Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
initial sample
|
 |
|||
|
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{567D1A1A-5618-11EB-90EB-ECF4BBEA1588}.dat
|
Microsoft Word Document
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{567D1A1C-5618-11EB-90EB-ECF4BBEA1588}.dat
|
Microsoft Word Document
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{567D1A1D-5618-11EB-90EB-ECF4BBEA1588}.dat
|
Microsoft Word Document
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\2_bc3d32a696895f78c19df6c717586a5d[1].svg
|
SVG Scalable Vector Graphics image
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ConvergedLogin_PCore_jwYGVbAxVLRxtzxSQp7jCQ2[1].js
|
ASCII text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\arrow_px_up[1].gif
|
GIF image data, version 89a, 7 x 9
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\authorize[1].htm
|
HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cf-7c36ab[1].css
|
UTF-8 Unicode text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\converged_ux_v2_RfnRCrmapm3W_OFn994CMA2[1].css
|
ASCII text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-1.7.2.min[1].js
|
HTML document, UTF-8 Unicode text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js
|
UTF-8 Unicode text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\lwsignupstringscountrybirthdate_en-us_pVtahKS9WUIZdNqg1DDhHg2[1].js
|
HTML document, UTF-8 Unicode text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg
|
SVG Scalable Vector Graphics image
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\print-icon[1].png
|
PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\script[1].js
|
UTF-8 Unicode text, with very long lines, with no line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\script[2].js
|
ASCII text, with very long lines, with no line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\50-f1e180[1].js
|
ASCII text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Print[1].png
|
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2[1].js
|
ASCII text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico
|
MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-1.11.2.min[1].js
|
ASCII text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js
|
ASCII text, with very long lines, with CRLF, LF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[1].eot
|
Embedded OpenType (EOT), Segoe UI Semibold family
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[2].eot
|
Embedded OpenType (EOT), Segoe UI Light family
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[3].eot
|
Embedded OpenType (EOT), Segoe UI family
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\lightweightsignuppackage_mStdClDku7grp_TX7Xaf-g2[1].js
|
UTF-8 Unicode text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg
|
SVG Scalable Vector Graphics image
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\override[1].css
|
ASCII text, with very long lines, with CRLF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\privacystatement[1].htm
|
HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\script[1].js
|
ASCII text, with very long lines, with no line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\signup[1].htm
|
HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg
|
SVG Scalable Vector Graphics image
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\app[1].css
|
ASCII text, with very long lines, with CRLF, LF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\converged.v2.login.min_rayhgcterrtxpnvapp3erg2[1].css
|
ASCII text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\favicon[1].ico
|
MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\favicon[2].ico
|
MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\mwfmdl2-v3.54[1].woff
|
Web Open Font Format, TrueType, length 26288, version 0.0
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\override[1].css
|
ASCII text, with very long lines, with CRLF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\shell.min[1].css
|
UTF-8 Unicode text, with very long lines, with no line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\style[1].css
|
ASCII text, with very long lines, with no line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ux.converged.login.strings-en.min_xw0hy9kamszck8doonyj8g2[1].js
|
UTF-8 Unicode text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\wcp-consent[1].js
|
UTF-8 Unicode text, with very long lines, with no line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg
|
SVG Scalable Vector Graphics image
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\50-f1e180[1].js
|
ASCII text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\Me[1].htm
|
HTML document, ASCII text, with very long lines, with CRLF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE1Mu3b[1].png
|
PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\cf-7c36ab[1].css
|
UTF-8 Unicode text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\dropdown_caret_KXSZjGsyILZaoTf0sI9X-A2[1].svg
|
SVG Scalable Vector Graphics image
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\favicon[1].ico
|
MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\favicon[2].ico
|
MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\icons[1].eot
|
Embedded OpenType (EOT), icons family
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg
|
SVG Scalable Vector Graphics image
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\oneds_Xr2D7Nex80v7A-8bxF8jgQ2[1].js
|
ASCII text, with very long lines, with CRLF, LF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\servicesagreement[1].htm
|
HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\style[1].css
|
UTF-8 Unicode text, with very long lines, with no line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Temp\~DF71AF7237989E274B.TMP
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\~DFB66D0A2BAC6D7BF1.TMP
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\~DFBBE7D503EFF5E58B.TMP
|
data
|
dropped
|
|
There are 50 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\internet explorer\iexplore.exe
|
'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
|
|
|
|
C:\Program Files (x86)\Internet Explorer\iexplore.exe
|
'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6768 CREDAT:17410 /prefetch:2
|
|
|
|
C:\Windows\System32\TokenBrokerCookies.exe
|
C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAABAOz_AwD0_5mUgr2fSv4NxRRKhIfqZP9fUQosM2-hJX8votGQsH2PQuCecfPy-WPQWQ7eiFMW6_yA4NTsqZVOGf6tlSk0LBwgAA&rid=e376dce7-fc39-4390-87c3-8fadf9f10a00
ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 1838406162 30864677 1
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://aka.ms/useterms
|
unknown
|
|
|
|
https://aka.ms/redeemrewards
|
unknown
|
|
|
|
https://login.microsoftonline.com/
|
unknown
|
|
|
|
https://signin.kissmetrics.com/privacy/#controls
|
unknown
|
|
|
|
https://login.skype.com/login
|
unknown
|
|
|
|
https://www.acuityads.com/opt-out/
|
unknown
|
|
|
|
https://www.skype.com/go/ustax
|
unknown
|
|
|
|
http://jquery.org/license
|
unknown
|
|
|
|
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_jwYGVbAxVLRxtzxSQp7jCQ2.js
|
unknown
|
|
|
|
https://acctcdn.msauth.net
|
unknown
|
|
|
|
https://signup.live.cotonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc
|
unknown
|
|
|
|
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(
|
unknown
|
|
|
|
https://www.optimizely.com/legal/opt-out/
|
unknown
|
|
|
|
http://sizzlejs.com/
|
unknown
|
|
|
|
https://www.youradchoices.ca/fr
|
unknown
|
|
|
|
https://acctcdn.msauth.net/lwsignupstringscountrybirthdate_en-us_pVtahKS9WUIZdNqg1DDhHg2.js?v=1
|
unknown
|
|
|
|
https://www.adr.org
|
unknown
|
|
|
|
https://www.xbox.com/en-US/Legal/CodeOfConduct)
|
unknown
|
|
|
|
http://www.asp.net/ajaxlibrary/CDN.ashx.
|
unknown
|
|
|
|
https://signup.live.com/error.aspx?errcode=1045&mkt=en-US
|
unknown
|
|
|
|
https://login.windows-ppe.net
|
unknown
|
|
|
|
https://www.xbox.com/en-US/Legal/CodeOfConduct
|
unknown
|
|
|
|
https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns
|
|
||
|
http://opensource.org/licenses/mit-license.php)
|
unknown
|
|
|
|
http://www.json.org/json2.js
|
unknown
|
|
|
|
https://aka.ms/taxservice
|
unknown
|
|
|
|
https://www.privacyshield.gov/welcome
|
unknown
|
|
|
|
https://login.microsoftonline.com
|
unknown
|
|
|
|
https://ondemand.webtrends.com/support/optout.asp
|
unknown
|
|
|
|
https://www.skype.com/go/legal.broadcast
|
unknown
|
|
|
|
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~
|
unknown
|
|
|
|
https://skype.com/go/myaccount
|
unknown
|
|
|
|
https://www.skype.com
|
unknown
|
|
|
|
https://www.appsflyer.com/optout
|
unknown
|
|
|
|
https://privacy.micros
|
unknown
|
|
|
|
https://www.appnexus.com/
|
unknown
|
|
|
|
https://acctcdn.msauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1
|
unknown
|
|
|
|
https://aka.ms/redeemrewards).
|
unknown
|
|
|
|
https://login.microsoftonline.com/jsdisabled
|
unknown
|
|
|
|
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
|
unknown
|
|
|
|
http://www.mpegla.com
|
unknown
|
|
|
|
https://www.youradchoices.ca
|
unknown
|
|
|
|
https://priv-policy.imrworldwide.com/priv/browser/us/en/optout.html
|
unknown
|
|
|
|
http://github.com/requirejs/almond/LICENSE
|
unknown
|
|
|
|
https://www.youronlinechoices.com/
|
unknown
|
|
|
|
https://mixer.com/contact
|
unknown
|
|
|
|
https://www.here.com/)
|
unknown
|
|
|
|
https://www.skype.com/go/store.reactivate.credit
|
unknown
|
|
|
|
https://acctcdn.msauth.net/lightweightsignuppackage_mStdClDku7grp_TX7Xaf-g2.js?v=1
|
unknown
|
|
|
|
https://www.aboutads.info/
|
unknown
|
|
|
|
https://www.adjust.com/opt-out/
|
unknown
|
|
|
|
https://www.xbox.com/managedatacollection
|
unknown
|
|
|
|
https://signup.live.com/
|
unknown
|
|
|
|
https://www.xbox.com/xbox-game-studios)
|
unknown
|
|
|
|
https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
|
unknown
|
|
|
|
https://acctcdn.msauth.net/images/favicon.ico?v=2~
|
unknown
|
|
|
|
https://developer.yahoo.com/flurry/end-user-opt-out/
|
unknown
|
|
|
|
http://fontello.com
|
unknown
|
|
|
|
http://www.mpegla.com).
|
unknown
|
|
|
|
https://signup.live.co
|
unknown
|
|
|
|
https://acctcdn.msauth.net/jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2.js?v=1
|
unknown
|
|
|
|
https://www.skype.com).
|
unknown
|
|
|
|
https://www.xbox.com
|
unknown
|
|
|
|
http://knockoutjs.com/
|
unknown
|
|
|
|
https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protectio
|
unknown
|
|
|
|
https://github.com/douglascrockford/JSON-js
|
unknown
|
|
|
|
https://www.clicktale.net/disable.html
|
unknown
|
|
|
|
https://acctcdn.msauth.net/images/favicon.ico?v=2~(
|
unknown
|
|
|
|
https://www.skype.com/go/allrates
|
unknown
|
|
|
|
https://acctcdn.msauth.net/converged_ux_v2_RfnRCrmapm3W_OFn994CMA2.css?v=1
|
unknown
|
|
|
|
http://www.opensource.org/licenses/mit-license.php)
|
unknown
|
|
|
|
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_xw0hy9kams
|
unknown
|
|
|
|
https://www.xbox.com/xbox-game-studios
|
unknown
|
|
|
|
http://fontello.comiconsRegulariconsiconsVersion
|
unknown
|
|
|
|
https://acctcdn.msauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg)
|
unknown
|
|
|
|
https://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html
|
unknown
|
|
|
|
https://www.skype.com/go/legal
|
unknown
|
|
|
|
https://mixer.com/about/tos
|
unknown
|
|
|
|
https://www.microsoft.
|
unknown
|
|
|
|
https://acctcdn.msauth.net/images/favicon.ico?v=2
|
unknown
|
|
|
|
https://aadcdn.msftauth.net
|
unknown
|
|
|
|
https://www.xbox.com/
|
unknown
|
|
|
|
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
|
unknown
|
|
|
|
https://www.linkedin.com/legal/privacy-policy
|
unknown
|
|
|
|
https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc
|
unknown
|
|
|
|
https://login.microsoftonline.com/0tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoft
|
unknown
|
|
|
|
http://jquery.com/
|
unknown
|
|
|
|
https://support.xbox.com/help/friends-social-activity/community/use-safety-settings
|
unknown
|
|
|
|
https://www.xbox.com/Legal/ThirdPartyDataSharing
|
unknown
|
|
There are 79 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
cs1100.wpc.omegacdn.net
|
152.199.23.37
|
|
|
|
sni1gl.wpc.alphacdn.net
|
152.199.21.175
|
|
|
|
signup.live.com
|
unknown
|
|
|
|
aadcdn.msftauth.net
|
unknown
|
|
|
|
protection.office.com
|
unknown
|
|
|
|
login.microsoftonline.com
|
unknown
|
|
|
|
assets.onestore.ms
|
unknown
|
|
|
|
acctcdn.msauth.net
|
unknown
|
|
|
|
ajax.aspnetcdn.com
|
unknown
|
|
IPs
|
IP
|
Domain
|
Country
|
Active
|
Malicious
|
|
|---|---|---|---|---|---|
|
152.199.21.175
|
unknown
|
United States
|
unknown
|
|
|
|
152.199.23.37
|
unknown
|
United States
|
unknown
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\internet explorer\iexplore.exe
|
{567D1A1A-5618-11EB-90EB-ECF4BBEA1588}
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
{14654CA6-5711-491D-B89A-58E571679951} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LangID
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
C:\Windows\System32\tbauth.dll.FriendlyAppName
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
C:\Windows\System32\tbauth.dll.ApplicationCompany
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Blocked
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LoadTimeArray
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LoadTimeArray
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Blocked
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LoadTimeArray
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LoadTimeArray
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
DecayDateQueue
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LastProcessed
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
DecayDateQueue
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LastProcessed
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
CVListPingLastYMD
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
DecayDateQueue
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LastProcessed
|
|
|
|
C:\Program Files (x86)\Internet Explorer\iexplore.exe
|
@C:\Windows\System32\ieframe.dll,-912
|
|
|
|
C:\Program Files (x86)\Internet Explorer\iexplore.exe
|
@C:\Windows\System32\ieframe.dll,-904
|
|
There are 22 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
28CF293D000
|
unkown
|
page read and write
|
|
|
|
21D59E54000
|
unkown
|
page read and write
|
|
|
|
7FF57AD3C000
|
unkown
|
page readonly
|
|
|
|
1DA67F40000
|
unkown
|
page readonly
|
|
|
|
7FF57AC4B000
|
unkown
|
page readonly
|
|
|
|
7FF58935B000
|
unkown
|
page readonly
|
|
|
|
30C877000
|
unkown
|
page read and write
|
|
|
|
7FF5BB4D4000
|
unkown
|
page readonly
|
|
|
|
7FF5CF24B000
|
unkown
|
page readonly
|
|
|
|
7FF4F3EEE000
|
unkown
|
page readonly
|
|
|
|
1D440AD6000
|
unkown
|
page read and write
|
|
|
|
7FF50024A000
|
unkown
|
page readonly
|
|
|
|
2159ED80000
|
heap private
|
page read and write
|
|
|
|
7FF4FFED7000
|
unkown
|
page readonly
|
|
|
|
7FF5001D4000
|
unkown
|
page readonly
|
|
|
|
7FF58038E000
|
unkown
|
page readonly
|
|
|
|
1D440ADB000
|
unkown
|
page read and write
|
|
|
|
9FE051E000
|
unkown
|
page read and write
|
|
|
|
18C78100000
|
unkown
|
page read and write
|
|
|
|
99E57D000
|
unkown
|
page read and write
|
|
|
|
21D59E70000
|
unkown
|
page read and write
|
|
|
|
99DFEE000
|
unkown
|
page read and write
|
|
|
|
7FF527934000
|
unkown
|
page readonly
|
|
|
|
7FF5278AF000
|
unkown
|
page readonly
|
|
|
|
1DA67D30000
|
heap private
|
page read and write
|
|
|
|
21D59DF0000
|
unkown
|
page read and write
|
|
|
|
8D692FF000
|
unkown
|
page read and write
|
|
|
|
7FF4F3F01000
|
unkown
|
page readonly
|
|
|
|
7FF5001FE000
|
unkown
|
page readonly
|
|
|
|
1DA69410000
|
unkown
|
page readonly
|
|
|
|
7FF58039D000
|
unkown
|
page readonly
|
|
|
|
28CF1F80000
|
unkown
|
page readonly
|
|
|
|
1D443010000
|
unkown
|
page read and write
|
|
|
|
7FF5893B8000
|
unkown
|
page readonly
|
|
|
|
1D442470000
|
unkown
|
page read and write
|
|
|
|
7FF5893C6000
|
unkown
|
page readonly
|
|
|
|
1DA67CF0000
|
unkown
|
page readonly
|
|
|
|
7FF5D1E64000
|
unkown
|
page readonly
|
|
|
|
99E3FA000
|
unkown
|
page read and write
|
|
|
|
7FF5002E4000
|
unkown
|
page readonly
|
|
|
|
21D59F08000
|
unkown
|
page read and write
|
|
|
|
59D18FF000
|
unkown
|
page read and write
|
|
|
|
1D440960000
|
unkown
|
page write copy
|
|
|
|
165963E0000
|
unkown
|
page read and write
|
|
|
|
18C7805B000
|
unkown
|
page read and write
|
|
|
|
7FF5893A4000
|
unkown
|
page readonly
|
|
|
|
1F9350C0000
|
unkown
|
page readonly
|
|
|
|
28CF27A0000
|
unkown
|
page read and write
|
|
|
|
C2658FA000
|
unkown
|
page read and write
|
|
|
|
1DA67960000
|
unkown
|
page read and write
|
|
|
|
7FF527894000
|
unkown
|
page readonly
|
|
|
|
1D442920000
|
unkown
|
page read and write
|
|
|
|
7FF55174C000
|
unkown
|
page readonly
|
|
|
|
7FF4F3CE1000
|
unkown
|
page readonly
|
|
|
|
7FF527855000
|
unkown
|
page readonly
|
|
|
|
18C7803C000
|
unkown
|
page read and write
|
|
|
|
7FF5CF188000
|
unkown
|
page readonly
|
|
|
|
1F9354B0000
|
unkown
|
page readonly
|
|
|
|
1F935280000
|
heap default
|
page read and write
|
|
|
|
9FE059E000
|
unkown
|
page read and write
|
|
|
|
7FF4F3E53000
|
unkown
|
page readonly
|
|
|
|
7FF580411000
|
unkown
|
page readonly
|
|
|
|
7FF5CF2DF000
|
unkown
|
page readonly
|
|
|
|
1DA69510000
|
heap private
|
page read and write
|
|
|
|
7FF5BB482000
|
unkown
|
page readonly
|
|
|
|
7FF57FB7D000
|
unkown
|
page readonly
|
|
|
|
7FF4F3C6F000
|
unkown
|
page readonly
|
|
|
|
1B9D26E9000
|
heap default
|
page read and write
|
|
|
|
7FF5CF0C1000
|
unkown
|
page readonly
|
|
|
|
7FF5CEFF7000
|
unkown
|
page readonly
|
|
|
|
7FF5CF222000
|
unkown
|
page readonly
|
|
|
|
7FF5512E6000
|
unkown
|
page readonly
|
|
|
|
1F935210000
|
unkown
|
page read and write
|
|
|
|
1F9351F0000
|
unkown
|
page read and write
|
|
|
|
1D440AA7000
|
unkown
|
page read and write
|
|
|
|
21D59E29000
|
unkown
|
page read and write
|
|
|
|
28CF20DF000
|
unkown
|
page read and write
|
|
|
|
28CF2953000
|
unkown
|
page read and write
|
|
|
|
7FF5892E6000
|
unkown
|
page readonly
|
|
|
|
8D6947F000
|
unkown
|
page read and write
|
|
|
|
7FF5512E0000
|
unkown
|
page readonly
|
|
|
|
16596443000
|
heap default
|
page read and write
|
|
|
|
7FF5CF364000
|
unkown
|
page readonly
|
|
|
|
7FF5893C9000
|
unkown
|
page readonly
|
|
|
|
1DA679BB000
|
heap default
|
page read and write
|
|
|
|
7FF4F3CC4000
|
unkown
|
page readonly
|
|
|
|
7FF57AD5B000
|
unkown
|
page readonly
|
|
|
|
7FF57AC31000
|
unkown
|
page readonly
|
|
|
|
28CF292E000
|
unkown
|
page read and write
|
|
|
|
1D442C00000
|
unkown
|
page readonly
|
|
|
|
F02367F000
|
unkown
|
page read and write
|
|
|
|
7FF57ADB8000
|
unkown
|
page readonly
|
|
|
|
F0230AC000
|
unkown
|
page read and write
|
|
|
|
21D59E00000
|
unkown
|
page read and write
|
|
|
|
7FF58034C000
|
unkown
|
page readonly
|
|
|
|
7FF5800DB000
|
unkown
|
page readonly
|
|
|
|
4214B7E000
|
unkown
|
page read and write
|
|
|
|
8D6927C000
|
unkown
|
page read and write
|
|
|
|
7FF5BB4F9000
|
unkown
|
page readonly
|
|
|
|
7FF5BB572000
|
unkown
|
page readonly
|
|
|
|
28CF22D0000
|
unkown
|
page readonly
|
|
|
|
1D440A70000
|
unkown
|
page read and write
|
|
|
|
21D59F02000
|
unkown
|
page read and write
|
|
|
|
7FF50022C000
|
unkown
|
page readonly
|
|
|
|
59D1779000
|
unkown
|
page read and write
|
|
|
|
1DA67A80000
|
unkown
|
page readonly
|
|
|
|
1D442570000
|
unkown
|
page readonly
|
|
|
|
2159ED90000
|
unkown
|
page readonly
|
|
|
|
21D59E13000
|
unkown
|
page read and write
|
|
|
|
7FF4FFECF000
|
unkown
|
page readonly
|
|
|
|
18C78102000
|
unkown
|
page read and write
|
|
|
|
1D440A29000
|
unkown
|
page read and write
|
|
|
|
7FF4F3791000
|
unkown
|
page readonly
|
|
|
|
7FF5D1E12000
|
unkown
|
page readonly
|
|
|
|
7FF551601000
|
unkown
|
page readonly
|
|
|
|
21D59F13000
|
unkown
|
page read and write
|
|
|
|
28CF1FA0000
|
unkown
|
page read and write
|
|
|
|
7FF55161B000
|
unkown
|
page readonly
|
|
|
|
7FF5BB4CA000
|
unkown
|
page readonly
|
|
|
|
7FF5CF25F000
|
unkown
|
page readonly
|
|
|
|
7FF5CF297000
|
unkown
|
page readonly
|
|
|
|
1D442B02000
|
unkown
|
page read and write
|
|
|
|
28CF2962000
|
unkown
|
page read and write
|
|
|
|
7FF5CF1E4000
|
unkown
|
page readonly
|
|
|
|
1D442920000
|
unkown
|
page read and write
|
|
|
|
2159ED85000
|
heap private
|
page read and write
|
|
|
|
16596655000
|
heap private
|
page read and write
|
|
|
|
7FF5278BE000
|
unkown
|
page readonly
|
|
|
|
7FF4F3EA7000
|
unkown
|
page readonly
|
|
|
|
7FF58031A000
|
unkown
|
page readonly
|
|
|
|
7FF55170A000
|
unkown
|
page readonly
|
|
|
|
2159EAF0000
|
heap default
|
page read and write
|
|
|
|
28CF2052000
|
unkown
|
page read and write
|
|
|
|
7FF57A596000
|
unkown
|
page readonly
|
|
|
|
7FF5D1EFA000
|
unkown
|
page readonly
|
|
|
|
7FF4FFECA000
|
unkown
|
page readonly
|
|
|
|
8D6937E000
|
unkown
|
page read and write
|
|
|
|
7FF58031E000
|
unkown
|
page readonly
|
|
|
|
7FF4F3B5A000
|
unkown
|
page readonly
|
|
|
|
7FF580228000
|
unkown
|
page readonly
|
|
|
|
7FF57AD3A000
|
unkown
|
page readonly
|
|
|
|
1659644B000
|
heap default
|
page read and write
|
|
|
|
7FF5CF17B000
|
unkown
|
page readonly
|
|
|
|
7FF580141000
|
unkown
|
page readonly
|
|
|
|
7FF500276000
|
unkown
|
page readonly
|
|
|
|
7FF58902A000
|
unkown
|
page readonly
|
|
|
|
7FF58943A000
|
unkown
|
page readonly
|
|
|
|
7FF5D1EF4000
|
unkown
|
page readonly
|
|
|
|
1D440A00000
|
unkown
|
page read and write
|
|
|
|
28CF1F10000
|
heap private
|
page read and write
|
|
|
|
1DA67D40000
|
unkown
|
page readonly
|
|
|
|
1DA696B0000
|
heap private
|
page read and write
|
|
|
|
7FF5BB4C4000
|
unkown
|
page readonly
|
|
|
|
9FE0A77000
|
unkown
|
page read and write
|
|
|
|
7FF5CF2B7000
|
unkown
|
page readonly
|
|
|
|
1D440A6C000
|
unkown
|
page read and write
|
|
|
|
18CC3642000
|
unkown
|
page read and write
|
|
|
|
7FF551737000
|
unkown
|
page readonly
|
|
|
|
21D59C30000
|
unkown
|
page readonly
|
|
|
|
7FF55161E000
|
unkown
|
page readonly
|
|
|
|
7FF4F3D93000
|
unkown
|
page readonly
|
|
|
|
7FF5CF2F6000
|
unkown
|
page readonly
|
|
|
|
1D4428C0000
|
heap private
|
page read and write
|
|
|
|
7FF5CF2AF000
|
unkown
|
page readonly
|
|
|
|
7FF57AC9D000
|
unkown
|
page readonly
|
|
|
|
1DA6798B000
|
heap default
|
page read and write
|
|
|
|
21D59F00000
|
unkown
|
page read and write
|
|
|
|
7FF589145000
|
unkown
|
page readonly
|
|
|
|
7FF5D1E1B000
|
unkown
|
page readonly
|
|
|
|
7FF57AD4E000
|
unkown
|
page readonly
|
|
|
|
7FF4F3E32000
|
unkown
|
page readonly
|
|
|
|
21D59E4F000
|
unkown
|
page read and write
|
|
|
|
21D59D00000
|
unkown
|
page readonly
|
|
|
|
21D59E3C000
|
unkown
|
page read and write
|
|
|
|
7FF5CF2CA000
|
unkown
|
page readonly
|
|
|
|
7FF4F36ED000
|
unkown
|
page readonly
|
|
|
|
21D59BC0000
|
heap private
|
page read and write
|
|
|
|
7FF57A916000
|
unkown
|
page readonly
|
|
|
|
7FF55166D000
|
unkown
|
page readonly
|
|
|
|
8D6957E000
|
unkown
|
page read and write
|
|
|
|
7FF527941000
|
unkown
|
page readonly
|
|
|
|
7FF5893CD000
|
unkown
|
page readonly
|
|
|
|
7FF4FFD62000
|
unkown
|
page readonly
|
|
|
|
28CF2730000
|
unkown
|
page write copy
|
|
|
|
7FF500254000
|
unkown
|
page readonly
|
|
|
|
7FF5CF161000
|
unkown
|
page readonly
|
|
|
|
1D440A6E000
|
unkown
|
page read and write
|
|
|
|
18C78066000
|
unkown
|
page read and write
|
|
|
|
7FF57ACB4000
|
unkown
|
page readonly
|
|
|
|
16596510000
|
unkown
|
page readonly
|
|
|
|
7FF57AD94000
|
unkown
|
page readonly
|
|
|
|
7FF5278CD000
|
unkown
|
page readonly
|
|
|
|
7FF4F3B67000
|
unkown
|
page readonly
|
|
|
|
1DA69350000
|
unkown
|
page readonly
|
|
|
|
7FF580325000
|
unkown
|
page readonly
|
|
|
|
F0235FF000
|
unkown
|
page read and write
|
|
|
|
7FF5278C9000
|
unkown
|
page readonly
|
|
|
|
7FF551811000
|
unkown
|
page readonly
|
|
|
|
7FF5CEAC6000
|
unkown
|
page readonly
|
|
|
|
18C77F30000
|
heap private
|
page read and write
|
|
|
|
7FF57AE3A000
|
unkown
|
page readonly
|
|
|
|
1B9D2510000
|
unkown
|
page readonly
|
|
|
|
21D5A000000
|
unkown
|
page readonly
|
|
|
|
16596650000
|
heap private
|
page read and write
|
|
|
|
7FF4F3B5F000
|
unkown
|
page readonly
|
|
|
|
18CC4FF0000
|
unkown
|
page read and write
|
|
|
|
1B9D2570000
|
unkown
|
page readonly
|
|
|
|
7FF4F3EC7000
|
unkown
|
page readonly
|
|
|
|
7FF5CF280000
|
unkown
|
page readonly
|
|
|
|
42147FF000
|
unkown
|
page read and write
|
|
|
|
7FF551720000
|
unkown
|
page readonly
|
|
|
|
7FF5CF2E8000
|
unkown
|
page readonly
|
|
|
|
7FF5CF1D3000
|
unkown
|
page readonly
|
|
|
|
7FF5CEE97000
|
unkown
|
page readonly
|
|
|
|
7FF580388000
|
unkown
|
page readonly
|
|
|
|
914339E000
|
unkown
|
page read and write
|
|
|
|
7FF5802C0000
|
unkown
|
page readonly
|
|
|
|
1DA697AF000
|
heap private
|
page read and write
|
|
|
|
7FF4FFFC6000
|
unkown
|
page readonly
|
|
|
|
7FF55176A000
|
unkown
|
page readonly
|
|
|
|
7FF5CEE40000
|
unkown
|
page readonly
|
|
|
|
28CF2000000
|
unkown
|
page read and write
|
|
|
|
1B9D2990000
|
unkown
|
page readonly
|
|
|
|
7FF5CF080000
|
unkown
|
page readonly
|
|
|
|
914377F000
|
unkown
|
page read and write
|
|
|
|
7FF5BB4E8000
|
unkown
|
page readonly
|
|
|
|
18CC3602000
|
unkown
|
page read and write
|
|
|
|
7FF500051000
|
unkown
|
page readonly
|
|
|
|
7FF5CF2D4000
|
unkown
|
page readonly
|
|
|
|
28CF20A1000
|
unkown
|
page read and write
|
|
|
|
7FF55172B000
|
unkown
|
page readonly
|
|
|
|
1DA678E0000
|
unkown
|
page readonly
|
|
|
|
7FF5D1E15000
|
unkown
|
page readonly
|
|
|
|
7FF52785B000
|
unkown
|
page readonly
|
|
|
|
28CF2900000
|
unkown
|
page read and write
|
|
|
|
1D440AA5000
|
unkown
|
page read and write
|
|
|
|
1F93528B000
|
heap default
|
page read and write
|
|
|
|
28CF20C3000
|
unkown
|
page read and write
|
|
|
|
7FF580337000
|
unkown
|
page readonly
|
|
|
|
42146FA000
|
unkown
|
page read and write
|
|
|
|
1DA67D35000
|
heap private
|
page read and write
|
|
|
|
1D442B17000
|
unkown
|
page read and write
|
|
|
|
18C77FB0000
|
unkown
|
page readonly
|
|
|
|
18C78802000
|
unkown
|
page read and write
|
|
|
|
28CF20A5000
|
unkown
|
page read and write
|
|
|
|
28CF27B0000
|
unkown
|
page readonly
|
|
|
|
7FF4F3D98000
|
unkown
|
page readonly
|
|
|
|
7FF57AD9A000
|
unkown
|
page readonly
|
|
|
|
7FF57AD4A000
|
unkown
|
page readonly
|
|
|
|
1F9352AF000
|
heap default
|
page read and write
|
|
|
|
7FF5278A4000
|
unkown
|
page readonly
|
|
|
|
28CF2965000
|
unkown
|
page read and write
|
|
|
|
7FF5CF28B000
|
unkown
|
page readonly
|
|
|
|
7FF5278B8000
|
unkown
|
page readonly
|
|
|
|
7FF5D1F01000
|
unkown
|
page readonly
|
|
|
|
7FF4F3E7A000
|
unkown
|
page readonly
|
|
|
|
1B9D2680000
|
unkown
|
page readonly
|
|
|
|
7FF4F3F82000
|
unkown
|
page readonly
|
|
|
|
7FF580358000
|
unkown
|
page readonly
|
|
|
|
8528FE000
|
unkown
|
page read and write
|
|
|
|
28CF2013000
|
unkown
|
page read and write
|
|
|
|
21D59E4B000
|
unkown
|
page read and write
|
|
|
|
16596410000
|
heap default
|
page read and write
|
|
|
|
7FF5BB485000
|
unkown
|
page readonly
|
|
|
|
7FF580320000
|
unkown
|
page readonly
|
|
|
|
C2656F7000
|
unkown
|
page read and write
|
|
|
|
1D442A02000
|
unkown
|
page read and write
|
|
|
|
18CC3702000
|
unkown
|
page read and write
|
|
|
|
7FF5BB480000
|
unkown
|
page readonly
|
|
|
|
9FE0D7F000
|
unkown
|
page read and write
|
|
|
|
7FF580374000
|
unkown
|
page readonly
|
|
|
|
7FF55179D000
|
unkown
|
page readonly
|
|
|
|
7FF5512F5000
|
unkown
|
page readonly
|
|
|
|
7FF580145000
|
unkown
|
page readonly
|
|
|
|
30C6FB000
|
unkown
|
page read and write
|
|
|
|
7FF5D1E10000
|
unkown
|
page readonly
|
|
|
|
28CF292A000
|
unkown
|
page read and write
|
|
|
|
1D440A81000
|
unkown
|
page read and write
|
|
|
|
7FF551571000
|
unkown
|
page readonly
|
|
|
|
9FE097F000
|
unkown
|
page read and write
|
|
|
|
7FF57ADCD000
|
unkown
|
page readonly
|
|
|
|
7FF57FFEF000
|
unkown
|
page readonly
|
|
|
|
28CF20F9000
|
unkown
|
page read and write
|
|
|
|
7FF5BB48B000
|
unkown
|
page readonly
|
|
|
|
7FF5CF12A000
|
unkown
|
page readonly
|
|
|
|
30C97F000
|
unkown
|
page read and write
|
|
|
|
7FF57FFDC000
|
unkown
|
page readonly
|
|
|
|
59D13CB000
|
unkown
|
page read and write
|
|
|
|
7FF527852000
|
unkown
|
page readonly
|
|
|
|
28CF295B000
|
unkown
|
page read and write
|
|
|
|
7FF5CF0B4000
|
unkown
|
page readonly
|
|
|
|
7FF500244000
|
unkown
|
page readonly
|
|
|
|
7FF55180A000
|
unkown
|
page readonly
|
|
|
|
7FF52793A000
|
unkown
|
page readonly
|
|
|
|
7FF5893E3000
|
unkown
|
page readonly
|
|
|
|
7FF5CEDEE000
|
unkown
|
page readonly
|
|
|
|
9FE049B000
|
unkown
|
page read and write
|
|
|
|
7FF4F3CD1000
|
unkown
|
page readonly
|
|
|
|
7FF4F3F09000
|
unkown
|
page readonly
|
|
|
|
421477E000
|
unkown
|
page read and write
|
|
|
|
7FF5D1E7E000
|
unkown
|
page readonly
|
|
|
|
7FF5CF24F000
|
unkown
|
page readonly
|
|
|
|
7FF5BB564000
|
unkown
|
page readonly
|
|
|
|
7FF5CEF5A000
|
unkown
|
page readonly
|
|
|
|
2159EAF9000
|
heap default
|
page read and write
|
|
|
|
18CC3613000
|
unkown
|
page read and write
|
|
|
|
7FF4F3C68000
|
unkown
|
page readonly
|
|
|
|
7FF550F66000
|
unkown
|
page readonly
|
|
|
|
7FF58040A000
|
unkown
|
page readonly
|
|
|
|
18C77FA0000
|
unkown
|
page readonly
|
|
|
|
7FF551684000
|
unkown
|
page readonly
|
|
|
|
7FF4F3C56000
|
unkown
|
page readonly
|
|
|
|
7FF4F3EE4000
|
unkown
|
page readonly
|
|
|
|
4214A7E000
|
unkown
|
page read and write
|
|
|
|
7FF580223000
|
unkown
|
page readonly
|
|
|
|
7FF5CF27A000
|
unkown
|
page readonly
|
|
|
|
59D17FA000
|
unkown
|
page read and write
|
|
|
|
28CF2113000
|
unkown
|
page read and write
|
|
|
|
7FF5802C2000
|
unkown
|
page readonly
|
|
|
|
7FF50025E000
|
unkown
|
page readonly
|
|
|
|
7FF55174F000
|
unkown
|
page readonly
|
|
|
|
7FF5CF0B6000
|
unkown
|
page readonly
|
|
|
|
1D4428B0000
|
unkown
|
page readonly
|
|
|
|
1D440AF6000
|
unkown
|
page read and write
|
|
|
|
18CC3500000
|
unkown
|
page readonly
|
|
|
|
28CF2082000
|
unkown
|
page read and write
|
|
|
|
7FF50026E000
|
unkown
|
page readonly
|
|
|
|
1B9D2980000
|
heap private
|
page read and write
|
|
|
|
7FF500279000
|
unkown
|
page readonly
|
|
|
|
7FF5CF26C000
|
unkown
|
page readonly
|
|
|
|
7FF50020B000
|
unkown
|
page readonly
|
|
|
|
7FF4F3F7A000
|
unkown
|
page readonly
|
|
|
|
7FF5D1E89000
|
unkown
|
page readonly
|
|
|
|
7FF588BF6000
|
unkown
|
page readonly
|
|
|
|
7FF527515000
|
unkown
|
page readonly
|
|
|
|
7FF551796000
|
unkown
|
page readonly
|
|
|
|
C2651FF000
|
unkown
|
page read and write
|
|
|
|
1DA69360000
|
unkown
|
page readonly
|
|
|
|
7FF4F3F06000
|
unkown
|
page readonly
|
|
|
|
1D4409B0000
|
unkown
|
page readonly
|
|
|
|
28CF207B000
|
unkown
|
page read and write
|
|
|
|
1D440B02000
|
unkown
|
page read and write
|
|
|
|
C2657FE000
|
unkown
|
page read and write
|
|
|
|
7FF580396000
|
unkown
|
page readonly
|
|
|
|
7FF4F3CB1000
|
unkown
|
page readonly
|
|
|
|
7FF5CF36A000
|
unkown
|
page readonly
|
|
|
|
99E67F000
|
unkown
|
page read and write
|
|
|
|
59D187F000
|
unkown
|
page read and write
|
|
|
|
7FF5BB4EE000
|
unkown
|
page readonly
|
|
|
|
16596380000
|
unkown
|
page readonly
|
|
|
|
7FF551774000
|
unkown
|
page readonly
|
|
|
|
7FF551788000
|
unkown
|
page readonly
|
|
|
|
7FF5BB4B8000
|
unkown
|
page readonly
|
|
|
|
7FF589367000
|
unkown
|
page readonly
|
|
|
|
7FF551799000
|
unkown
|
page readonly
|
|
|
|
C2655FB000
|
unkown
|
page read and write
|
|
|
|
30C5F5000
|
unkown
|
page read and write
|
|
|
|
1D4408F0000
|
heap private
|
page read and write
|
|
|
|
7FF57ADAF000
|
unkown
|
page readonly
|
|
|
|
7FF4F3EBF000
|
unkown
|
page readonly
|
|
|
|
9FE08F5000
|
unkown
|
page read and write
|
|
|
|
99E2FA000
|
unkown
|
page read and write
|
|
|
|
7FF5CF220000
|
unkown
|
page readonly
|
|
|
|
7FF5892E2000
|
unkown
|
page readonly
|
|
|
|
7FF4F39F2000
|
unkown
|
page readonly
|
|
|
|
7FF57ADBE000
|
unkown
|
page readonly
|
|
|
|
7FF4F3EF8000
|
unkown
|
page readonly
|
|
|
|
1D440AFC000
|
unkown
|
page read and write
|
|
|
|
7FF4F3E9B000
|
unkown
|
page readonly
|
|
|
|
28CF2802000
|
unkown
|
page read and write
|
|
|
|
7FF5BB4AC000
|
unkown
|
page readonly
|
|
|
|
1D442930000
|
unkown
|
page readonly
|
|
|
|
18C77FC0000
|
unkown
|
page read and write
|
|
|
|
C26517E000
|
unkown
|
page read and write
|
|
|
|
7FF4F3E95000
|
unkown
|
page readonly
|
|
|
|
8D694FE000
|
unkown
|
page read and write
|
|
|
|
7FF580404000
|
unkown
|
page readonly
|
|
|
|
7FF500217000
|
unkown
|
page readonly
|
|
|
|
7FF52789A000
|
unkown
|
page readonly
|
|
|
|
1D440A54000
|
unkown
|
page read and write
|
|
|
|
7FF57ADC6000
|
unkown
|
page readonly
|
|
|
|
7FF57AD67000
|
unkown
|
page readonly
|
|
|
|
7FF527942000
|
unkown
|
page readonly
|
|
|
|
18C78088000
|
unkown
|
page read and write
|
|
|
|
F02357E000
|
unkown
|
page read and write
|
|
|
|
85287E000
|
unkown
|
page read and write
|
|
|
|
7FF5D1E6E000
|
unkown
|
page readonly
|
|
|
|
C2654FC000
|
unkown
|
page read and write
|
|
|
|
7FF500238000
|
unkown
|
page readonly
|
|
|
|
1D442950000
|
unkown
|
page readonly
|
|
|
|
1DA67980000
|
heap default
|
page read and write
|
|
|
|
7FF580179000
|
unkown
|
page readonly
|
|
|
|
9FE0B7F000
|
unkown
|
page read and write
|
|
|
|
7FF580364000
|
unkown
|
page readonly
|
|
|
|
1D440B13000
|
unkown
|
page read and write
|
|
|
|
7FF4F3B4C000
|
unkown
|
page readonly
|
|
|
|
7FF55177F000
|
unkown
|
page readonly
|
|
|
|
7FF58937C000
|
unkown
|
page readonly
|
|
|
|
9FE0E7E000
|
unkown
|
page read and write
|
|
|
|
7FF589442000
|
unkown
|
page readonly
|
|
|
|
7FF500268000
|
unkown
|
page readonly
|
|
|
|
21D59C20000
|
heap default
|
page read and write
|
|
|
|
18CC3657000
|
unkown
|
page read and write
|
|
|
|
7FF4F3D71000
|
unkown
|
page readonly
|
|
|
|
7FF5CF2F9000
|
unkown
|
page readonly
|
|
|
|
28CF1F90000
|
unkown
|
page readonly
|
|
|
|
914367E000
|
unkown
|
page read and write
|
|
|
|
7FF4F3E5F000
|
unkown
|
page readonly
|
|
|
|
7FF4F3F74000
|
unkown
|
page readonly
|
|
|
|
7FF4F3E8E000
|
unkown
|
page readonly
|
|
|
|
7FF5CEE46000
|
unkown
|
page readonly
|
|
|
|
1DA69370000
|
unkown
|
page readonly
|
|
|
|
1F935120000
|
unkown
|
page readonly
|
|
|
|
91436FD000
|
unkown
|
page read and write
|
|
|
|
1DA69400000
|
heap private
|
page read and write
|
|
|
|
7FF580201000
|
unkown
|
page readonly
|
|
|
|
8527FD000
|
unkown
|
page read and write
|
|
|
|
30C77E000
|
unkown
|
page read and write
|
|
|
|
7FF5D1E54000
|
unkown
|
page readonly
|
|
|
|
7FF57AE42000
|
unkown
|
page readonly
|
|
|
|
2159EF90000
|
unkown
|
page readonly
|
|
|
|
91437FE000
|
unkown
|
page read and write
|
|
|
|
28CF2200000
|
unkown
|
page readonly
|
|
|
|
7FF5CF1EC000
|
unkown
|
page readonly
|
|
|
|
7FF57AC4E000
|
unkown
|
page readonly
|
|
|
|
7FF4F3A69000
|
unkown
|
page readonly
|
|
|
|
7FF500271000
|
unkown
|
page readonly
|
|
|
|
28CF2029000
|
unkown
|
page read and write
|
|
|
|
99E37E000
|
unkown
|
page read and write
|
|
|
|
7FF57ADC9000
|
unkown
|
page readonly
|
|
|
|
7FF527850000
|
unkown
|
page readonly
|
|
|
|
7FF589355000
|
unkown
|
page readonly
|
|
|
|
7FF5CF0D1000
|
unkown
|
page readonly
|
|
|
|
1F93529F000
|
heap default
|
page read and write
|
|
|
|
7FF500202000
|
unkown
|
page readonly
|
|
|
|
7FF5D1E3C000
|
unkown
|
page readonly
|
|
|
|
7FF4F3E7C000
|
unkown
|
page readonly
|
|
|
|
18CC3490000
|
heap private
|
page read and write
|
|
|
|
7FF589394000
|
unkown
|
page readonly
|
|
|
|
7FF5BB56A000
|
unkown
|
page readonly
|
|
|
|
7FF5CEE95000
|
unkown
|
page readonly
|
|
|
|
7FF551812000
|
unkown
|
page readonly
|
|
|
|
99E47B000
|
unkown
|
page read and write
|
|
|
|
1D440CD0000
|
unkown
|
page readonly
|
|
|
|
4214AFE000
|
unkown
|
page read and write
|
|
|
|
1B9D26E0000
|
heap default
|
page read and write
|
|
|
|
16596418000
|
heap default
|
page read and write
|
|
|
|
16596660000
|
unkown
|
page readonly
|
|
|
|
7FF5CF285000
|
unkown
|
page readonly
|
|
|
|
1DA679A6000
|
heap default
|
page read and write
|
|
|
|
852679000
|
unkown
|
page read and write
|
|
|
|
7FF4F3E22000
|
unkown
|
page readonly
|
|
|
|
7FF5CF046000
|
unkown
|
page readonly
|
|
|
|
28CF2913000
|
unkown
|
page read and write
|
|
|
|
28CF2780000
|
unkown
|
page readonly
|
|
|
|
7FF58934E000
|
unkown
|
page readonly
|
|
|
|
1D440A13000
|
unkown
|
page read and write
|
|
|
|
7FF4F3E2C000
|
unkown
|
page readonly
|
|
|
|
7FF4F3EFE000
|
unkown
|
page readonly
|
|
|
|
7FF57AD87000
|
unkown
|
page readonly
|
|
|
|
1D4409F0000
|
unkown
|
page read and write
|
|
|
|
18CC3850000
|
unkown
|
page readonly
|
|
|
|
9FE0C7D000
|
unkown
|
page read and write
|
|
|
|
7FF527888000
|
unkown
|
page readonly
|
|
|
|
7FF589350000
|
unkown
|
page readonly
|
|
|
|
7FF551673000
|
unkown
|
page readonly
|
|
|
|
1D442B49000
|
unkown
|
page read and write
|
|
|
|
28CF1F70000
|
heap default
|
page read and write
|
|
|
|
16596446000
|
heap default
|
page read and write
|
|
|
|
7FF551757000
|
unkown
|
page readonly
|
|
|
|
99E279000
|
unkown
|
page read and write
|
|
|
|
18C78108000
|
unkown
|
page read and write
|
|
|
|
7FF5892EC000
|
unkown
|
page readonly
|
|
|
|
7FF5CF1CD000
|
unkown
|
page readonly
|
|
|
|
F02347F000
|
unkown
|
page read and write
|
|
|
|
18C78081000
|
unkown
|
page read and write
|
|
|
|
7FF57AE41000
|
unkown
|
page readonly
|
|
|
|
7FF55168C000
|
unkown
|
page readonly
|
|
|
|
2159EA90000
|
unkown
|
page readonly
|
|
|
|
28CF2660000
|
unkown
|
page readonly
|
|
|
|
7FF4F3E64000
|
unkown
|
page readonly
|
|
|
|
7FF5CEBD7000
|
unkown
|
page readonly
|
|
|
|
28CF203C000
|
unkown
|
page read and write
|
|
|
|
7FF551725000
|
unkown
|
page readonly
|
|
|
|
7FF57AD50000
|
unkown
|
page readonly
|
|
|
|
21D59DE0000
|
unkown
|
page readonly
|
|
|
|
18C78D40000
|
unkown
|
page readonly
|
|
|
|
59D167F000
|
unkown
|
page read and write
|
|
|
|
18C78113000
|
unkown
|
page read and write
|
|
|
|
7FF4FFFBB000
|
unkown
|
page readonly
|
|
|
|
165965E0000
|
unkown
|
page read and write
|
|
|
|
7FF58034F000
|
unkown
|
page readonly
|
|
|
|
1D440C00000
|
unkown
|
page readonly
|
|
|
|
7FF58939A000
|
unkown
|
page readonly
|
|
|
|
18C78000000
|
unkown
|
page read and write
|
|
|
|
18C78A00000
|
unkown
|
page readonly
|
|
|
|
7FF5CF254000
|
unkown
|
page readonly
|
|
|
|
1B9D2660000
|
unkown
|
page read and write
|
|
|
|
7FF5CF371000
|
unkown
|
page readonly
|
|
|
|
1B9D2640000
|
unkown
|
page read and write
|
|
|
|
99E4FC000
|
unkown
|
page read and write
|
|
|
|
7FF5CF000000
|
unkown
|
page readonly
|
|
|
|
18CC35D0000
|
unkown
|
page readonly
|
|
|
|
7FF5515C3000
|
unkown
|
page readonly
|
|
|
|
7FF580412000
|
unkown
|
page readonly
|
|
|
|
7FF57FFEA000
|
unkown
|
page readonly
|
|
|
|
1D442B48000
|
unkown
|
page read and write
|
|
|
|
2159E970000
|
unkown
|
page readonly
|
|
|
|
1F935230000
|
unkown
|
page readonly
|
|
|
|
21D5A402000
|
unkown
|
page read and write
|
|
|
|
7FF4F3D8B000
|
unkown
|
page readonly
|
|
|
|
1B9D2985000
|
heap private
|
page read and write
|
|
|
|
21D5A940000
|
unkown
|
page readonly
|
|
|
|
18C7802A000
|
unkown
|
page read and write
|
|
|
|
7FF57AAD0000
|
unkown
|
page readonly
|
|
|
|
7FF57A925000
|
unkown
|
page readonly
|
|
|
|
7FF5CEB81000
|
unkown
|
page readonly
|
|
|
|
7FF58933A000
|
unkown
|
page readonly
|
|
|
|
7FF5277D1000
|
unkown
|
page readonly
|
|
|
|
99DEEB000
|
unkown
|
page read and write
|
|
|
|
7FF4F3E30000
|
unkown
|
page readonly
|
|
|
|
7FF5CF2EE000
|
unkown
|
page readonly
|
|
|
|
18C78200000
|
unkown
|
page readonly
|
|
|
|
18CC34F0000
|
heap default
|
page read and write
|
|
|
|
7FF551764000
|
unkown
|
page readonly
|
|
|
|
7FF57ACA3000
|
unkown
|
page readonly
|
|
|
|
1D442920000
|
unkown
|
page read and write
|
|
|
|
7FF4F3C4B000
|
unkown
|
page readonly
|
|
|
|
28CF20E9000
|
unkown
|
page read and write
|
|
|
|
28CF20BC000
|
unkown
|
page read and write
|
|
|
|
18C77F90000
|
heap default
|
page read and write
|
|
|
|
7FF5001DF000
|
unkown
|
page readonly
|
|
|
|
7FF4F3E5B000
|
unkown
|
page readonly
|
|
|
|
7FF5D1F02000
|
unkown
|
page readonly
|
|
|
|
7FF5CF2C4000
|
unkown
|
page readonly
|
|
|
|
85277E000
|
unkown
|
page read and write
|
|
|
|
1B9D26EE000
|
heap default
|
page read and write
|
|
|
|
7FF5D1E78000
|
unkown
|
page readonly
|
|
|
|
7FF5CEDE2000
|
unkown
|
page readonly
|
|
|
|
C2650FC000
|
unkown
|
page read and write
|
|
|
|
165969A0000
|
unkown
|
page readonly
|
|
|
|
7FF4F3DDD000
|
unkown
|
page readonly
|
|
|
|
1D442920000
|
unkown
|
page read and write
|
|
|
|
F02312F000
|
unkown
|
page read and write
|
|
|
|
7FF5CF26A000
|
unkown
|
page readonly
|
|
|
|
1D440950000
|
heap default
|
page read and write
|
|
|
|
21D5A600000
|
unkown
|
page readonly
|
|
|
|
8526FE000
|
unkown
|
page read and write
|
|
|
|
7FF5BB571000
|
unkown
|
page readonly
|
|
|
|
7FF58933C000
|
unkown
|
page readonly
|
|
|
|
7FF4F3CC6000
|
unkown
|
page readonly
|
|
|
|
7FF580399000
|
unkown
|
page readonly
|
|
|
|
7FF5CEDF2000
|
unkown
|
page readonly
|
|
|
|
7FF500205000
|
unkown
|
page readonly
|
|
|
|
99E5FA000
|
unkown
|
page read and write
|
|
|
|
2159EA40000
|
unkown
|
page read and write
|
|
|
|
914387C000
|
unkown
|
page read and write
|
|
|
|
7FF5D1E48000
|
unkown
|
page readonly
|
|
|
|
7FF58037E000
|
unkown
|
page readonly
|
|
|
|
7FF57ABF3000
|
unkown
|
page readonly
|
|
|
|
7FF4F3F81000
|
unkown
|
page readonly
|
|
|
|
7FF5D1E5A000
|
unkown
|
page readonly
|
|
|
|
28CF2A00000
|
unkown
|
page readonly
|
|
|
|
7FF55170C000
|
unkown
|
page readonly
|
|
|
|
2159EA60000
|
unkown
|
page read and write
|
|
|
|
1DA67940000
|
unkown
|
page read and write
|
|
|
|
7FF5CF27E000
|
unkown
|
page readonly
|
|
|
|
7FF589434000
|
unkown
|
page readonly
|
|
|
|
18CC3800000
|
unkown
|
page write copy
|
|
|
|
7FF57ABA1000
|
unkown
|
page readonly
|
|
|
|
1659641E000
|
heap default
|
page read and write
|
|
|
|
21D59E8A000
|
unkown
|
page read and write
|
|
|
|
7FF5CED5E000
|
unkown
|
page readonly
|
|
|
|
7FF4F3CE9000
|
unkown
|
page readonly
|
|
|
|
7FF5BB4FD000
|
unkown
|
page readonly
|
|
|
|
7FF5CF2AC000
|
unkown
|
page readonly
|
|
|
|
7FF580391000
|
unkown
|
page readonly
|
|
|
|
7FF5CF123000
|
unkown
|
page readonly
|
|
|
|
1F9354A5000
|
heap private
|
page read and write
|
|
|
|
30C1CB000
|
unkown
|
page read and write
|
|
|
|
18C78060000
|
unkown
|
page read and write
|
|
|
|
1D440A3F000
|
unkown
|
page read and write
|
|
|
|
4214BFF000
|
unkown
|
page read and write
|
|
|
|
7FF57AE34000
|
unkown
|
page readonly
|
|
|
|
7FF5893BE000
|
unkown
|
page readonly
|
|
|
|
21D59E26000
|
unkown
|
page read and write
|
|
|
|
7FF55178E000
|
unkown
|
page readonly
|
|
|
|
7FF5800E6000
|
unkown
|
page readonly
|
|
|
|
18C782D0000
|
unkown
|
page readonly
|
|
|
|
1DA67CE0000
|
unkown
|
page readonly
|
|
|
|
7FF4F3EBC000
|
unkown
|
page readonly
|
|
|
|
59D16FF000
|
unkown
|
page read and write
|
|
|
|
99DF6E000
|
unkown
|
page read and write
|
|
|
|
7FF551804000
|
unkown
|
page readonly
|
|
|
|
7FF58902D000
|
unkown
|
page readonly
|
|
|
|
30CA7F000
|
unkown
|
page read and write
|
|
|
|
7FF589441000
|
unkown
|
page readonly
|
|
|
|
18CC3600000
|
unkown
|
page read and write
|
|
|
|
28CF1FF0000
|
unkown
|
page readonly
|
|
|
|
7FF5002F1000
|
unkown
|
page readonly
|
|
|
|
7FF5CEBD3000
|
unkown
|
page readonly
|
|
|
|
7FF4F3ED4000
|
unkown
|
page readonly
|
|
|
|
18CC3629000
|
unkown
|
page read and write
|
|
|
|
7FF57ACBC000
|
unkown
|
page readonly
|
|
|
|
28CF20B0000
|
unkown
|
page read and write
|
|
|
|
7FF4F3DD6000
|
unkown
|
page readonly
|
|
|
|
7FF57AD55000
|
unkown
|
page readonly
|
|
|
|
7FF5802E3000
|
unkown
|
page readonly
|
|
|
|
7FF5002EA000
|
unkown
|
page readonly
|
|
|
|
1D442B00000
|
unkown
|
page read and write
|
|
|
|
7FF4F3E6F000
|
unkown
|
page readonly
|
|
|
|
7FF57AAC7000
|
unkown
|
page readonly
|
|
|
|
7FF52787C000
|
unkown
|
page readonly
|
|
|
|
30C47E000
|
unkown
|
page read and write
|
|
|
|
7FF5CF372000
|
unkown
|
page readonly
|
|
|
|
7FF589388000
|
unkown
|
page readonly
|
|
|
|
18C78013000
|
unkown
|
page read and write
|
|
|
|
1F9354A0000
|
heap private
|
page read and write
|
|
|
|
7FF58032B000
|
unkown
|
page readonly
|
|
|
|
7FF4F3EDA000
|
unkown
|
page readonly
|
|
|
|
F0231AE000
|
unkown
|
page read and write
|
|
|
|
28CF2790000
|
unkown
|
page readonly
|
|
|
|
7FF4F3E8A000
|
unkown
|
page readonly
|
|
|
|
7FF57AD7C000
|
unkown
|
page readonly
|
|
|
|
7FF55171E000
|
unkown
|
page readonly
|
|
|
|
7FF5CF03B000
|
unkown
|
page readonly
|
|
|
|
7FF4F3CB5000
|
unkown
|
page readonly
|
|
|
|
1D442910000
|
unkown
|
page readonly
|
|
|
|
21D59E7C000
|
unkown
|
page read and write
|
|
|
|
914331C000
|
unkown
|
page read and write
|
|
|
|
7FF58021B000
|
unkown
|
page readonly
|
|
|
|
7FF4F3E90000
|
unkown
|
page readonly
|
|
|
|
7FF57FFF7000
|
unkown
|
page readonly
|
|
|
|
7FF57AD7F000
|
unkown
|
page readonly
|
|
|
|
7FF55171A000
|
unkown
|
page readonly
|
|
|
|
7FF5CEE55000
|
unkown
|
page readonly
|
|
|
|
30C4FE000
|
unkown
|
page read and write
|
|
|
|
7FF5893AE000
|
unkown
|
page readonly
|
|
|
|
7FF58036A000
|
unkown
|
page readonly
|
|
|
|
7FF5001FA000
|
unkown
|
page readonly
|
|
|
|
7FF551497000
|
unkown
|
page readonly
|
|
|
|
1D440B19000
|
unkown
|
page read and write
|
|
|
|
21D59E88000
|
unkown
|
page read and write
|
|
|
|
7FF5BB4DE000
|
unkown
|
page readonly
|
|
|
|
7FF5514A0000
|
unkown
|
page readonly
|
|
|
|
18CC50F0000
|
unkown
|
page readonly
|
|
|
|
28CF1FC0000
|
unkown
|
page readonly
|
|
|
|
7FF57A910000
|
unkown
|
page readonly
|
|
|
|
1DA69390000
|
heap private
|
page read and write
|
|
|
|
7FF57ADA4000
|
unkown
|
page readonly
|
|
|
|
7FF500200000
|
unkown
|
page readonly
|
|
|
|
7FF5002F2000
|
unkown
|
page readonly
|
|
|
|
7FF5CF183000
|
unkown
|
page readonly
|
|
|
|
7FF5D1E8D000
|
unkown
|
page readonly
|
|
|
|
28CF2102000
|
unkown
|
page read and write
|
|
|
|
1D440A75000
|
unkown
|
page read and write
|
|
There are 646 hidden memdumps, click here to show them.
DOM / HTML
|
URL
|
Malicious
|
|
|---|---|---|
|
https://privacy.microsoft.com/en-US/privacystatement
|
|
|
|
https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns
|
|
|
|
https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1
|
|
|
|
https://www.microsoft.com/en-US/servicesagreement/
|
|