Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
printouts of outstanding as of 01_20_2021.xlsm
|
Microsoft Excel 2007+
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\ylztwx[1].rar
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\by9zwa7p1[1].zip
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\xkpffwn[1].zip
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\h79fwesfe[1].rar
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Temp\ogsit.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\zlgzuxvz.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\zsijkwsd.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\~$printouts of outstanding as of 01_20_2021.xlsm
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, 58936 bytes, 1 file
|
dropped
|
 |
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\suspendedpage[1].htm
|
HTML document, ASCII text, with very long lines
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B2F6E8C4.png
|
PNG image data, 699 x 298, 8-bit colormap, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BCA4260F.png
|
PNG image data, 114 x 98, 8-bit colormap, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C7A618C6.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\780F0000
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\CabF789.tmp
|
Microsoft Cabinet archive data, 58936 bytes, 1 file
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\Excel8.0\MSForms.exd
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\TarF78A.tmp
|
data
|
modified
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue
Oct 17 10:04:00 2017, mtime=Wed Jan 20 23:12:58 2021, atime=Wed Jan 20 23:12:58 2021, length=8192, window=hide
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\printouts of outstanding as of 01_20_2021.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:15
2020, mtime=Wed Jan 20 23:12:58 2021, atime=Wed Jan 20 23:13:00 2021, length=54601, window=hide
|
dropped
|
|
|
|
C:\Users\user\Desktop\EC1F0000
|
data
|
dropped
|
|
There are 13 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\zsijkwsd.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\zsijkwsd.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\zdkvrlsh.dll
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
-s C:\Users\user\AppData\Local\Temp\zsijkwsd.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\zaviwlej.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\alajwj.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\ogsit.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\ogsit.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\ogsit.dll
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
-s C:\Users\user\AppData\Local\Temp\ogsit.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\ogsit.dll
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
-s C:\Users\user\AppData\Local\Temp\ogsit.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\ogsit.dll
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
-s C:\Users\user\AppData\Local\Temp\ogsit.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\luwbghnz.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\zlgzuxvz.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\zlgzuxvz.dll
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
-s C:\Users\user\AppData\Local\Temp\zlgzuxvz.dll
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\zlgzuxvz.dll
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
-s C:\Users\user\AppData\Local\Temp\zlgzuxvz.dll
|
|
There are 11 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://cms.ivpr.org/by9zwa7p1.zip
|
64.37.52.138
|
|
|
|
http://monitrade.net/h79fwesfe.rar
|
192.185.147.185
|
|
|
|
http://salaodigitalautomovel.pt.deve.pt/d8ms3mljy.zip
|
185.32.190.115
|
|
|
|
http://laureys.be/uzssv27.rar
|
85.17.252.207
|
|
|
|
http://artec.com.tr/xkpffwn.zip
|
46.28.239.13
|
|
|
|
https://198.57.200.100:3786/hy;R
|
unknown
|
|
|
|
https://211.110.44.63:5353/
|
unknown
|
|
|
|
https://69.164.207.140/
|
unknown
|
|
|
|
http://crl.entrust.net/server1.crl0
|
unknown
|
|
|
|
https://194.225.58.214/5
|
unknown
|
|
|
|
http://ocsp.entrust.net03
|
unknown
|
|
|
|
https://194.225.58.214/
|
unknown
|
|
|
|
https://211.110.44.63/~
|
unknown
|
|
|
|
https://194.225.58.214/9
|
unknown
|
|
|
|
http://laureys.be/cgi-sys/suspendedpage.cgi
|
85.17.252.207
|
|
|
|
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
|
unknown
|
|
|
|
https://69.164.207.140:3388/hy
|
unknown
|
|
|
|
http://www.diginotar.nl/cps/pkioverheid0
|
unknown
|
|
|
|
https://69.164.207.140/q
|
unknown
|
|
|
|
https://69.164.207.140:3388/
|
unknown
|
|
|
|
http://bafnabrotherskesarwala.com/ys95lm6k.rar
|
103.11.153.223
|
|
|
|
https://198.57.200.100:3786/
|
unknown
|
|
|
|
https://211.110.44.63/h
|
unknown
|
|
|
|
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
|
unknown
|
|
|
|
https://198.57.200.100/
|
unknown
|
|
|
|
https://211.110.44.63/
|
unknown
|
|
|
|
http://www.gastronauts.asia/ylztwx.rar
|
132.148.96.144
|
|
|
|
http://ocsp.entrust.net0D
|
unknown
|
|
|
|
https://secure.comodo.com/CPS0
|
unknown
|
|
|
|
http://servername/isapibackend.dll
|
unknown
|
|
|
|
http://crl.entrust.net/2048ca.crl0
|
unknown
|
|
There are 21 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
bafnabrotherskesarwala.com
|
103.11.153.223
|
|
|
|
salaodigitalautomovel.pt.deve.pt
|
185.32.190.115
|
|
|
|
monitrade.net
|
192.185.147.185
|
|
|
|
laureys.be
|
85.17.252.207
|
|
|
|
artec.com.tr
|
46.28.239.13
|
|
|
|
cms.ivpr.org
|
64.37.52.138
|
|
|
|
gastronauts.asia
|
132.148.96.144
|
|
|
|
www.gastronauts.asia
|
unknown
|
|
IPs
|
IP
|
Domain
|
Country
|
Active
|
Malicious
|
|
|---|---|---|---|---|---|
|
198.57.200.100
|
unknown
|
United States
|
unknown
|
|
|
|
69.164.207.140
|
unknown
|
United States
|
unknown
|
|
|
|
211.110.44.63
|
unknown
|
Korea Republic of
|
unknown
|
|
|
|
194.225.58.214
|
unknown
|
Iran (ISLAMIC Republic Of)
|
unknown
|
|
|
|
185.32.190.115
|
unknown
|
Portugal
|
unknown
|
|
|
|
85.17.252.207
|
unknown
|
Netherlands
|
unknown
|
|
|
|
103.11.153.223
|
unknown
|
India
|
unknown
|
|
|
|
46.28.239.13
|
unknown
|
Turkey
|
unknown
|
|
|
|
192.185.147.185
|
unknown
|
United States
|
unknown
|
|
|
|
132.148.96.144
|
unknown
|
United States
|
unknown
|
|
|
|
64.37.52.138
|
unknown
|
United States
|
unknown
|
|
There are 1 hidden IPs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
=?4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
MTTT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
VBAFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ReviewToken
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EF67F
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
FontCachePath
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DefaultSheetR2L
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
UseSystemSeparators
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ThousandsSeparator
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DecimalSeparator
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F0686
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F07CE
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductNonBootFilesIntl_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F1989
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F2626
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
`g4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
LastPurgeTime
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
FF3F0
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1003C8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EXCELFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SavedLegacySettings
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductNonBootFilesIntl_1033
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
SavedLegacySettings
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
SavedLegacySettings
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
Blob
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
Blob
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
Blob
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
Blob
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
Blob
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
Blob
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
SavedLegacySettings
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
SavedLegacySettings
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
SavedLegacySettings
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
SavedLegacySettings
|
|
There are 270 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
476000
|
unkown
|
page read and write
|
|
|
|
331C000
|
unkown
|
page read and write
|
|
|
|
D10000
|
unkown
|
page execute and read and write
|
|
|
|
79A000
|
heap private
|
page read and write
|
|
|
|
650000
|
unkown
|
page readonly
|
|
|
|
1D90000
|
unkown
|
page readonly
|
|
|
|
7B0000
|
unkown
|
page read and write
|
|
|
|
3E8000
|
unkown
|
page read and write
|
|
|
|
606000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
6A4000
|
heap private
|
page read and write
|
|
|
|
5C4000
|
heap private
|
page read and write
|
|
|
|
33E3000
|
unkown
|
page read and write
|
|
|
|
80000
|
unkown
|
page read and write
|
|
|
|
1DF0000
|
unkown
|
page readonly
|
|
|
|
22D0000
|
heap private
|
page read and write
|
|
|
|
7B0000
|
unkown
|
page read and write
|
|
|
|
390000
|
heap default
|
page read and write
|
|
|
|
70000
|
unkown
|
page readonly
|
|
|
|
22A000
|
heap default
|
page read and write
|
|
|
|
264000
|
unkown
|
page read and write
|
|
|
|
48C000
|
unkown
|
page read and write
|
|
|
|
350000
|
unkown
|
page read and write
|
|
|
|
116000
|
unkown
|
page read and write
|
|
|
|
32B6000
|
unkown
|
page read and write
|
|
|
|
326000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page readonly
|
|
|
|
70300000
|
unkown image
|
page readonly
|
|
|
|
190000
|
unkown
|
page execute and read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
29E000
|
heap default
|
page read and write
|
|
|
|
32A7000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
90000
|
unkown
|
page read and write
|
|
|
|
5C4000
|
heap private
|
page read and write
|
|
|
|
32F000
|
heap default
|
page read and write
|
|
|
|
1BE000
|
heap default
|
page read and write
|
|
|
|
E0000
|
unkown
|
page read and write
|
|
|
|
1CF0000
|
unkown
|
page readonly
|
|
|
|
6A0000
|
heap private
|
page read and write
|
|
|
|
590000
|
heap default
|
page read and write
|
|
|
|
474000
|
heap private
|
page read and write
|
|
|
|
280000
|
unkown
|
page readonly
|
|
|
|
590000
|
heap private
|
page read and write
|
|
|
|
496000
|
unkown
|
page read and write
|
|
|
|
31C000
|
heap default
|
page read and write
|
|
|
|
2A7000
|
heap default
|
page read and write
|
|
|
|
243000
|
heap default
|
page read and write
|
|
|
|
1DF0000
|
unkown
|
page readonly
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
100000
|
unkown
|
page read and write
|
|
|
|
310000
|
unkown
|
page read and write
|
|
|
|
802000
|
heap private
|
page read and write
|
|
|
|
220000
|
heap default
|
page read and write
|
|
|
|
556000
|
unkown
|
page read and write
|
|
|
|
3F0000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
E0000
|
unkown
|
page read and write
|
|
|
|
2DE000
|
heap default
|
page read and write
|
|
|
|
434000
|
heap private
|
page read and write
|
|
|
|
2A0000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
640000
|
unkown
|
page readonly
|
|
|
|
3B4000
|
heap default
|
page read and write
|
|
|
|
418000
|
heap default
|
page read and write
|
|
|
|
E0000
|
unkown
|
page read and write
|
|
|
|
51B000
|
heap default
|
page read and write
|
|
|
|
22D5000
|
heap private
|
page read and write
|
|
|
|
6E0000
|
unkown
|
page readonly
|
|
|
|
790000
|
unkown
|
page readonly
|
|
|
|
3AE000
|
heap default
|
page read and write
|
|
|
|
375000
|
heap default
|
page read and write
|
|
|
|
403000
|
heap default
|
page read and write
|
|
|
|
4B0000
|
unkown
|
page readonly
|
|
|
|
CD0000
|
unkown
|
page execute and read and write
|
|
|
|
400000
|
heap private
|
page read and write
|
|
|
|
3C3000
|
heap default
|
page read and write
|
|
|
|
1E30000
|
unkown
|
page readonly
|
|
|
|
2095000
|
heap private
|
page read and write
|
|
|
|
273000
|
heap default
|
page read and write
|
|
|
|
17D000
|
heap default
|
page read and write
|
|
|
|
355000
|
heap private
|
page read and write
|
|
|
|
180000
|
heap default
|
page read and write
|
|
|
|
4C0000
|
heap private
|
page read and write
|
|
|
|
70000
|
unkown
|
page read and write
|
|
|
|
512000
|
heap default
|
page read and write
|
|
|
|
2F3000
|
heap default
|
page read and write
|
|
|
|
466000
|
heap private
|
page read and write
|
|
|
|
170000
|
unkown
|
page read and write
|
|
|
|
3E1000
|
unkown
|
page read and write
|
|
|
|
20F0000
|
unkown
|
page readonly
|
|
|
|
519000
|
heap default
|
page read and write
|
|
|
|
34A000
|
heap default
|
page read and write
|
|
|
|
323000
|
heap default
|
page read and write
|
|
|
|
2F7000
|
heap default
|
page read and write
|
|
|
|
3A4000
|
heap private
|
page read and write
|
|
|
|
307000
|
heap default
|
page read and write
|
|
|
|
3CC000
|
heap default
|
page read and write
|
|
|
|
3EA000
|
heap default
|
page read and write
|
|
|
|
595000
|
heap private
|
page read and write
|
|
|
|
820000
|
unkown
|
page readonly
|
|
|
|
36A000
|
heap default
|
page read and write
|
|
|
|
4C0000
|
heap private
|
page read and write
|
|
|
|
1D50000
|
unkown
|
page readonly
|
|
|
|
270000
|
heap default
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
3F0000
|
unkown
|
page read and write
|
|
|
|
26E000
|
heap default
|
page read and write
|
|
|
|
154000
|
heap private
|
page read and write
|
|
|
|
E0000
|
unkown
|
page read and write
|
|
|
|
247000
|
heap default
|
page read and write
|
|
|
|
436000
|
heap default
|
page read and write
|
|
|
|
550000
|
heap private
|
page read and write
|
|
|
|
BC0000
|
unkown
|
page readonly
|
|
|
|
B34000
|
unkown
|
page read and write
|
|
|
|
340000
|
unkown
|
page readonly
|
|
|
|
3E8000
|
heap default
|
page read and write
|
|
|
|
354000
|
heap default
|
page read and write
|
|
|
|
660000
|
heap private
|
page read and write
|
|
|
|
2A0000
|
unkown
|
page read and write
|
|
|
|
470000
|
heap private
|
page read and write
|
|
|
|
440000
|
unkown
|
page read and write
|
|
|
|
425000
|
unkown
|
page read and write
|
|
|
|
77E000
|
unkown
|
page read and write
|
|
|
|
630000
|
heap private
|
page read and write
|
|
|
|
33E3000
|
unkown
|
page read and write
|
|
|
|
2080000
|
unkown
|
page readonly
|
|
|
|
326E000
|
unkown
|
page read and write
|
|
|
|
4A0000
|
unkown
|
page readonly
|
|
|
|
3E9000
|
unkown
|
page read and write
|
|
|
|
2CB000
|
unkown
|
page read and write
|
|
|
|
33D000
|
unkown
|
page read and write
|
|
|
|
32C4000
|
unkown
|
page read and write
|
|
|
|
1EF000
|
heap default
|
page read and write
|
|
|
|
210000
|
heap private
|
page read and write
|
|
|
|
35A000
|
heap default
|
page read and write
|
|
|
|
243000
|
heap default
|
page read and write
|
|
|
|
5A0000
|
unkown
|
page readonly
|
|
|
|
34F000
|
unkown
|
page read and write
|
|
|
|
7F0000
|
unkown
|
page readonly
|
|
|
|
32BA000
|
unkown
|
page read and write
|
|
|
|
1EA000
|
heap default
|
page read and write
|
|
|
|
430000
|
heap private
|
page read and write
|
|
|
|
1F0000
|
heap private
|
page read and write
|
|
|
|
1E0000
|
unkown
|
page execute and read and write
|
|
|
|
850000
|
unkown
|
page readonly
|
|
|
|
8C0000
|
unkown
|
page readonly
|
|
|
|
1A0000
|
unkown
|
page execute and read and write
|
|
|
|
830000
|
unkown
|
page readonly
|
|
|
|
2A6000
|
unkown
|
page read and write
|
|
|
|
28A000
|
heap default
|
page read and write
|
|
|
|
2A0000
|
unkown
|
page read and write
|
|
|
|
180000
|
unkown
|
page readonly
|
|
|
|
2B7000
|
heap default
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
130000
|
heap default
|
page read and write
|
|
|
|
4A0000
|
heap default
|
page read and write
|
|
|
|
C0000
|
heap default
|
page read and write
|
|
|
|
120000
|
unkown
|
page readonly
|
|
|
|
4E0000
|
unkown
|
page readonly
|
|
|
|
2A0000
|
heap default
|
page read and write
|
|
|
|
2F0000
|
unkown
|
page execute and read and write
|
|
|
|
425000
|
unkown
|
page read and write
|
|
|
|
220B000
|
heap private
|
page read and write
|
|
|
|
22E000
|
heap default
|
page read and write
|
|
|
|
290000
|
unkown
|
page read and write
|
|
|
|
236000
|
unkown
|
page read and write
|
|
|
|
7E0000
|
heap private
|
page read and write
|
|
|
|
1E4000
|
heap private
|
page read and write
|
|
|
|
180000
|
unkown
|
page readonly
|
|
|
|
3E1000
|
unkown
|
page read and write
|
|
|
|
1F8000
|
heap private
|
page read and write
|
|
|
|
F0000
|
unkown
|
page read and write
|
|
|
|
7FE000
|
unkown
|
page read and write
|
|
|
|
70000
|
unkown
|
page read and write
|
|
|
|
654000
|
heap private
|
page read and write
|
|
|
|
3E8000
|
unkown
|
page read and write
|
|
|
|
47D000
|
heap default
|
page read and write
|
|
|
|
38B000
|
heap private
|
page read and write
|
|
|
|
326C000
|
unkown
|
page read and write
|
|
|
|
325000
|
heap default
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
8F0000
|
unkown
|
page readonly
|
|
|
|
F0000
|
heap private
|
page read and write
|
|
|
|
2F0000
|
unkown
|
page readonly
|
|
|
|
3CA000
|
heap default
|
page read and write
|
|
|
|
250000
|
heap default
|
page read and write
|
|
|
|
E7000
|
heap default
|
page read and write
|
|
|
|
240000
|
unkown
|
page readonly
|
|
|
|
16E000
|
heap default
|
page read and write
|
|
|
|
1A0000
|
unkown
|
page readonly
|
|
|
|
2090000
|
heap private
|
page read and write
|
|
|
|
1F6000
|
unkown
|
page read and write
|
|
|
|
160000
|
unkown
|
page read and write
|
|
|
|
33F5000
|
unkown
|
page read and write
|
|
|
|
F0000
|
unkown
|
page read and write
|
|
|
|
4F0000
|
unkown
|
page readonly
|
|
|
|
420000
|
unkown
|
page read and write
|
|
|
|
70000
|
unkown
|
page readonly
|
|
|
|
544000
|
heap private
|
page read and write
|
|
|
|
5F0000
|
unkown
|
page write copy
|
|
|
|
426000
|
unkown
|
page read and write
|
|
|
|
624000
|
heap private
|
page read and write
|
|
|
|
2050000
|
unkown
|
page readonly
|
|
|
|
33E000
|
heap default
|
page read and write
|
|
|
|
3E6000
|
unkown
|
page read and write
|
|
|
|
29D000
|
unkown
|
page read and write
|
|
|
|
215000
|
heap private
|
page read and write
|
|
|
|
1FC000
|
unkown
|
page read and write
|
|
|
|
187000
|
heap default
|
page read and write
|
|
|
|
540000
|
heap private
|
page read and write
|
|
|
|
2D0000
|
heap default
|
page read and write
|
|
|
|
620000
|
heap private
|
page read and write
|
|
|
|
35F000
|
unkown
|
page read and write
|
|
|
|
70000
|
unkown
|
page readonly
|
|
|
|
1EB000
|
unkown
|
page read and write
|
|
|
|
1A0000
|
unkown
|
page execute and read and write
|
|
|
|
C4000
|
heap private
|
page read and write
|
|
|
|
180000
|
heap private
|
page read and write
|
|
|
|
2170000
|
heap private
|
page read and write
|
|
|
|
70000
|
unkown
|
page readonly
|
|
|
|
120000
|
unkown
|
page readonly
|
|
|
|
100000
|
unkown
|
page readonly
|
|
|
|
1DA000
|
heap default
|
page read and write
|
|
|
|
480000
|
unkown
|
page write copy
|
|
|
|
4C4000
|
heap default
|
page read and write
|
|
|
|
3F0000
|
unkown
|
page read and write
|
|
|
|
16A000
|
unkown
|
page read and write
|
|
|
|
33F0000
|
unkown
|
page read and write
|
|
|
|
4A6000
|
unkown
|
page read and write
|
|
|
|
33E3000
|
unkown
|
page read and write
|
|
|
|
32BB000
|
unkown
|
page read and write
|
|
|
|
220000
|
heap private
|
page read and write
|
|
|
|
32A000
|
heap default
|
page read and write
|
|
|
|
1B7000
|
heap default
|
page read and write
|
|
|
|
544000
|
heap private
|
page read and write
|
|
|
|
260000
|
heap default
|
page read and write
|
|
|
|
9AE000
|
unkown
|
page read and write
|
|
|
|
21DB000
|
heap private
|
page read and write
|
|
|
|
7F0000
|
unkown
|
page readonly
|
|
|
|
4B6000
|
unkown
|
page read and write
|
|
|
|
15D000
|
heap default
|
page read and write
|
|
|
|
6E0000
|
unkown
|
page readonly
|
|
|
|
880000
|
unkown
|
page readonly
|
|
|
|
404000
|
heap private
|
page read and write
|
|
|
|
420000
|
unkown
|
page readonly
|
|
|
|
3D6000
|
unkown
|
page read and write
|
|
|
|
45D000
|
unkown
|
page read and write
|
|
|
|
F0000
|
unkown
|
page read and write
|
|
|
|
456000
|
unkown
|
page read and write
|
|
|
|
7E4000
|
heap private
|
page read and write
|
|
|
|
550000
|
unkown
|
page read and write
|
|
|
|
570000
|
unkown
|
page write copy
|
|
|
|
1B0000
|
heap default
|
page read and write
|
|
|
|
18A000
|
heap default
|
page read and write
|
|
|
|
3A0000
|
unkown
|
page read and write
|
|
|
|
2F0000
|
unkown
|
page read and write
|
|
|
|
704000
|
heap private
|
page read and write
|
|
|
|
52F000
|
heap default
|
page read and write
|
|
|
|
2060000
|
unkown
|
page readonly
|
|
|
|
570000
|
heap private
|
page read and write
|
|
|
|
27A000
|
heap default
|
page read and write
|
|
|
|
2090000
|
unkown
|
page readonly
|
|
|
|
33E1000
|
unkown
|
page read and write
|
|
|
|
8A000
|
unkown
|
page read and write
|
|
|
|
70000
|
unkown
|
page read and write
|
|
|
|
4C4000
|
heap private
|
page read and write
|
|
|
|
356000
|
unkown
|
page read and write
|
|
|
|
1D0000
|
unkown
|
page execute and read and write
|
|
|
|
556000
|
heap private
|
page read and write
|
|
|
|
9D0000
|
unkown
|
page readonly
|
|
|
|
370000
|
unkown
|
page read and write
|
|
|
|
33F0000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
3E9000
|
heap default
|
page read and write
|
|
|
|
21A0000
|
heap private
|
page read and write
|
|
|
|
B0000
|
unkown
|
page readonly
|
|
|
|
790000
|
heap private
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
390000
|
heap default
|
page read and write
|
|
|
|
8A0000
|
unkown
|
page readonly
|
|
|
|
134000
|
heap private
|
page read and write
|
|
|
|
350000
|
heap private
|
page read and write
|
|
|
|
E0000
|
unkown
|
page readonly
|
|
|
|
150000
|
heap private
|
page read and write
|
|
|
|
120000
|
heap private
|
page read and write
|
|
|
|
6EE000
|
unkown
|
page read and write
|
|
|
|
210000
|
unkown
|
page execute and read and write
|
|
|
|
14C000
|
unkown
|
page read and write
|
|
|
|
1A0000
|
unkown
|
page readonly
|
|
|
|
2FA000
|
heap default
|
page read and write
|
|
|
|
2B6000
|
unkown
|
page read and write
|
|
|
|
3E1000
|
unkown
|
page read and write
|
|
|
|
630000
|
unkown
|
page readonly
|
|
|
|
1CF0000
|
unkown
|
page readonly
|
|
|
|
890000
|
unkown
|
page readonly
|
|
|
|
A30000
|
unkown
|
page readonly
|
|
|
|
337000
|
heap default
|
page read and write
|
|
|
|
120000
|
unkown
|
page readonly
|
|
|
|
360000
|
unkown
|
page readonly
|
|
|
|
360000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
21F0000
|
unkown
|
page readonly
|
|
|
|
1D90000
|
unkown
|
page readonly
|
|
|
|
237000
|
heap default
|
page read and write
|
|
|
|
150000
|
unkown
|
page readonly
|
|
|
|
1C0000
|
unkown
|
page execute and read and write
|
|
|
|
7F0000
|
heap private
|
page read and write
|
|
|
|
506000
|
unkown
|
page read and write
|
|
|
|
28E000
|
unkown
|
page read and write
|
|
|
|
1CB000
|
unkown
|
page read and write
|
|
|
|
E0000
|
unkown
|
page read and write
|
|
|
|
330000
|
heap default
|
page read and write
|
|
|
|
137000
|
heap default
|
page read and write
|
|
|
|
25C000
|
heap default
|
page read and write
|
|
|
|
80000
|
unkown
|
page read and write
|
|
|
|
426000
|
unkown
|
page read and write
|
|
|
|
1B4000
|
heap private
|
page read and write
|
|
|
|
230000
|
heap default
|
page read and write
|
|
|
|
25C000
|
unkown
|
page read and write
|
|
|
|
1F0000
|
heap default
|
page read and write
|
|
|
|
500000
|
heap private
|
page read and write
|
|
|
|
3B0000
|
unkown
|
page readonly
|
|
|
|
614000
|
heap private
|
page read and write
|
|
|
|
5CB000
|
heap private
|
page read and write
|
|
|
|
294000
|
heap private
|
page read and write
|
|
|
|
2205000
|
heap private
|
page read and write
|
|
|
|
3E3000
|
heap default
|
page read and write
|
|
|
|
3A0000
|
heap private
|
page read and write
|
|
|
|
24C000
|
unkown
|
page read and write
|
|
|
|
880000
|
unkown
|
page readonly
|
|
|
|
F6000
|
heap private
|
page read and write
|
|
|
|
6D0000
|
unkown
|
page readonly
|
|
|
|
4D0000
|
unkown
|
page readonly
|
|
|
|
272000
|
unkown
|
page read and write
|
|
|
|
283000
|
heap default
|
page read and write
|
|
|
|
2D4000
|
heap default
|
page read and write
|
|
|
|
4F0000
|
unkown
|
page read and write
|
|
|
|
32E000
|
heap default
|
page read and write
|
|
|
|
342A000
|
unkown
|
page read and write
|
|
|
|
750000
|
unkown
|
page readonly
|
|
|
|
1D70000
|
unkown
|
page readonly
|
|
|
|
720000
|
unkown
|
page readonly
|
|
|
|
3CE000
|
heap default
|
page read and write
|
|
|
|
25E000
|
heap default
|
page read and write
|
|
|
|
280000
|
unkown
|
page read and write
|
|
|
|
6E630000
|
unkown image
|
page readonly
|
|
|
|
760000
|
heap private
|
page read and write
|
|
|
|
664000
|
heap private
|
page read and write
|
|
|
|
6D0000
|
unkown
|
page readonly
|
|
|
|
21F0000
|
unkown
|
page write copy
|
|
|
|
1FC000
|
unkown
|
page read and write
|
|
|
|
575000
|
heap private
|
page read and write
|
|
|
|
240000
|
heap default
|
page read and write
|
|
|
|
C0000
|
heap private
|
page read and write
|
|
|
|
170000
|
unkown
|
page readonly
|
|
|
|
41F000
|
unkown
|
page read and write
|
|
|
|
650000
|
heap private
|
page read and write
|
|
|
|
990000
|
unkown
|
page readonly
|
|
|
|
AB000
|
unkown
|
page read and write
|
|
|
|
320000
|
unkown
|
page read and write
|
|
|
|
1D0000
|
unkown
|
page execute and read and write
|
|
|
|
3E9000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
4DF000
|
heap default
|
page read and write
|
|
|
|
7C0000
|
unkown
|
page readonly
|
|
|
|
100000
|
unkown
|
page readonly
|
|
|
|
32BB000
|
unkown
|
page read and write
|
|
|
|
900000
|
heap private
|
page read and write
|
|
|
|
782000
|
heap private
|
page read and write
|
|
|
|
32A000
|
heap default
|
page read and write
|
|
|
|
4E6000
|
unkown
|
page read and write
|
|
|
|
7F4000
|
heap private
|
page read and write
|
|
|
|
7D0000
|
unkown
|
page readonly
|
|
|
|
1FA0000
|
unkown
|
page readonly
|
|
|
|
300000
|
heap default
|
page read and write
|
|
|
|
397000
|
heap default
|
page read and write
|
|
|
|
15A000
|
unkown
|
page read and write
|
|
|
|
5D0000
|
unkown
|
page readonly
|
|
|
|
273000
|
unkown
|
page read and write
|
|
|
|
14C000
|
unkown
|
page read and write
|
|
|
|
397000
|
heap default
|
page read and write
|
|
|
|
230000
|
unkown
|
page readonly
|
|
|
|
223B000
|
heap private
|
page read and write
|
|
|
|
6E3E0000
|
unkown image
|
page readonly
|
|
|
|
20B000
|
unkown
|
page read and write
|
|
|
|
268000
|
heap default
|
page read and write
|
|
|
|
6C4000
|
heap private
|
page read and write
|
|
|
|
32BB000
|
unkown
|
page read and write
|
|
|
|
140000
|
unkown
|
page readonly
|
|
|
|
13C000
|
unkown
|
page read and write
|
|
|
|
B0000
|
unkown
|
page readonly
|
|
|
|
5C0000
|
heap private
|
page read and write
|
|
|
|
320000
|
unkown
|
page read and write
|
|
|
|
1E0000
|
heap private
|
page read and write
|
|
|
|
510000
|
unkown
|
page read and write
|
|
|
|
2070000
|
unkown
|
page readonly
|
|
|
|
6C0000
|
heap private
|
page read and write
|
|
|
|
B2F000
|
unkown
|
page read and write
|
|
|
|
240000
|
unkown
|
page readonly
|
|
|
|
80000
|
unkown
|
page read and write
|
|
|
|
500000
|
unkown
|
page write copy
|
|
|
|
7E0000
|
unkown
|
page readonly
|
|
|
|
32E9000
|
unkown
|
page read and write
|
|
|
|
26C000
|
unkown
|
page read and write
|
|
|
|
1F7000
|
heap default
|
page read and write
|
|
|
|
B0000
|
unkown
|
page readonly
|
|
|
|
70000
|
unkown
|
page read and write
|
|
|
|
700000
|
unkown
|
page readonly
|
|
|
|
2B3000
|
heap default
|
page read and write
|
|
|
|
474000
|
heap private
|
page read and write
|
|
|
|
170000
|
unkown
|
page execute and read and write
|
|
|
|
1B0000
|
heap private
|
page read and write
|
|
|
|
293000
|
heap default
|
page read and write
|
|
|
|
460000
|
heap private
|
page read and write
|
|
|
|
278000
|
unkown
|
page read and write
|
|
|
|
9C0000
|
heap private
|
page read and write
|
|
|
|
910000
|
unkown
|
page readonly
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
1E0000
|
unkown
|
page read and write
|
|
|
|
764000
|
heap private
|
page read and write
|
|
|
|
120000
|
heap default
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
410000
|
heap private
|
page read and write
|
|
|
|
430000
|
unkown
|
page execute and read and write
|
|
|
|
183000
|
heap default
|
page read and write
|
|
|
|
3CF000
|
heap default
|
page read and write
|
|
|
|
226000
|
heap default
|
page read and write
|
|
|
|
520000
|
unkown
|
page read and write
|
|
|
|
133000
|
heap default
|
page read and write
|
|
|
|
4DA000
|
heap default
|
page read and write
|
|
|
|
25F000
|
unkown
|
page read and write
|
|
|
|
2EA000
|
heap default
|
page read and write
|
|
|
|
26C000
|
unkown
|
page read and write
|
|
|
|
110000
|
unkown
|
page execute and read and write
|
|
|
|
29A000
|
heap default
|
page read and write
|
|
|
|
2280000
|
unkown
|
page write copy
|
|
|
|
2F7000
|
heap default
|
page read and write
|
|
|
|
2F0000
|
heap default
|
page read and write
|
|
|
|
274000
|
unkown
|
page read and write
|
|
|
|
516000
|
heap default
|
page read and write
|
|
|
|
5D0000
|
unkown
|
page readonly
|
|
|
|
30E000
|
heap default
|
page read and write
|
|
|
|
4B0000
|
unkown
|
page read and write
|
|
|
|
6E630000
|
unkown image
|
page readonly
|
|
|
|
2EF000
|
heap default
|
page read and write
|
|
|
|
D0000
|
unkown
|
page read and write
|
|
|
|
3D0000
|
heap private
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
70000
|
unkown
|
page readonly
|
|
|
|
470000
|
heap private
|
page read and write
|
|
|
|
270000
|
unkown
|
page read and write
|
|
|
|
33E1000
|
unkown
|
page read and write
|
|
|
|
170000
|
unkown
|
page readonly
|
|
|
|
2110000
|
unkown
|
page readonly
|
|
|
|
290000
|
unkown
|
page read and write
|
|
|
|
150000
|
unkown
|
page readonly
|
|
|
|
510000
|
heap private
|
page read and write
|
|
|
|
40B000
|
heap private
|
page read and write
|
|
|
|
42F000
|
unkown
|
page read and write
|
|
|
|
5A0000
|
unkown
|
page readonly
|
|
|
|
3CA000
|
heap default
|
page read and write
|
|
|
|
390000
|
heap default
|
page read and write
|
|
|
|
6E630000
|
unkown image
|
page readonly
|
|
|
|
400000
|
unkown
|
page read and write
|
|
|
|
110000
|
unkown
|
page readonly
|
|
|
|
480000
|
unkown
|
page read and write
|
|
|
|
634000
|
heap private
|
page read and write
|
|
|
|
9D0000
|
unkown
|
page readonly
|
|
|
|
E00000
|
unkown
|
page execute and read and write
|
|
|
|
80000
|
unkown
|
page read and write
|
|
|
|
2130000
|
unkown
|
page write copy
|
|
|
|
3221000
|
unkown
|
page read and write
|
|
|
|
460000
|
unkown
|
page read and write
|
|
|
|
160000
|
unkown
|
page readonly
|
|
|
|
3297000
|
unkown
|
page read and write
|
|
|
|
370000
|
heap default
|
page read and write
|
|
|
|
3F9000
|
heap default
|
page read and write
|
|
|
|
434000
|
unkown
|
page read and write
|
|
|
|
130000
|
heap private
|
page read and write
|
|
|
|
2175000
|
heap private
|
page read and write
|
|
|
|
2265000
|
heap private
|
page read and write
|
|
|
|
32F8000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
2200000
|
heap private
|
page read and write
|
|
|
|
1C0000
|
unkown
|
page read and write
|
|
|
|
670000
|
unkown
|
page readonly
|
|
|
|
100000
|
unkown
|
page read and write
|
|
|
|
414000
|
heap private
|
page read and write
|
|
|
|
980000
|
unkown
|
page readonly
|
|
|
|
4C6000
|
heap private
|
page read and write
|
|
|
|
2B0000
|
heap default
|
page read and write
|
|
|
|
72F000
|
unkown
|
page read and write
|
|
|
|
7A0000
|
unkown
|
page readonly
|
|
|
|
126000
|
heap default
|
page read and write
|
|
|
|
3290000
|
unkown
|
page read and write
|
|
|
|
13A000
|
heap default
|
page read and write
|
|
|
|
430000
|
unkown
|
page write copy
|
|
|
|
366000
|
unkown
|
page read and write
|
|
|
|
70000
|
unkown
|
page readonly
|
|
|
|
1D80000
|
unkown
|
page readonly
|
|
|
|
810000
|
heap private
|
page read and write
|
|
|
|
1A0000
|
unkown
|
page readonly
|
|
|
|
21A5000
|
heap private
|
page read and write
|
|
|
|
33C000
|
unkown
|
page read and write
|
|
|
|
314000
|
heap default
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
1D4000
|
heap default
|
page read and write
|
|
|
|
560000
|
unkown
|
page readonly
|
|
|
|
9B000
|
unkown
|
page read and write
|
|
|
|
1DD0000
|
unkown
|
page readonly
|
|
|
|
3EE000
|
heap default
|
page read and write
|
|
|
|
1B0000
|
unkown
|
page readonly
|
|
|
|
5D0000
|
unkown
|
page read and write
|
|
|
|
120000
|
unkown
|
page execute and read and write
|
|
|
|
2095000
|
heap private
|
page read and write
|
|
|
|
CC000
|
unkown
|
page read and write
|
|
|
|
7B7000
|
heap private
|
page read and write
|
|
|
|
4A7000
|
heap default
|
page read and write
|
|
|
|
550000
|
unkown
|
page read and write
|
|
|
|
70000
|
unkown
|
page readonly
|
|
|
|
7B0000
|
unkown
|
page readonly
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
6B0000
|
unkown
|
page readonly
|
|
|
|
2F0000
|
heap default
|
page read and write
|
|
|
|
364000
|
unkown
|
page read and write
|
|
|
|
20CB000
|
heap private
|
page read and write
|
|
|
|
1BC000
|
unkown
|
page read and write
|
|
|
|
290000
|
heap private
|
page read and write
|
|
|
|
230B000
|
heap private
|
page read and write
|
|
|
|
90000
|
unkown
|
page read and write
|
|
|
|
53E000
|
unkown
|
page read and write
|
|
|
|
170000
|
unkown
|
page read and write
|
|
|
|
27E000
|
heap default
|
page read and write
|
|
|
|
7A0000
|
unkown
|
page readonly
|
|
|
|
267000
|
heap default
|
page read and write
|
|
|
|
405000
|
heap default
|
page read and write
|
|
|
|
2260000
|
heap private
|
page read and write
|
|
|
|
100000
|
unkown
|
page readonly
|
|
|
|
21D0000
|
heap private
|
page read and write
|
|
|
|
3E4000
|
heap default
|
page read and write
|
|
|
|
700000
|
heap private
|
page read and write
|
|
|
|
360000
|
heap private
|
page read and write
|
|
|
|
650000
|
unkown
|
page readonly
|
|
|
|
24A000
|
heap default
|
page read and write
|
|
|
|
21AB000
|
heap private
|
page read and write
|
|
|
|
504000
|
heap private
|
page read and write
|
|
|
|
FC000
|
unkown
|
page read and write
|
|
|
|
D0000
|
unkown
|
page read and write
|
|
|
|
33E1000
|
unkown
|
page read and write
|
|
|
|
2A0000
|
heap default
|
page read and write
|
|
|
|
2BA000
|
heap default
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
32BB000
|
unkown
|
page read and write
|
|
|
|
36F000
|
heap default
|
page read and write
|
|
|
|
4D0000
|
unkown
|
page read and write
|
|
|
|
1B0000
|
unkown
|
page readonly
|
|
|
|
580000
|
unkown
|
page readonly
|
|
|
|
E0000
|
unkown
|
page read and write
|
|
|
|
27C000
|
heap default
|
page read and write
|
|
|
|
310000
|
unkown
|
page read and write
|
|
|
|
21D5000
|
heap private
|
page read and write
|
|
|
|
850000
|
unkown
|
page readonly
|
|
|
|
526000
|
unkown
|
page read and write
|
|
|
|
3E9000
|
unkown
|
page read and write
|
|
|
|
267000
|
heap default
|
page read and write
|
|
|
|
32A7000
|
unkown
|
page read and write
|
|
|
|
F0000
|
unkown
|
page read and write
|
|
|
|
1A0000
|
unkown
|
page readonly
|
|
|
|
B0D000
|
unkown
|
page read and write
|
|
|
|
427000
|
heap default
|
page read and write
|
|
|
|
227000
|
heap default
|
page read and write
|
|
|
|
150000
|
unkown
|
page read and write
|
|
|
|
820000
|
unkown
|
page readonly
|
|
|
|
B1F000
|
unkown
|
page read and write
|
|
|
|
12C000
|
unkown
|
page read and write
|
|
|
|
546000
|
unkown
|
page read and write
|
|
|
|
F0000
|
unkown
|
page read and write
|
|
|
|
33E1000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
90000
|
unkown
|
page readonly
|
|
|
|
620000
|
unkown
|
page readonly
|
|
|
|
2D6000
|
unkown
|
page read and write
|
|
|
|
70000
|
unkown
|
page read and write
|
|
|
|
260000
|
unkown
|
page read and write
|
|
|
|
2EA000
|
unkown
|
page read and write
|
|
|
|
610000
|
heap private
|
page read and write
|
|
|
|
11E000
|
heap default
|
page read and write
|
|
|
|
E0000
|
heap default
|
page read and write
|
|
|
|
30D000
|
unkown
|
page read and write
|
|
|
|
350000
|
unkown
|
page read and write
|
|
|
|
451000
|
heap default
|
page read and write
|
|
|
|
124000
|
heap private
|
page read and write
|
|
|
|
6E3E0000
|
unkown image
|
page readonly
|
|
|
|
377000
|
heap default
|
page read and write
|
|
|
|
5C0000
|
heap private
|
page read and write
|
|
|
|
3297000
|
unkown
|
page read and write
|
|
|
|
4FF000
|
unkown
|
page read and write
|
|
|
|
1D60000
|
unkown
|
page readonly
|
|
|
|
17A000
|
unkown
|
page read and write
|
|
|
|
FA000
|
unkown
|
page read and write
|
|
|
|
AF0000
|
unkown
|
page read and write
|
|
|
|
2D7000
|
heap default
|
page read and write
|
|
|
|
660000
|
unkown
|
page readonly
|
|
|
|
586000
|
unkown
|
page read and write
|
|
|
|
DA000
|
unkown
|
page read and write
|
|
|
|
560000
|
unkown
|
page readonly
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
3E1000
|
unkown
|
page read and write
|
|
|
|
5AB000
|
heap private
|
page read and write
|
|
|
|
550000
|
heap private
|
page read and write
|
|
|
|
6B0000
|
unkown
|
page execute and read and write
|
|
|
|
1CA0000
|
unkown
|
page readonly
|
|
|
|
90000
|
unkown
|
page read and write
|
|
|
|
610000
|
unkown
|
page readonly
|
|
|
|
1D0000
|
heap default
|
page read and write
|
|
|
|
750000
|
unkown
|
page readonly
|
|
|
|
276000
|
unkown
|
page read and write
|
|
|
|
11A000
|
unkown
|
page read and write
|
|
|
|
343000
|
heap default
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
2090000
|
heap private
|
page read and write
|
|
|
|
396000
|
unkown
|
page read and write
|
|
|
|
F0000
|
unkown
|
page readonly
|
|
|
|
540000
|
heap private
|
page read and write
|
|
|
|
190000
|
unkown
|
page execute and read and write
|
|
|
|
229B000
|
heap private
|
page read and write
|
|
|
|
353000
|
heap default
|
page read and write
|
|
|
|
1D3000
|
heap default
|
page read and write
|
|
|
|
33E1000
|
unkown
|
page read and write
|
|
|
|
2110000
|
unkown
|
page readonly
|
|
|
|
F0000
|
unkown
|
page read and write
|
|
|
|
3290000
|
unkown
|
page read and write
|
|
|
|
1D30000
|
unkown
|
page readonly
|
|
|
|
20000
|
heap private
|
page read and write
|
|
|
|
270000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page readonly
|
|
|
|
556000
|
heap private
|
page read and write
|
|
|
|
586000
|
unkown
|
page read and write
|
|
|
|
20CB000
|
heap private
|
page read and write
|
|
|
|
516000
|
heap private
|
page read and write
|
|
|
|
3405000
|
unkown
|
page read and write
|
|
|
|
250000
|
unkown
|
page readonly
|
|
|
|
40D000
|
unkown
|
page read and write
|
|
|
|
3D5000
|
heap private
|
page read and write
|
|
|
|
3B0000
|
unkown
|
page read and write
|
|
|
|
436000
|
unkown
|
page read and write
|
|
|
|
32B8000
|
unkown
|
page read and write
|
|
There are 638 hidden memdumps, click here to show them.