Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\zT6Nm@i4\K_FPS64.dll
|
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\PMRunner64.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\111.7z
|
7-zip archive data, version 0.4
|
dropped
|
 |
|
|
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Realtek????????
.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0,
Archive, ctime=Thu Jan 14 15:39:10 2021, mtime=Thu Jan 14 15:39:10 2021, atime=Thu Jan 14 15:39:10 2021, length=271704, window=hide
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\zr.exe
|
PE32 executable (console) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Plugin32.dll
|
data
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\111.7z
|
7-zip archive data, version 0.4
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\KK.txt
|
data
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Programs\Startup\Realtek????????
.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0,
Archive, ctime=Thu Jan 14 15:39:10 2021, mtime=Thu Jan 14 15:39:10 2021, atime=Thu Jan 14 15:39:10 2021, length=271704, window=hide
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\copy.bat
|
ASCII text, with CR, LF line terminators
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\ru2.url
|
MS Windows 95 Internet shortcut text (URL=<file:///C:\Users\user\zT6Nm@i4\run001.lnk>), ASCII text, with CR line terminators
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\run.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Wed Apr 11 22:34:14 2018, mtime=Wed Sep 30 06:35:53 2020, atime=Wed Apr 11 22:34:14
2018, length=273920, window=hide
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\run001.lnk
|
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=0,
ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\run003.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Sun Apr 30 07:53:46 2017, mtime=Sun Apr 30 07:53:46 2017, atime=Sun Apr 30 07:53:46
2017, length=461088, window=hide
|
dropped
|
|
|
|
C:\Users\user\zT6Nm@i4\zr.exe
|
PE32 executable (console) Intel 80386, for MS Windows
|
dropped
|
|
|
|
\Device\ConDrv
|
ASCII text, with CRLF, CR line terminators
|
dropped
|
|
There are 7 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
|
'C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe'
|
|
|
|
C:\Users\user\zT6Nm@i4\PMRunner64.exe
|
'C:\Users\user\zT6Nm@i4\PMRunner64.exe'
|
|
|
|
C:\Users\user\zT6Nm@i4\PMRunner64.exe
|
'C:\Users\user\zT6Nm@i4\PMRunner64.exe'
|
|
|
|
C:\Users\user\zT6Nm@i4\PMRunner64.exe
|
'C:\Users\user\zT6Nm@i4\PMRunner64.exe'
|
|
|
|
C:\Users\user\zT6Nm@i4\zr.exe
|
'C:\Users\user\zT6Nm@i4\zr.exe' a 'C:\Users\user\zT6Nm@i4\111.7z' 'C:\Users\user\zT6Nm@i4\TXP\*'
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
|
|
C:\Windows\System32\cmd.exe
|
'C:\Windows\System32\cmd.exe' /C 'C:\Users\user\zT6Nm@i4\copy.bat'
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
|
|
C:\ProgramData\Microsoft\zr.exe
|
'C:\ProgramData\Microsoft\zr.exe' x C:\ProgramData\Microsoft\111.7z -y
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://110.92.66.246:13527/\
|
110.92.66.246
|
|
|
|
http://crl.thawte.com/ThawtePremiumServerCA.crl0
|
unknown
|
|
|
|
http://crl.thawte.com/ThawteTimestampingCA.crl0
|
unknown
|
|
|
|
https://www.thawte.com/cps0/
|
unknown
|
|
|
|
http://crl.thawte.com/ThawtePCA.crl0
|
unknown
|
|
|
|
http://www.symauth.com/cps0(
|
unknown
|
|
|
|
http://www.symauth.com/rpa00
|
unknown
|
|
|
|
https://www.thawte.com/cps0
|
unknown
|
|
|
|
http://www.nsecsoft.com
|
unknown
|
|
|
|
https://www.thawte.com/repository0W
|
unknown
|
|
|
|
http://ocsp.thawte.com0
|
unknown
|
|
There are 1 hidden URLs, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Active
|
Malicious
|
|
|---|---|---|---|---|---|
|
110.92.66.246
|
unknown
|
Hong Kong
|
unknown
|
|
|
|
40.126.31.135
|
unknown
|
United States
|
unknown
|
|
|
|
192.168.2.1
|
unknown
|
unknown
|
unknown
|
|
|
|
204.79.197.200
|
unknown
|
United States
|
unknown
|
|
|
|
192.168.2.4
|
unknown
|
unknown
|
unknown
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
|
LangID
|
|
|
|
C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
|
C:\Windows\System32\cmd.exe.FriendlyAppName
|
|
|
|
C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
|
C:\Windows\System32\cmd.exe.ApplicationCompany
|
|
|
|
C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
|
SlowContextMenuEntries
|
|
|
|
C:\Users\user\zT6Nm@i4\PMRunner64.exe
|
NULL
|
|
|
|
C:\Users\user\zT6Nm@i4\PMRunner64.exe
|
Version
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53CC56000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1A53CC30000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
25E5000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
22032E29000
|
unkown
|
page read and write
|
|
|
|
9FF000
|
stack
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1DB30F4C000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
7FFA99DA0000
|
unkown image
|
page readonly
|
|
|
|
1A53C8FA000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53CC4E000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1DB2EF1E000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
2270000
|
heap private
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1DB32410000
|
unkown
|
page read and write
|
|
|
|
69C000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53CC62000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
8FF000
|
stack
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
7FF590960000
|
unkown
|
page readonly
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
2420000
|
heap private
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
5AE000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
2275000
|
heap private
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
7FF590819000
|
unkown
|
page readonly
|
|
|
|
7FF5DA27C000
|
unkown
|
page readonly
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1D99FF50000
|
heap default
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1D9A0102000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1A53C030000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown image
|
page readonly
|
|
|
|
1A53C030000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
7FF5DA1F2000
|
unkown
|
page readonly
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
4DE000
|
unkown
|
page read and write
|
|
|
|
7FF5909EC000
|
unkown
|
page readonly
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
7FF5DA2B8000
|
unkown
|
page readonly
|
|
|
|
1D9A0029000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53CC57000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
7FF5DA0A9000
|
unkown
|
page readonly
|
|
|
|
6DF000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
7FF5DA071000
|
unkown
|
page readonly
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
676000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
696000
|
unkown
|
page read and write
|
|
|
|
1A53CC5F000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
146000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
510000
|
heap default
|
page read and write
|
|
|
|
1A53C8FA000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1DB32110000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
7FF5DA24E000
|
unkown
|
page readonly
|
|
|
|
14F96FA000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
22032E13000
|
unkown
|
page read and write
|
|
|
|
7ED000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1DB2EF3D000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
2480000
|
unkown
|
page readonly
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1D9A214C000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53CC31000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1DB30F97000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
7FF590A1E000
|
unkown
|
page readonly
|
|
|
|
1A53A64D000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
7FF5DA2BE000
|
unkown
|
page readonly
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
7FF5DA1F0000
|
unkown
|
page readonly
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
7FF5DA028000
|
unkown
|
page readonly
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
22032DE0000
|
unkown
|
page readonly
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
7FF5DA29A000
|
unkown
|
page readonly
|
|
|
|
1A53CC21000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1DB32410000
|
unkown
|
page read and write
|
|
|
|
7FF5DA23A000
|
unkown
|
page readonly
|
|
|
|
1A53C030000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
14017B000
|
unkown image
|
page readonly
|
|
|
|
22DB000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
7FF7A5186000
|
unkown image
|
page readonly
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
3C3000
|
unkown
|
page read and write
|
|
|
|
1DB32413000
|
unkown
|
page read and write
|
|
|
|
A3E000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
7FF590697000
|
unkown
|
page readonly
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1A53C030000
|
unkown
|
page read and write
|
|
|
|
478000
|
unkown image
|
page readonly
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C030000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
7FFA99DA0000
|
unkown image
|
page readonly
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
7FF5DA196000
|
unkown
|
page readonly
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
6A1000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
25C0000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
6B5000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1DB31202000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
2490000
|
unkown
|
page readonly
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1A53C020000
|
unkown
|
page read and write
|
|
|
|
1A53C030000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1AD000
|
heap private
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1A53C8FA000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53CC5C000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
4FCB000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
heap private
|
page read and write
|
|
|
|
1A53CC52000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|
|
|
2228000
|
heap private
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
1A53C010000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1A53A64B000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
691000
|
unkown
|
page read and write
|
|
|
|
1836DAD0000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
2308000
|
unkown
|
page read and write
|
|
|
|
140204000
|
unkown image
|
page read and write
|
|
|
|
14F987A000
|
unkown
|
page read and write
|
|
|
|
1DB32310000
|
unkown
|
page read and write
|
|
|
|
1A53C0C0000
|
unkown
|
page read and write
|
|
|
|
7FF7A5161000
|
unkown image
|
page execute read
|
|
|
|
1A53A642000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1836D990000
|
unkown
|
page read and write
|
|
|
|
26DD8550000
|
unkown
|
page read and write
|
|
|
|
1A53BE90000
|
unkown
|
page read and write
|
|