IOC Report
t9TtulOQal

loading gif

Files

File Path
Type
Category
Malicious
t9TtulOQal.exe
PE32+ executable (console) x86-64, for MS Windows
initial sample
malicious
C:\Windows\System\BUaaHVm.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\BgzddBq.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\DGHKyFn.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\DNPJrAp.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\DnqcwtK.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\ESsAvrN.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\EqjbEoF.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\GVCGjmH.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\JXaKkbf.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\KMucPon.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\LlHIifL.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\NvBlBmE.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\SMIxvgz.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\SphOrRR.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\VDhYVpi.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\WmJzbhD.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\ZQlhpPj.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\bcWhMHX.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\eICKJjV.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\emWQJVL.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\gMOVsdQ.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\iDVoGZo.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\jNieyqN.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\muxfLeg.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\oywIyRw.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\pFPFzsF.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\qNlhNvn.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\stDgizI.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\uyinQiQ.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\wzZdyFs.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\xfTIPLt.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Windows\System\zUtbfaW.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\behaviors-76de0719b85a[1].css
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\dark-d4a90c367f0c[1].css
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\frameworks-6903f4471853[1].css
UTF-8 Unicode text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\light-92c7d381038e[1].css
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1717-85e1b724ca10[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\2486-d89868d3cb25[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\3682-e91f7f4f1ce8[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\3706-a9e5e1421754[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\3826-6af63b920599[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\3932-24b9e74cf858[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\5222-6b85a0658795[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\5329-98db7da29ab9[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\5388-1dbf1debd575[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\5724-640299416084[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\7749-832f2a20ce72[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\8646-b11421a6cbd6[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\8932-24f1e0ea55c2[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\93-8fdb428884fb[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ampinsk[1].jpg
JPEG image data, baseline, precision 8, 64x64, frames 3
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\apple[1].jpg
JPEG image data, baseline, precision 8, 64x64, frames 3
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\behaviors-b1bd0e37a9b4[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\element-registry-d86468692d21[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\environment-bec046a69997[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\facebook[1].png
PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\flutter[1].png
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\gatsbyjs[1].png
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\github-5661da47685a[1].css
UTF-8 Unicode text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\github-elements-29d8293f1694[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\hashicorp[1].png
PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\home-assistant[1].png
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\home-e461cf7ec7b7[1].css
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jasonetco[1].jpg
JPEG image data, baseline, precision 8, 64x64, frames 3
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\joshaber[1].jpg
JPEG image data, baseline, precision 8, 64x64, frames 3
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\kubernetes[1].png
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\notifications-global-28a2c6fa1139[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\nplasterer[1].jpg
JPEG image data, baseline, precision 8, 64x64, frames 3
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\npm[1].png
PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ohmyzsh[1].png
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\pmarsceill[1].png
PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\runtime-51fc180fd3a8[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\rust-lang[1].png
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\site-c0607420942f[1].css
UTF-8 Unicode text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\sophshep[1].png
PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\tensorflow[1].png
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\3198-f068837ff3a6[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\actions-autocomplete[1].png
PNG image data, 1412 x 86, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\actions-check[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\actions-editor-actions[1].png
PNG image data, 550 x 1466, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\actions-editor-sidebar[1].png
PNG image data, 550 x 904, 4-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\actions-editor[1].png
PNG image data, 1412 x 904, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\actions-spinner[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\astro-mona[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\codeql-description[1].png
PNG image data, 982 x 166, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\codeql-step-1[1].png
PNG image data, 982 x 463, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\codeql-step-2[1].png
PNG image data, 918 x 433, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\codeql-step-3[1].png
PNG image data, 858 x 404, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\codespaces-glow[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\codespaces-vscode-1[1].png
PNG image data, 2496 x 1480, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\codespaces-vscode-2[1].png
PNG image data, 2496 x 1480, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\codespaces-vscode-3[1].png
PNG image data, 2496 x 1480, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\community-discussions-1[1].png
PNG image data, 808 x 480, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\community-discussions-2[1].png
PNG image data, 768 x 792, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\community-readme-1[1].png
PNG image data, 766 x 748, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\community-readme-2[1].png
PNG image data, 766 x 730, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\community-sponsor-1[1].png
PNG image data, 768 x 484, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\community-sponsor-2[1].png
PNG image data, 768 x 524, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\dependabot-merge[1].png
PNG image data, 1328 x 888, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\dependabot-pr[1].png
PNG image data, 1412 x 952, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\discussions-answered-check[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\discussions-check[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\enterprise-city-w-logos[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1376x436, frames 3
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\facebook[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\file[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\folder[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\footer-illustration[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\gh-desktop[1].png
PNG image data, 1418 x 1020, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\github-logo[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\github-mark[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\globe[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1238x1404, frames 3
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\heart[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\hero-glow[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\home-b03d01c8df61[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\iphone-notch[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\linkedin[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\marketing-9af736bab4dd[1].js
ASCII text, with very long lines
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\matrix-workflow-build[1].png
PNG image data, 520 x 88, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\matrix-workflow-canvas[1].png
PNG image data, 1412 x 844, 4-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\matrix-workflow-publish-tab[1].png
PNG image data, 152 x 42, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\matrix-workflow-publish[1].png
PNG image data, 584 x 328, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\matrix-workflow-spinner[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\matrix-workflow-success[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\matrix-workflow-test-tab[1].png
PNG image data, 116 x 42, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\matrix-workflow-test[1].png
PNG image data, 584 x 328, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\platform-apple[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\platform-arm[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\platform-google[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\platform-linux[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\platform-windows[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\pr-comment[1].png
PNG image data, 980 x 940, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\pr-description[1].png
PNG image data, 980 x 434, 4-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\pr-merge[1].png
PNG image data, 980 x 888, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\pr-screen[1].png
PNG image data, 1400 x 2474, 8-bit colormap, non-interlaced
modified
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\repo-browser[1].png
PNG image data, 2496 x 1480, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\repo-editor-glow[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\repo-terminal-glow[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\secret-alert[1].png
PNG image data, 984 x 388, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\secret-list[1].png
PNG image data, 984 x 206, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\security-alert-fan[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\twitter[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\webgl-globe-72040f00cce7[1].js
ASCII text
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\youtube[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iscpwkgf.2is.ps1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q4bzvk4k.5w0.psm1
very short file (no magic)
dropped
C:\Windows\System\FCKOZeV.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\FMexUiT.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\FOnZRKr.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\FWCdtoi.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\FeFYpim.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\FxmRhvo.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\FyLyeFw.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\GFTDyHI.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\HTqkXki.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\HkItpNv.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\HpbubZL.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\HwyrgzG.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\IvImsiG.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\IwKYdHI.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\JOQDzgU.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\KrndXYC.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\KsiwdeS.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\LCJGpBT.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\LWncCoi.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\MCOVfKO.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\MRIFuAF.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\NAUjBRC.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\NDqadHk.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\NHwQSty.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\NxFlqYt.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\OJNBHHu.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\PgAOShe.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\QDYWXHy.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\RRDiUuc.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\RlNyVjS.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\RsLgSLi.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\SLFulCG.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\SNvUzbt.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\SkEyCtt.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\SxcwbMZ.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\TnMUQyL.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\TvasPml.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\UQijOzj.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\UdAHMCt.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\UqmycyY.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\VXVIrum.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\WdlDRyY.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\WfHsQZP.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\WhXZiHd.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\XCvwelc.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\XiTpMXp.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\XlZGLnX.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\YMzIzWJ.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\YQCyEcy.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\YjKetXR.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\ZiMOpPX.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\ZtTzcBh.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\ZvssSZj.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\ZzwbFgD.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\dEYJnfK.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\dTLKbpW.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\daHfGgI.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\dlNvLir.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\ezzkzMm.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\gCFlHHJ.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\gdcLiYI.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\hUsjREf.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\heenggl.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\huzPDUS.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\iSqsUCr.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\ilcWOZl.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\jPKzTtz.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\jlNpXjM.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\joINsxO.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\kwkrjVa.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\lSizvcg.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\lgsRKGr.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\lixNaxD.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\lwgsJqd.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\mEbRccf.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\mIyThvK.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\mtQRaqN.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\nrQYUmJ.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\ntmWQZK.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\oBrtOof.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\osvCeul.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\ovDdHGH.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\pOKHtag.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\pQoKRMn.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\pWjGKSk.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\qQSrpPb.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\rAKqgoA.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\rhHsFle.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\rvuSdjQ.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\smuYHXa.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\svOQXJz.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\vcEmNkW.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\wDdnUtc.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\wZzWCWV.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\xdUCYQb.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\yONznpZ.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\yPKDcsN.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\System\zVbOvXm.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
There are 235 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\t9TtulOQal.exe
"C:\Users\user\Desktop\t9TtulOQal.exe"
malicious
C:\Windows\System\uyinQiQ.exe
C:\Windows\System\uyinQiQ.exe
malicious
C:\Windows\System\EqjbEoF.exe
C:\Windows\System\EqjbEoF.exe
malicious
C:\Windows\System\xfTIPLt.exe
C:\Windows\System\xfTIPLt.exe
malicious
C:\Windows\System\SphOrRR.exe
C:\Windows\System\SphOrRR.exe
malicious
C:\Windows\System\pFPFzsF.exe
C:\Windows\System\pFPFzsF.exe
malicious
C:\Windows\System\qNlhNvn.exe
C:\Windows\System\qNlhNvn.exe
malicious
C:\Windows\System\wzZdyFs.exe
C:\Windows\System\wzZdyFs.exe
malicious
C:\Windows\System\jNieyqN.exe
C:\Windows\System\jNieyqN.exe
malicious
C:\Windows\System\ESsAvrN.exe
C:\Windows\System\ESsAvrN.exe
malicious
C:\Windows\System\eICKJjV.exe
C:\Windows\System\eICKJjV.exe
malicious
C:\Windows\System\muxfLeg.exe
C:\Windows\System\muxfLeg.exe
malicious
C:\Windows\System\JXaKkbf.exe
C:\Windows\System\JXaKkbf.exe
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
There are 5 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://github.githubassets.com/assets/3198-f068837ff3a6.js
185.199.108.154
https://github.githubassets.com/assets/2486-d89868d3cb25.js
185.199.108.154
https://github.githubassets.com/assets/github-elements-29d8293f1694.js
185.199.108.154
https://github.githubassets.com/images/modules/site/icons/footer/github-logo.svg
185.199.108.154
https://github.githubassets.com/assets/8646-b11421a6cbd6.js
185.199.108.154
https://avatars.githubusercontent.com/nplasterer?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/matrix-workflow-test-tab.png
185.199.108.154
https://github.githubassets.com/assets/3706-a9e5e1421754.js
185.199.108.154
https://github.githubassets.com/assets/5724-640299416084.js
185.199.108.154
https://avatars.githubusercontent.com/jasonetco?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/logos/platform-google.svg
185.199.108.154
https://avatars.githubusercontent.com/rust-lang?s=64&v=4
185.199.108.133
https://avatars.githubusercontent.com/joshaber?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/codeql-step-2.png
185.199.108.154
https://avatars.githubusercontent.com/sophshep?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/logos/platform-windows.svg
185.199.108.154
https://avatars.githubusercontent.com/apple?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/actions-autocomplete.png
185.199.108.154
https://github.githubassets.com/images/modules/site/home/actions-editor.png
185.199.108.154
https://github.githubassets.com/images/modules/site/home/community-sponsor-1.png
185.199.108.154
https://github.githubassets.com/assets/93-8fdb428884fb.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/pr-comment.png
185.199.108.154
https://github.githubassets.com/images/modules/site/home/footer-illustration.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/icons/folder.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/pr-description.png
185.199.108.154
https://github.githubassets.com/assets/behaviors-76de0719b85a.css
185.199.108.154
https://avatars.githubusercontent.com/pmarsceill?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/icons/heart.svg
185.199.108.154
https://github.githubassets.com/assets/5222-6b85a0658795.js
185.199.108.154
https://github.githubassets.com/assets/5388-1dbf1debd575.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/hero-glow.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/pr-merge.png
185.199.108.154
https://github.githubassets.com/assets/element-registry-d86468692d21.js
185.199.108.154
https://github.githubassets.com/assets/dark-d4a90c367f0c.css
185.199.108.154
https://github.githubassets.com/images/modules/site/home/icons/file.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/globe.jpg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/secret-list.png
185.199.108.154
https://github.githubassets.com/assets/1717-85e1b724ca10.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/enterprise-city-w-logos.jpg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/matrix-workflow-publish-tab.png
185.199.108.154
https://github.githubassets.com/images/modules/site/home/discussions-answered-check.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/icons/footer/twitter.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/repo-terminal-glow.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/codespaces-glow.svg
185.199.108.154
https://github.githubassets.com/assets/marketing-9af736bab4dd.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/logos/platform-apple.svg
185.199.108.154
https://raw.githubusercontent.com/
185.199.111.133
https://avatars.githubusercontent.com/ohmyzsh?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/codespaces-vscode-3.png
185.199.108.154
https://github.githubassets.com/images/modules/site/icons/footer/facebook.svg
185.199.108.154
https://avatars.githubusercontent.com/ansible?s=64&v=4
185.199.108.133
https://github.githubassets.com/assets/home-b03d01c8df61.js
185.199.108.154
https://github.githubassets.com/images/modules/site/icons/footer/linkedin.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/codeql-step-3.png
185.199.108.154
https://github.githubassets.com/images/modules/site/home/pr-screen.png
185.199.108.154
https://github.githubassets.com/assets/3682-e91f7f4f1ce8.js
185.199.108.154
https://github.githubassets.com/assets/3826-6af63b920599.js
185.199.108.154
https://github.githubassets.com/images/modules/site/icons/footer/youtube.svg
185.199.108.154
https://github.githubassets.com/assets/home-e461cf7ec7b7.css
185.199.108.154
https://github.githubassets.com/images/modules/site/home/community-readme-2.png
185.199.108.154
https://github.githubassets.com/assets/behaviors-b1bd0e37a9b4.js
185.199.108.154
https://avatars.githubusercontent.com/flutter?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/community-readme-1.png
185.199.108.154
https://github.githubassets.com/assets/notifications-global-28a2c6fa1139.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/security-alert-fan.svg
185.199.108.154
https://github.githubassets.com/assets/5329-98db7da29ab9.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/secret-alert.png
185.199.108.154
https://avatars.githubusercontent.com/kubernetes?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/logos/platform-arm.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/codeql-step-1.png
185.199.108.154
https://github.githubassets.com/images/modules/site/home/repo-browser.png
185.199.108.154
https://github.githubassets.com/assets/light-92c7d381038e.css
185.199.108.154
https://github.githubassets.com/images/modules/site/home/logos/platform-linux.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/codespaces-vscode-1.png
185.199.108.154
https://avatars.githubusercontent.com/ampinsk?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/matrix-workflow-publish.png
185.199.108.154
https://github.githubassets.com/assets/3932-24b9e74cf858.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/gh-desktop.png
185.199.108.154
https://github.com/
140.82.121.3
https://github.githubassets.com/images/modules/site/home/discussions-check.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/icons/footer/github-mark.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/community-discussions-1.png
185.199.108.154
https://avatars.githubusercontent.com/hashicorp?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/matrix-workflow-test.png
185.199.108.154
https://github.githubassets.com/assets/github-5661da47685a.css
185.199.108.154
https://github.githubassets.com/images/modules/site/home/community-sponsor-2.png
185.199.108.154
https://github.githubassets.com/assets/environment-bec046a69997.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/matrix-workflow-success.svg
185.199.108.154
https://github.githubassets.com/assets/frameworks-6903f4471853.css
185.199.108.154
https://github.githubassets.com/assets/runtime-51fc180fd3a8.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/astro-mona.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/matrix-workflow-build.png
185.199.108.154
https://avatars.githubusercontent.com/gatsbyjs?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/codeql-description.png
185.199.108.154
https://avatars.githubusercontent.com/npm?s=64&v=4
185.199.108.133
https://github.githubassets.com/images/modules/site/home/iphone-notch.svg
185.199.108.154
https://github.githubassets.com/assets/8932-24f1e0ea55c2.js
185.199.108.154
https://github.githubassets.com/images/modules/site/home/actions-spinner.svg
185.199.108.154
https://github.githubassets.com/images/modules/site/home/community-discussions-2.png
185.199.108.154
https://github.githubassets.com/assets/site-c0607420942f.css
185.199.108.154
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
avatars.githubusercontent.com
185.199.108.133
github.com
140.82.121.3
raw.githubusercontent.com
185.199.111.133
github.githubassets.com
185.199.108.154

IPs

IP
Domain
Country
Malicious
192.168.2.1
unknown
unknown
185.199.108.133
avatars.githubusercontent.com
Netherlands
185.199.108.154
github.githubassets.com
Netherlands
140.82.121.3
github.com
United States
3.120.98.217
unknown
United States
185.199.111.133
raw.githubusercontent.com
Netherlands

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
7FF6698C1000
unkown
page execute and read and write
malicious
7FF670C91000
unkown
page execute and read and write
malicious
7FF620051000
unkown
page execute and read and write
malicious
7FF7B05A1000
unkown
page execute and read and write
malicious
7FF77BDE1000
unkown
page execute and read and write
malicious
7FF769431000
unkown
page execute and read and write
malicious
7FF690B41000
unkown
page execute and read and write
malicious
7FF78C711000
unkown
page execute and read and write
malicious
7FF7A45C1000
unkown
page execute and read and write
malicious
7FF624291000
unkown
page execute and read and write
malicious
7FF7C3391000
unkown
page execute and read and write
malicious
7FF69AD41000
unkown
page execute and read and write
malicious
7FF726C51000
unkown
page execute and read and write
malicious
7FF6E7BB1000
unkown
page execute and read and write
malicious
7FF7721A1000
unkown
page execute and read and write
malicious
7FF762061000
unkown
page execute and read and write
malicious
7FF6D4DC1000
unkown
page execute and read and write
malicious
7FF7AC671000
unkown
page execute and read and write
malicious
7FF64B0A1000
unkown
page execute and read and write
malicious
7FF624C81000
unkown
page execute and read and write
malicious
7FF6F9A41000
unkown
page execute and read and write
malicious
7FF7655E1000
unkown
page execute and read and write
malicious
7FF7BD901000
unkown
page execute and read and write
malicious
7FF7D12A1000
unkown
page execute and read and write
malicious
7FF7DE0B1000
unkown
page execute and read and write
malicious
7FF64DC51000
unkown
page execute and read and write
malicious
7FF7D85E1000
unkown
page execute and read and write
malicious
12936680000
heap
page read and write
7FF76244D000
unkown
page execute and read and write
2599013A000
heap
page read and write
DA2D0FE000
stack
page read and write
252CF090000
heap
page read and write
7FF7BDCED000
unkown
page execute and read and write
7FF762060000
unkown
page readonly
252D4924000
trusted library allocation
page read and write
434C6FF000
stack
page read and write
D99D6FC000
stack
page read and write
7FF64B47B000
unkown
page execute and read and write
25E0C800000
heap
page read and write
7FF6D51B1000
unkown
page write copy
7FF78CAFD000
unkown
page execute and read and write
1BAAF160000
heap
page read and write
21E96313000
heap
page read and write
1FA53902000
unkown
page read and write
252D4900000
trusted library allocation
page read and write
7FF77C14D000
unkown
page execute and write copy
7FF690F31000
unkown
page write copy
227E48A0000
direct allocation
page execute read
27C141C0000
direct allocation
page execute read
22C0BA00000
heap
page read and write
170E0F50000
heap
page read and write
7FF7621AB000
unkown
page execute and read and write
292C6EE0000
heap
page read and write
22625FE0000
remote allocation
page read and write
252D0150000
trusted library section
page readonly
252D46E5000
heap
page read and write
227E48A8000
direct allocation
page execute read
266E7A80000
heap
page read and write
1FA53AD0000
unkown
page read and write
7F72CFE000
stack
page read and write
7FF7659CD000
unkown
page execute and read and write
21E97E02000
trusted library allocation
page read and write
7FF7AC670000
unkown
page readonly
1F951E71000
heap
page read and write
FE80677000
stack
page read and write
29271D10000
direct allocation
page execute read
7FF7A49B1000
unkown
page write copy
2B09E120000
heap
page read and write
7FF6243DB000
unkown
page execute and read and write
D80EF7B000
stack
page read and write
7FF624681000
unkown
page write copy
753B6FF000
stack
page read and write
7FF690F31000
unkown
page read and write
2598F86E000
heap
page read and write
266E7D08000
heap
page read and write
1E21B400000
heap
page read and write
1FA51970000
heap
page read and write
1FA53AD0000
unkown
page read and write
7FF77BF2B000
unkown
page execute and read and write
25E0C720000
heap
page read and write
21E97C70000
trusted library allocation
page read and write
7FF620050000
unkown
page readonly
252CF902000
heap
page read and write
2AADDB68000
heap
page read and write
CB2AFFF000
stack
page read and write
7FF624681000
unkown
page read and write
1FA517D0000
heap
page read and write
B8D3FF000
stack
page read and write
2B09E538000
direct allocation
page execute read
7FF77C1CF000
unkown
page execute and write copy
DBF0FFF000
stack
page read and write
7FF6E7BB0000
unkown
page readonly
177C8778000
direct allocation
page execute read
7631D7E000
stack
page read and write
2B09E1D8000
heap
page read and write
7FF76243B000
unkown
page execute and read and write
7FF7BDCEF000
unkown
page execute and write copy
1BAAF2A0000
direct allocation
page execute read
CB2B2FF000
stack
page read and write
9C3C87F000
stack
page read and write
2598F800000
heap
page read and write
4F14EFC000
stack
page read and write
1E84B428000
direct allocation
page execute read
227E4720000
heap
page read and write
7FF7C3390000
unkown
page readonly
3F0353B000
stack
page read and write
259C97A4000
heap
page read and write
D80F3FD000
stack
page read and write
7FF76981F000
unkown
page execute and write copy
2B09E530000
direct allocation
page execute read
7FF7B05A0000
unkown
page readonly
D80EB1B000
stack
page read and write
DA298FF000
stack
page read and write
1B9C9140000
heap
page read and write
3F03B7E000
stack
page read and write
227D3350000
direct allocation
page execute read
55706FE000
stack
page read and write
252D4990000
trusted library allocation
page read and write
7FF6D4DC0000
unkown
page readonly
252CF000000
heap
page read and write
1F952802000
trusted library allocation
page read and write
CC0A4FF000
stack
page read and write
25E0C875000
heap
page read and write
218E3FE0000
heap
page read and write
22625857000
heap
page read and write
DA2C8FC000
stack
page read and write
2CC49BB0000
direct allocation
page execute read
177C8770000
direct allocation
page execute read
25E0C863000
heap
page read and write
DA2C9FE000
stack
page read and write
227E4880000
heap
page read and write
27CB8D80000
heap
page read and write
21E9624A000
heap
page read and write
1FFE3170000
heap
page read and write
252D46F4000
heap
page read and write
266E7D02000
heap
page read and write
7FF69B0AD000
unkown
page execute and write copy
2E85DFF000
stack
page read and write
22C0BA64000
heap
page read and write
252D0170000
trusted library section
page readonly
21E96318000
heap
page read and write
27CB8B50000
direct allocation
page execute read
1F951F13000
heap
page read and write
6EF47FF000
stack
page read and write
1F6B12D0000
heap
page read and write
252CF0A0000
heap
page read and write
252CF958000
heap
page read and write
FF49BFF000
stack
page read and write
129366A0000
direct allocation
page execute read
1E84B420000
direct allocation
page execute read
1FA51950000
unkown
page read and write
21E961E0000
trusted library allocation
page read and write
7FF72702B000
unkown
page execute and read and write
1FA51BE0000
unkown
page read and write
CB2A877000
stack
page read and write
7FF7C36FD000
unkown
page execute and write copy
252D4921000
trusted library allocation
page read and write
15466208000
heap
page read and write
2AADD920000
heap
page read and write
25E0C856000
heap
page read and write
7FF6D51AD000
unkown
page execute and read and write
1214C078000
heap
page read and write
7FF78CAEB000
unkown
page execute and read and write
27CB8B68000
heap
page read and write
E1414FC000
stack
page read and write
7FF7BDA4B000
unkown
page execute and read and write
1FA51BEB000
heap
page read and write
1E21B2D0000
heap
page read and write
7FF690B40000
unkown
page readonly
27C14250000
heap
page read and write
21E96140000
heap
page read and write
259C96F0000
heap
page read and write
252D4980000
trusted library allocation
page read and write
22C0BA79000
heap
page read and write
1FFE3198000
direct allocation
page execute read
1F951E3F000
heap
page read and write
D99D7FF000
stack
page read and write
252CF0FE000
heap
page read and write
7FF64B0A0000
unkown
page readonly
7FF62466B000
unkown
page execute and read and write
7FF669CB1000
unkown
page read and write
20806A20000
heap
page read and write
7FF64DFBD000
unkown
page execute and write copy
21E9622A000
heap
page read and write
2AADDAA0000
direct allocation
page execute read
25E0C860000
heap
page read and write
25990100000
heap
page read and write
1FA51A5E000
unkown
page read and write
1CB00000000
heap
page read and write
7FF64B491000
unkown
page read and write
82930FE000
stack
page read and write
130A4C9000
unkown
page read and write
24D84D20000
direct allocation
page execute read
7FF769430000
unkown
page readonly
7FF7BDC6D000
unkown
page execute and write copy
1FA51A66000
unkown
page read and write
266E7C13000
heap
page read and write
7FF62467F000
unkown
page execute and write copy
252D46DB000
heap
page read and write
266E7D13000
heap
page read and write
FDD09FF000
stack
page read and write
27C14040000
heap
page read and write
2CC49BB8000
direct allocation
page execute read
E1412FF000
stack
page read and write
177C89F0000
heap
page read and write
1CB00060000
heap
page read and write
1FA51BA0000
unkown
page read and write
25E0C859000
heap
page read and write
1F951E63000
heap
page read and write
129366C4000
heap
page read and write
7FF7DE49D000
unkown
page execute and read and write
1F951DA0000
trusted library allocation
page read and write
252CF802000
heap
page read and write
22625802000
heap
page read and write
7FF7D89CD000
unkown
page execute and read and write
7FF7C377F000
unkown
page execute and write copy
1FA51963000
heap
page read and write
E1411FE000
stack
page read and write
7F72AFC000
stack
page read and write
177C87B4000
heap
page read and write
21E96269000
heap
page read and write
22625710000
heap
page read and write
7FF670DDB000
unkown
page execute and read and write
6EF45FF000
stack
page read and write
6EF44FE000
stack
page read and write
2598F8CE000
heap
page read and write
7FF69B131000
unkown
page write copy
1FA538F0000
unkown
page read and write
259C9A20000
heap
page read and write
2598F7D0000
trusted library allocation
page read and write
227E4978000
heap
page read and write
CB2ABFE000
stack
page read and write
F4EBBFC000
stack
page read and write
D80F0FE000
stack
page read and write
1E21B308000
heap
page read and write
2CC49B90000
heap
page read and write
D80F8FF000
stack
page read and write
EB0FFFE000
stack
page read and write
266E7BF0000
trusted library allocation
page read and write
7FF7659BB000
unkown
page execute and read and write
22625FE0000
remote allocation
page read and write
1F6B12D8000
heap
page read and write
FDD08FC000
stack
page read and write
252D0130000
trusted library section
page readonly
F4EBEFF000
stack
page read and write
CC0A16C000
stack
page read and write
292C6F50000
heap
page read and write
21E97D60000
remote allocation
page read and write
252CF029000
heap
page read and write
7FF6E7F9D000
unkown
page execute and read and write
130A7FC000
unkown
page read and write
1FA51BD0000
unkown
page readonly
AB91DFF000
stack
page read and write
7FF6D4F0B000
unkown
page execute and read and write
1214C068000
direct allocation
page execute read
27CB89F0000
heap
page read and write
7FF6698C0000
unkown
page readonly
15466180000
heap
page read and write
27C141C8000
direct allocation
page execute read
1E84B3E0000
heap
page read and write
2598F8D0000
heap
page read and write
22A36328000
direct allocation
page execute read
20809510000
unkown
page read and write
7FF7DE48B000
unkown
page execute and read and write
1FA51BD0000
unkown
page readonly
7FF690C8B000
unkown
page execute and read and write
7FF620441000
unkown
page write copy
1BABFFF000
stack
page read and write
259C97A7000
heap
page read and write
7FF7D85E0000
unkown
page readonly
7FF7A470B000
unkown
page execute and read and write
230A7290000
direct allocation
page execute read
7FF7ACA61000
unkown
page read and write
9C3C2FC000
stack
page read and write
2598F843000
heap
page read and write
170E10D0000
direct allocation
page execute read
227D3660000
heap
page read and write
7FF79B990000
unkown
page readonly
7FF7659D1000
unkown
page write copy
7FF7D1691000
unkown
page write copy
266E7C49000
heap
page read and write
7FF7B098D000
unkown
page execute and read and write
1BAAF2B8000
heap
page read and write
22625FB0000
trusted library allocation
page read and write
1F951D70000
heap
page read and write
3F03C7F000
stack
page read and write
1E21B2F0000
direct allocation
page execute read
7FF669C2D000
unkown
page execute and write copy
985DAFC000
stack
page read and write
7FF7AC7BB000
unkown
page execute and read and write
1FA53AC0000
unkown
page readonly
218E3EA0000
heap
page read and write
252D49B0000
remote allocation
page read and write
1FA51F80000
unkown
page readonly
252CF7C1000
trusted library allocation
page read and write
22A36344000
heap
page read and write
55703CC000
stack
page read and write
266E7C29000
heap
page read and write
25E0C85A000
heap
page read and write
24D849C8000
heap
page read and write
1FA51F80000
unkown
page readonly
130A87B000
unkown
page read and write
2598F670000
heap
page read and write
7FF7721A0000
unkown
page readonly
2598F829000
heap
page read and write
1FA539F0000
unkown
page readonly
2CC49B00000
heap
page read and write
230A7650000
heap
page read and write
7FF78C85B000
unkown
page execute and read and write
7FF77258D000
unkown
page execute and read and write
1BAAF550000
heap
page read and write
8292EFC000
stack
page read and write
7FF77C1BB000
unkown
page execute and read and write
20806A6B000
heap
page read and write
20808D10000
unkown
page read and write
252D4550000
trusted library allocation
page read and write
7FF64B48F000
unkown
page execute and write copy
1C7A0650000
heap
page read and write
227E4860000
heap
page read and write
7FF7659D1000
unkown
page read and write
25E0C832000
heap
page read and write
266E7C4D000
heap
page read and write
2598F824000
heap
page read and write
7FF62019B000
unkown
page execute and read and write
252CF800000
heap
page read and write
7FF6E7FA1000
unkown
page write copy
4F14FFF000
stack
page read and write
252D4560000
trusted library allocation
page read and write
130A4C7000
unkown
page read and write
25E0C86E000
heap
page read and write
252D4590000
trusted library allocation
page read and write
7FF69AD40000
unkown
page readonly
7FF6245FD000
unkown
page execute and write copy
7FF669A0B000
unkown
page execute and read and write
1E84B2A0000
heap
page read and write
2B09E190000
heap
page read and write
7FF78CAFF000
unkown
page execute and write copy
1FA51960000
unkown
page read and write
7FF769821000
unkown
page write copy
7FF7ACA5D000
unkown
page execute and read and write
7FF7C3781000
unkown
page read and write
7FF7ACA5F000
unkown
page execute and write copy
DA2D3FE000
stack
page read and write
B8D2FF000
stack
page read and write
2B09E570000
heap
page read and write
1B9C9180000
direct allocation
page execute read
292C6FA8000
heap
page read and write
1F951D00000
heap
page read and write
753B4FC000
stack
page read and write
7FF72703D000
unkown
page execute and read and write
266E7C4A000
heap
page read and write
129366B0000
heap
page read and write
54499DC000
stack
page read and write
6C0D5FE000
stack
page read and write
22C0BA13000
heap
page read and write
218E4028000
direct allocation
page execute read
7FF6D512D000
unkown
page execute and write copy
7FF772591000
unkown
page write copy
CB2B07F000
stack
page read and write
21E97CA0000
trusted library allocation
page read and write
753B5FF000
stack
page read and write
7631CFE000
stack
page read and write
21E97D60000
remote allocation
page read and write
21E96202000
heap
page read and write
2598F660000
heap
page read and write
7631BFF000
stack
page read and write
7FF62043F000
unkown
page execute and write copy
7FF76572B000
unkown
page execute and read and write
434C7FF000
stack
page read and write
22C0BA68000
heap
page read and write
B85F30C000
stack
page read and write
2598F8BF000
heap
page read and write
25E0C87E000
heap
page read and write
252D46F2000
heap
page read and write
64DC2FC000
stack
page read and write
7DF4D6920000
unkown
page readonly
7FF669C9B000
unkown
page execute and read and write
7FF7C3390000
unkown
page readonly
7FF76979D000
unkown
page execute and write copy
7631A7B000
stack
page read and write
25E0C902000
heap
page read and write
1FFE3150000
heap
page read and write
1FA51BEB000
unkown
page read and write
25E0C841000
heap
page read and write
252D46A4000
heap
page read and write
7FF7DE0B0000
unkown
page readonly
25E0C862000
heap
page read and write
7FF7D1691000
unkown
page read and write
1F951E50000
heap
page read and write
6E9DBFF000
stack
page read and write
7FF77C1D1000
unkown
page write copy
7FF62506F000
unkown
page execute and write copy
1B9C9160000
heap
page read and write
252D04C0000
trusted library allocation
page read and write
25E0C858000
heap
page read and write
DA296FC000
stack
page read and write
7FF6E7F1D000
unkown
page execute and write copy
15466160000
heap
page read and write
227E4940000
heap
page read and write
27C14180000
heap
page read and write
7F72DFE000
stack
page read and write
CB2A9FB000
stack
page read and write
252D490E000
trusted library allocation
page read and write
9C3BBAB000
stack
page read and write
25E0C831000
heap
page read and write
CB2AE7F000
stack
page read and write
227D3368000
heap
page read and write
7FF69B131000
unkown
page read and write
130A87B000
unkown
page read and write
7FF69B11B000
unkown
page execute and read and write
7631E7E000
stack
page read and write
7FF64E041000
unkown
page write copy
252D46D5000
heap
page read and write
1E84B508000
heap
page read and write
7FF727041000
unkown
page read and write
7FF7B0991000
unkown
page write copy
252D463E000
heap
page read and write
25E0C87C000
heap
page read and write
7FF79BD81000
unkown
page write copy
CB2AAFA000
stack
page read and write
252D44C0000
trusted library allocation
page read and write
2080A4E0000
unkown
page read and write
FE8057B000
stack
page read and write
7FF77C1D1000
unkown
page read and write
252D0120000
trusted library section
page readonly
2CC49EF0000
heap
page read and write
259C9590000
heap
page read and write
252CF013000
heap
page read and write
64DC3FF000
stack
page read and write
7FF7A45C0000
unkown
page readonly
9C3C27E000
stack
page read and write
25E0C861000
heap
page read and write
21E97CE0000
trusted library allocation
page read and write
21E9628B000
heap
page read and write
D80F1FB000
stack
page read and write
2AADDB20000
heap
page read and write
29271BB0000
heap
page read and write
1F951E8B000
heap
page read and write
22A36338000
heap
page read and write
7FF670C90000
unkown
page readonly
252CF7F0000
trusted library allocation
page read and write
25E0C85C000
heap
page read and write
7FF62043D000
unkown
page execute and read and write
129368E0000
heap
page read and write
7FF62042B000
unkown
page execute and read and write
1C7A03F0000
heap
page read and write
266E7C8C000
heap
page read and write
218E40A0000
heap
page read and write
1FA51963000
unkown
page read and write
25E0C876000
heap
page read and write
2598F902000
heap
page read and write
7FF7DE4A1000
unkown
page write copy
25E0C87F000
heap
page read and write
25E0D202000
trusted library allocation
page read and write
7FF6D51B1000
unkown
page read and write
1FA51BE5000
heap
page read and write
9C3C57D000
stack
page read and write
7FF76244F000
unkown
page execute and write copy
7FF669CAF000
unkown
page execute and write copy
170E1090000
heap
page read and write
252CF900000
heap
page read and write
1BAAF2A8000
direct allocation
page execute read
2080846A000
heap
page read and write
7E4FFF000
stack
page read and write
DA297FF000
stack
page read and write
2AADDA60000
heap
page read and write
7FF762451000
unkown
page read and write
2B09E1D0000
heap
page read and write
292C6F80000
heap
page read and write
252D4540000
trusted library allocation
page read and write
7FF7D872B000
unkown
page execute and read and write
7FF6E7FA1000
unkown
page read and write
1F951E6E000
heap
page read and write
7FF77BDE0000
unkown
page readonly
130A77E000
unkown
page read and write
DBF0B1C000
stack
page read and write
985DCFF000
stack
page read and write
130A67E000
stack
page read and write
6C0D4FF000
stack
page read and write
7FF67107D000
unkown
page execute and read and write
21E96150000
heap
page read and write
230A7250000
heap
page read and write
20806B85000
heap
page read and write
218E42F0000
heap
page read and write
FF49AFC000
stack
page read and write
29271E20000
heap
page read and write
22626002000
trusted library allocation
page read and write
1BAAF2B0000
heap
page read and write
22625829000
heap
page read and write
21E96213000
heap
page read and write
7FF7A492D000
unkown
page execute and write copy
1BAAF3B0000
heap
page read and write
259C9790000
heap
page read and write
1FA51960000
heap
page read and write
E1410FE000
stack
page read and write
208068E0000
heap
page read and write
7FF6F9E2D000
unkown
page execute and read and write
2262583D000
heap
page read and write
CC0A5FE000
stack
page read and write
AB91CFF000
stack
page read and write
24D84D28000
direct allocation
page execute read
22625813000
heap
page read and write
7FF6E7BB0000
unkown
page readonly
266E7AF0000
heap
page read and write
7FF77257B000
unkown
page execute and read and write
2598F913000
heap
page read and write
292C6F70000
direct allocation
page execute read
170E10B0000
heap
page read and write
25E0C83A000
heap
page read and write
7FF78CB01000
unkown
page write copy
DBF0EFF000
stack
page read and write
CB2A67C000
stack
page read and write
7FF64DC50000
unkown
page readonly
7FF7A45C0000
unkown
page readonly
FE8077F000
stack
page read and write
177C8750000
heap
page read and write
1E84B400000
heap
page read and write
266E7C4F000
heap
page read and write
252D4659000
heap
page read and write
2598F88A000
heap
page read and write
7FF64E03D000
unkown
page execute and read and write
1214BFF0000
heap
page read and write
7FF7D89D1000
unkown
page read and write
1FA51900000
unkown
page read and write
22625FE0000
remote allocation
page read and write
7FF6D519B000
unkown
page execute and read and write
1F6B11F0000
heap
page read and write
7FF7D167B000
unkown
page execute and read and write
2AADDA80000
heap
page read and write
25E0C829000
heap
page read and write
DA2D4FF000
stack
page read and write
252CF0A2000
heap
page read and write
170E1110000
heap
page read and write
7FF64B1EB000
unkown
page execute and read and write
1FA53BD0000
unkown
page read and write
252CF095000
heap
page read and write
7FF669CB1000
unkown
page write copy
4F150FF000
stack
page read and write
130A6FF000
unkown
page read and write
7FF625071000
unkown
page write copy
21E9625A000
heap
page read and write
129365F0000
heap
page read and write
218E40A8000
heap
page read and write
7FF76981D000
unkown
page execute and read and write
7FF78CA7D000
unkown
page execute and write copy
21E96200000
heap
page read and write
24D849A0000
heap
page read and write
1F6B11D0000
heap
page read and write
266E7C4B000
heap
page read and write
2598F813000
heap
page read and write
266E7A90000
heap
page read and write
1F951E00000
heap
page read and write
1B9C9000000
heap
page read and write
25E0C86B000
heap
page read and write
1FA543D0000
unkown
page read and write
CB2AEFF000
stack
page read and write
252D4908000
trusted library allocation
page read and write
7E4EFE000
stack
page read and write
7FF69AD40000
unkown
page readonly
E1416FC000
stack
page read and write
252D4970000
trusted library allocation
page read and write
252CF057000
heap
page read and write
D80F5FE000
stack
page read and write
7FF77250D000
unkown
page execute and write copy
24D84910000
heap
page read and write
E1415FE000
stack
page read and write
266E7C82000
heap
page read and write
25E0C842000
heap
page read and write
252CF918000
heap
page read and write
252CF7E0000
trusted library allocation
page read and write
22C0BB02000
heap
page read and write
1FA543D0000
unkown
page read and write
1FA53AC0000
unkown
page readonly
7FF624FED000
unkown
page execute and write copy
227D32E0000
heap
page read and write
21E961B0000
heap
page read and write
24D849C0000
heap
page read and write
1FA544FE000
unkown
page read and write
DA2D1FF000
stack
page read and write
76320FD000
stack
page read and write
EB0FEFF000
stack
page read and write
7FF726FBD000
unkown
page execute and write copy
3548FFF000
stack
page read and write
2AADDB60000
heap
page read and write
259C9798000
heap
page read and write
7FF7BDCDB000
unkown
page execute and read and write
7FF7655E0000
unkown
page readonly
266E7C00000
heap
page read and write
9C3C17E000
stack
page read and write
7631F7D000
stack
page read and write
7FF624290000
unkown
page readonly
7FF64B40D000
unkown
page execute and write copy
130A4CB000
unkown
page read and write
7FF7B098F000
unkown
page execute and write copy
1FA51BF0000
unkown
page readonly
7FF6F9E1B000
unkown
page execute and read and write
7FF62467D000
unkown
page execute and read and write
7FF624C80000
unkown
page readonly
20806B80000
heap
page read and write
252CF102000
heap
page read and write
25E0C855000
heap
page read and write
7FF727041000
unkown
page write copy
218E4000000
heap
page read and write
1FA51900000
unkown
page read and write
76321FD000
stack
page read and write
8292FFF000
stack
page read and write
7FF7AC9DD000
unkown
page execute and write copy
7FF7D13EB000
unkown
page execute and read and write
D80F7FF000
stack
page read and write
1CB000A8000
direct allocation
page execute read
1FA518E0000
unkown
page read and write
1C7A1E28000
direct allocation
page execute read
252CF959000
heap
page read and write
1FA51930000
unkown
page readonly
1C7A0400000
heap
page read and write
7FF7D894D000
unkown
page execute and write copy
D80F2FF000
stack
page read and write
170E1188000
heap
page read and write
CB2AF7E000
stack
page read and write
1C7A0630000
heap
page read and write
22C0BB00000
heap
page read and write
20808910000
unkown
page read and write
154661A8000
direct allocation
page execute read
226256A0000
heap
page read and write
25E0C84D000
heap
page read and write
252CF07A000
heap
page read and write
1CB000F0000
heap
page read and write
1B9C91C8000
heap
page read and write
7FF7623CD000
unkown
page execute and write copy
9C3C67E000
stack
page read and write
25E0C85F000
heap
page read and write
2080AEE0000
unkown
page read and write
170E1180000
heap
page read and write
7FF7BDCF1000
unkown
page write copy
DA2D2FE000
stack
page read and write
7FF7659CF000
unkown
page execute and write copy
7FF76957B000
unkown
page execute and read and write
3548EFC000
stack
page read and write
1FA51BA0000
unkown
page read and write
7FF6E7F8B000
unkown
page execute and read and write
21E9624A000
heap
page read and write
252D4560000
trusted library allocation
page read and write
1FA51978000
unkown
page read and write
1CB00080000
heap
page read and write
24D84980000
heap
page read and write
1FA51B90000
unkown
page readonly
2CC49B70000
heap
page read and write
7FF77C1CD000
unkown
page execute and read and write
7FF624290000
unkown
page readonly
FE802FE000
stack
page read and write
7FF64E02B000
unkown
page execute and read and write
7FF62506D000
unkown
page execute and read and write
22A36320000
direct allocation
page execute read
15466020000
heap
page read and write
25E0C870000
heap
page read and write
7FF762451000
unkown
page write copy
7FF7DE0B0000
unkown
page readonly
7FF76594D000
unkown
page execute and write copy
20806A60000
heap
page read and write
252D4662000
heap
page read and write
252D49B0000
remote allocation
page read and write
252CF08C000
heap
page read and write
7FF76980B000
unkown
page execute and read and write
CB2B0FE000
stack
page read and write
27CB8B60000
heap
page read and write
22C0BA40000
heap
page read and write
230A7298000
direct allocation
page execute read
27C141A0000
heap
page read and write
DA2CCFC000
stack
page read and write
252CF0B1000
heap
page read and write
22A36270000
heap
page read and write
25E0C813000
heap
page read and write
21E96249000
heap
page read and write
29271D20000
heap
page read and write
1FFE3238000
heap
page read and write
22C0BB13000
heap
page read and write
6E9DCFF000
stack
page read and write
259C9710000
direct allocation
page execute read
B8CF0C000
stack
page read and write
252D4580000
trusted library allocation
page read and write
2B09E1B0000
heap
page read and write
20806B60000
direct allocation
page execute read
CB2ACF9000
stack
page read and write
29271D18000
direct allocation
page execute read
1CB0010A000
heap
page read and write
1214C070000
heap
page read and write
FE8027C000
stack
page read and write
130A4C9000
unkown
page read and write
252CF03D000
heap
page read and write
7FF78CB01000
unkown
page read and write
252D46EC000
heap
page read and write
7FF690F1B000
unkown
page execute and read and write
177C8730000
heap
page read and write
22625800000
heap
page read and write
130A8FF000
stack
page read and write
252D0160000
trusted library section
page readonly
227D3360000
heap
page read and write
29271CF0000
heap
page read and write
252D46A0000
heap
page read and write
22C0B930000
trusted library allocation
page read and write
1B9C9188000
direct allocation
page execute read
1FFE3510000
heap
page read and write
7FF670FFD000
unkown
page execute and write copy
7FF69B12D000
unkown
page execute and read and write
252CEFB0000
trusted library allocation
page read and write
252CEE50000
heap
page read and write
1F951E86000
heap
page read and write
6C0D1BC000
stack
page read and write
177C86C0000
heap
page read and write
7FF77258F000
unkown
page execute and write copy
25E0C82C000
heap
page read and write
7FF769430000
unkown
page readonly
7FF7C3781000
unkown
page write copy
D80F6FF000
stack
page read and write
7FF6698C0000
unkown
page readonly
7FF7DE4A1000
unkown
page read and write
266E7C80000
heap
page read and write
7FF7C34DB000
unkown
page execute and read and write
2E85CFC000
stack
page read and write
7FF7A499B000
unkown
page execute and read and write
7FF7ACA61000
unkown
page write copy
D80F4FF000
stack
page read and write
1CB00420000
heap
page read and write
177C87A0000
heap
page read and write
130A4C7000
unkown
page read and write
7FF72703F000
unkown
page execute and write copy
7FF6F9E31000
unkown
page read and write
1F6B1090000
heap
page read and write
25E0C865000
heap
page read and write
1FA51970000
unkown
page read and write
7F72BFE000
stack
page read and write
252D49B0000
remote allocation
page read and write
EB0FB1C000
stack
page read and write
6E9DAFC000
stack
page read and write
7FF69B12F000
unkown
page execute and write copy
985DBFE000
stack
page read and write
266E8402000
trusted library allocation
page read and write
7FF624C80000
unkown
page readonly
7FF7AC670000
unkown
page readonly
252CEFC0000
trusted library section
page read and write
20806A40000
heap
page read and write
227E4970000
heap
page read and write
7FF690F2D000
unkown
page execute and read and write
1E84B4C0000
heap
page read and write
1C7A0460000
heap
page read and write
7FF726C50000
unkown
page readonly
25990002000
heap
page read and write
7FF78C710000
unkown
page readonly
7FF7D168D000
unkown
page execute and read and write
7FF7A49AD000
unkown
page execute and read and write
230A7270000
heap
page read and write
DA2CFFF000
stack
page read and write
AB919DC000
stack
page read and write
7FF64DD9B000
unkown
page execute and read and write
E1413FC000
stack
page read and write
E140B6C000
stack
page read and write
7FF67106B000
unkown
page execute and read and write
129366B8000
heap
page read and write
22A36300000
heap
page read and write
130A4CB000
unkown
page read and write
7FF7B097B000
unkown
page execute and read and write
252D0140000
trusted library section
page readonly
7FF7B05A0000
unkown
page readonly
252D462C000
heap
page read and write
22C0BA02000
heap
page read and write
7FF7D89CF000
unkown
page execute and write copy
252D4580000
trusted library allocation
page read and write
21E96276000
heap
page read and write
FDD0AFF000
stack
page read and write
129366A8000
direct allocation
page execute read
1214C240000
heap
page read and write
25E0C857000
heap
page read and write
130A7FC000
unkown
page read and write
D83E4FC000
stack
page read and write
3F03A7B000
stack
page read and write
1BAC0FF000
stack
page read and write
D83E5FE000
stack
page read and write
7FF6E7CFB000
unkown
page execute and read and write
7FF64E041000
unkown
page read and write
1F951E29000
heap
page read and write
2598F8E2000
heap
page read and write
7FF726C50000
unkown
page readonly
1FA53BD0000
unkown
page read and write
7FF7ACA4B000
unkown
page execute and read and write
27C14258000
heap
page read and write
1C7A0468000
heap
page read and write
DA2CEFF000
stack
page read and write
1FFE3010000
heap
page read and write
25E0C885000
heap
page read and write
1FA544FE000
unkown
page read and write
227D3530000
heap
page read and write
7FF69AE8B000
unkown
page execute and read and write
7FF762060000
unkown
page readonly
252CEE40000
heap
page read and write
1FA53902000
unkown
page read and write
252D460F000
heap
page read and write
55707FF000
stack
page read and write
D83E6FE000
stack
page read and write
22C0B7C0000
heap
page read and write
7FF77BDE0000
unkown
page readonly
7FF7A49B1000
unkown
page read and write
1FA51B90000
unkown
page readonly
7FF64B491000
unkown
page write copy
1FA51950000
unkown
page read and write
22C0B830000
heap
page read and write
5449CFF000
stack
page read and write
21E9623D000
heap
page read and write
218E4020000
direct allocation
page execute read
22A362E0000
heap
page read and write
7FF64DC50000
unkown
page readonly
20806B68000
direct allocation
page execute read
9C3C3FE000
stack
page read and write
F4EBFFF000
stack
page read and write
24D84D70000
heap
page read and write
22625902000
heap
page read and write
29271EE0000
heap
page read and write
259C9718000
direct allocation
page execute read
7FF624DCB000
unkown
page execute and read and write
35490FF000
stack
page read and write
6EF42FE000
stack
page read and write
1F6B1210000
direct allocation
page execute read
7FF6203BD000
unkown
page execute and write copy
292C6F78000
direct allocation
page execute read
252CF076000
heap
page read and write
1B9C91C0000
heap
page read and write
21E96300000
heap
page read and write
130A67E000
stack
page read and write
7FF6F9B8B000
unkown
page execute and read and write
252CF113000
heap
page read and write
D99D8FF000
stack
page read and write
7FF625071000
unkown
page read and write
22C0B7D0000
heap
page read and write
130A97E000
stack
page read and write
2E85EFF000
stack
page read and write
27CB8B30000
heap
page read and write
1E21B580000
heap
page read and write
7FF7BDCF1000
unkown
page read and write
7FF670C90000
unkown
page readonly
29271D28000
heap
page read and write
7FF7D12A0000
unkown
page readonly
7FF7DE41D000
unkown
page execute and write copy
1CB000F8000
heap
page read and write
7FF7721A0000
unkown
page readonly
1FA51978000
heap
page read and write
7631FFE000
stack
page read and write
230A7308000
heap
page read and write
7FF7D89BB000
unkown
page execute and read and write
259C96D0000
heap
page read and write
1214C3A0000
heap
page read and write
252D464B000
heap
page read and write
22A36690000
heap
page read and write
1FA51BE5000
unkown
page read and write
7FF7B0991000
unkown
page read and write
266E7D00000
heap
page read and write
1C7A1E20000
direct allocation
page execute read
7FF7DE49F000
unkown
page execute and write copy
2CC49BE0000
heap
page read and write
7FF690B40000
unkown
page readonly
7FF7A49AF000
unkown
page execute and write copy
1BAAF3D0000
heap
page read and write
9C3BFFC000
stack
page read and write
21E96302000
heap
page read and write
1F6B1260000
heap
page read and write
7FF7D168F000
unkown
page execute and write copy
FF49CFF000
stack
page read and write
177C87A8000
heap
page read and write
6EF427B000
stack
page read and write
22A36330000
heap
page read and write
1F951D10000
heap
page read and write
292C6FA0000
heap
page read and write
292C7170000
heap
page read and write
252CF918000
heap
page read and write
7FF620050000
unkown
page readonly
7FF7DE1FB000
unkown
page execute and read and write
7FF7C377D000
unkown
page execute and read and write
1FA51A5E000
unkown
page read and write
27CB8C60000
heap
page read and write
25E0C864000
heap
page read and write
266E7C3C000
heap
page read and write
22C0BA59000
heap
page read and write
1FFE3230000
heap
page read and write
1CB000A0000
direct allocation
page execute read
6EF46FE000
stack
page read and write
B85F7FF000
stack
page read and write
3F03D7E000
stack
page read and write
266E7C71000
heap
page read and write
21E9625A000
heap
page read and write
7FF78C710000
unkown
page readonly
7FF7B090D000
unkown
page execute and write copy
9C3C77D000
stack
page read and write
7FF79BCFD000
unkown
page execute and write copy
434C38C000
stack
page read and write
1BABEFC000
stack
page read and write
252CF913000
heap
page read and write
22C0C202000
trusted library allocation
page read and write
252CF815000
heap
page read and write
1FA51BE0000
heap
page read and write
1FA51A66000
unkown
page read and write
9C3C47B000
stack
page read and write
7E4BDC000
stack
page read and write
7FF7D89D1000
unkown
page write copy
7FF620441000
unkown
page read and write
25E0C86A000
heap
page read and write
7FF64B48D000
unkown
page execute and read and write
1E21B300000
heap
page read and write
25990113000
heap
page read and write
7FF7722EB000
unkown
page execute and read and write
15466200000
heap
page read and write
1FFE3190000
direct allocation
page execute read
7FF671081000
unkown
page write copy
1F951E13000
heap
page read and write
2598F6D0000
heap
page read and write
252D4600000
heap
page read and write
7FF671081000
unkown
page read and write
7FF7B06EB000
unkown
page execute and read and write
25E0C83C000
heap
page read and write
1B9C9490000
heap
page read and write
252D4594000
trusted library allocation
page read and write
21E97D60000
remote allocation
page read and write
7FF62505B000
unkown
page execute and read and write
266E7C4E000
heap
page read and write
12936660000
heap
page read and write
20809F10000
unkown
page read and write
B85F6FF000
stack
page read and write
25E0C846000
heap
page read and write
227D3358000
direct allocation
page execute read
7FF64B0A0000
unkown
page readonly
7FF6E7F9F000
unkown
page execute and write copy
7FF669CAD000
unkown
page execute and read and write
7FF7D160D000
unkown
page execute and write copy
25E0C868000
heap
page read and write
7FF769821000
unkown
page read and write
252CEEB0000
heap
page read and write
25E0C790000
heap
page read and write
64DC4FF000
stack
page read and write
7FF6D51AF000
unkown
page execute and write copy
154661A0000
direct allocation
page execute read
7FF6D4DC0000
unkown
page readonly
7FF772591000
unkown
page read and write
1FA5392D000
unkown
page read and write
1FA538F0000
unkown
page read and write
7FF67107F000
unkown
page execute and write copy
1FA539F0000
unkown
page readonly
252CF7E3000
trusted library allocation
page read and write
22C0BA28000
heap
page read and write
154664C0000
heap
page read and write
FE8037E000
stack
page read and write
7FF7BD900000
unkown
page readonly
27CB8B58000
direct allocation
page execute read
25E0C840000
heap
page read and write
252D4960000
trusted library allocation
page read and write
1FA518E0000
unkown
page read and write
7FF7BD900000
unkown
page readonly
7FF7C376B000
unkown
page execute and read and write
2AADDAA8000
direct allocation
page execute read
7FF7D85E0000
unkown
page readonly
6EF437E000
stack
page read and write
7FF726D9B000
unkown
page execute and read and write
252D461E000
heap
page read and write
1E21B2F8000
direct allocation
page execute read
2CC49BE8000
heap
page read and write
1E21B314000
heap
page read and write
20808450000
heap
page read and write
230A7300000
heap
page read and write
25E0C730000
heap
page read and write
35491FE000
stack
page read and write
DA2CDFF000
stack
page read and write
7FF6F9E2F000
unkown
page execute and write copy
252D4530000
trusted library allocation
page read and write
7FF64E03F000
unkown
page execute and write copy
1F6B1218000
direct allocation
page execute read
252CF071000
heap
page read and write
227D3550000
heap
page read and write
CB2ADFB000
stack
page read and write
252D0040000
trusted library allocation
page read and write
7FF6F9A40000
unkown
page readonly
266E7C51000
heap
page read and write
252D4920000
trusted library allocation
page read and write
7FF6F9DAD000
unkown
page execute and write copy
20808710000
heap
page read and write
1E84B500000
heap
page read and write
1E21B190000
heap
page read and write
7FF7655E0000
unkown
page readonly
27C14210000
heap
page read and write
7FF7D12A0000
unkown
page readonly
252D4550000
trusted library allocation
page read and write
7FF690EAD000
unkown
page execute and write copy
1FA51F70000
unkown
page readonly
1F951F02000
heap
page read and write
230A71E0000
heap
page read and write
7FF6F9E31000
unkown
page write copy
1214C060000
direct allocation
page execute read
5449DFF000
stack
page read and write
7FF6F9A40000
unkown
page readonly
226256B0000
heap
page read and write
1214C260000
heap
page read and write
FE8087E000
stack
page read and write
21E96224000
heap
page read and write
1FA51DF0000
unkown
page readonly
20808330000
heap
page read and write
21E96259000
heap
page read and write
170E10D8000
direct allocation
page execute read
7FF690F2F000
unkown
page execute and write copy
25E0C7C0000
trusted library allocation
page read and write
There are 994 hidden memdumps, click here to show them.