Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
New Order for April#89032.xlsx
|
CDFV2 Encrypted
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\hkn[1].exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
downloaded
|
|
|
|
C:\Users\user\Desktop\~$New Order for April#89032.xlsx
|
data
|
dropped
|
|
|
|
C:\Users\Public\vbc.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2BCDEC9D.jpeg
|
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames
3
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\33C3DEE4.jpeg
|
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames
3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\346FC870.jpeg
|
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames
3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4A0B656B.png
|
PNG image data, 992 x 192, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4F4CB40C.png
|
PNG image data, 1268 x 540, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\611091FA.jpeg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 88x89, frames
3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\65BB8ECE.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6AF88CAF.png
|
PNG image data, 1268 x 540, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6D2F9C18.png
|
PNG image data, 992 x 192, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\70052995.jpeg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 88x89, frames
3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7DE011E6.png
|
PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C1F47D39.jpeg
|
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames
3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C96B05B3.jpeg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 178x124,
frames 3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CE617A92.jpeg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 178x124,
frames 3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D78A5477.png
|
PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
There are 9 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
|
|
|
|
C:\Users\Public\vbc.exe
|
'C:\Users\Public\vbc.exe'
|
|
|
|
C:\Users\Public\vbc.exe
|
C:\Users\Public\vbc.exe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://198.23.174.104/hkn.exe
|
198.23.174.104
|
|
|
|
http://127.0.0.1:HTTP/1.1
|
unknown
|
|
|
|
http://DynDns.comDynDNS
|
unknown
|
|
|
|
https://api.telegram.org
|
unknown
|
|
|
|
http://crl.entrust.net/server1.crl0
|
unknown
|
|
|
|
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
|
unknown
|
|
|
|
http://ocsp.entrust.net03
|
unknown
|
|
|
|
http://certificates.godaddy.com/repository/0
|
unknown
|
|
|
|
https://dist.nuget.org/win-x86-commandline/latest/nuget.exe
|
unknown
|
|
|
|
https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendDocumentdocument-----
|
unknown
|
|
|
|
https://github.com/d-haxton/HaxtonBot/archive/master.zip
|
unknown
|
|
|
|
http://certs.godaddy.com/repository/1301
|
unknown
|
|
|
|
https://api.telegram.orgP
|
unknown
|
|
|
|
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
|
unknown
|
|
|
|
http://www.diginotar.nl/cps/pkioverheid0
|
unknown
|
|
|
|
http://crl.godaddy.com/gdig2s1-1823.crl0
|
unknown
|
|
|
|
https://certs.godaddy.com/repository/0
|
unknown
|
|
|
|
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
|
unknown
|
|
|
|
http://crl.godaddy.com/gdroot-g2.crl0F
|
unknown
|
|
|
|
https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/
|
unknown
|
|
|
|
http://WrqCET.com
|
unknown
|
|
|
|
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
|
unknown
|
|
|
|
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
|
unknown
|
|
|
|
http://crl.godaddy.com/gdroot.crl0F
|
unknown
|
|
|
|
http://www.%s.comPA
|
unknown
|
|
|
|
https://github.com/Spegeli/Pokemon-Go-Rocket-API/archive/master.zip
|
unknown
|
|
|
|
https://YiNu10TJVGgbJcx5.com
|
unknown
|
|
|
|
http://api.telegram.org
|
unknown
|
|
|
|
http://certificates.godaddy.com/repository/gdig2.crt0
|
unknown
|
|
|
|
http://ocsp.entrust.net0D
|
unknown
|
|
|
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
|
|
|
https://secure.comodo.com/CPS0
|
unknown
|
|
|
|
https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendDocument
|
unknown
|
|
|
|
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
|
unknown
|
|
|
|
http://crl.entrust.net/2048ca.crl0
|
unknown
|
|
There are 25 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
api.telegram.org
|
149.154.167.220
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
198.23.174.104
|
unknown
|
United States
|
|
|
|
149.154.167.220
|
api.telegram.org
|
United Kingdom
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
wa7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
MTTT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ReviewToken
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F05DA
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
FontCachePath
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
VBAFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DefaultSheetR2L
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
UseSystemSeparators
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ThousandsSeparator
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DecimalSeparator
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
q7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F56A8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F6152
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 21
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
LastPurgeTime
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EXCELFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F56A8
|
|
|
|
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
EquationEditorFilesIntl_1033
|
|
|
|
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
SavedLegacySettings
|
|
|
|
C:\Users\Public\vbc.exe
|
EnableFileTracing
|
|
|
|
C:\Users\Public\vbc.exe
|
EnableConsoleTracing
|
|
|
|
C:\Users\Public\vbc.exe
|
FileTracingMask
|
|
|
|
C:\Users\Public\vbc.exe
|
ConsoleTracingMask
|
|
|
|
C:\Users\Public\vbc.exe
|
MaxFileSize
|
|
|
|
C:\Users\Public\vbc.exe
|
FileDirectory
|
|
|
|
C:\Users\Public\vbc.exe
|
EnableFileTracing
|
|
|
|
C:\Users\Public\vbc.exe
|
EnableConsoleTracing
|
|
|
|
C:\Users\Public\vbc.exe
|
FileTracingMask
|
|
|
|
C:\Users\Public\vbc.exe
|
ConsoleTracingMask
|
|
|
|
C:\Users\Public\vbc.exe
|
MaxFileSize
|
|
|
|
C:\Users\Public\vbc.exe
|
FileDirectory
|
|
|
|
C:\Users\Public\vbc.exe
|
Blob
|
|
|
|
C:\Users\Public\vbc.exe
|
Blob
|
|
|
|
C:\Users\Public\vbc.exe
|
Blob
|
|
|
|
C:\Users\Public\vbc.exe
|
Blob
|
|
|
|
C:\Users\Public\vbc.exe
|
Blob
|
|
|
|
C:\Users\Public\vbc.exe
|
Blob
|
|
There are 69 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2560000
|
unkown
|
page read and write
|
|
|
|
24C1000
|
unkown
|
page read and write
|
|
|
|
23C3000
|
unkown
|
page read and write
|
|
|
|
33AC000
|
unkown
|
page read and write
|
|
|
|
402000
|
unkown
|
page execute and read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
5C2E000
|
unkown
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
693000
|
unkown
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
3A2000
|
heap default
|
page read and write
|
|
|
|
480000
|
unkown
|
page read and write
|
|
|
|
8C0000
|
unkown
|
page read and write
|
|
|
|
6F4000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
46DE000
|
unkown
|
page read and write
|
|
|
|
373000
|
heap default
|
page read and write
|
|
|
|
760000
|
unkown
|
page readonly
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
5B64000
|
unkown
|
page readonly
|
|
|
|
720000
|
heap private
|
page execute and read and write
|
|
|
|
25F8000
|
unkown
|
page read and write
|
|
|
|
4F40000
|
unkown
|
page read and write
|
|
|
|
4FCD000
|
unkown
|
page read and write
|
|
|
|
4A0000
|
unkown
|
page read and write
|
|
|
|
2F0000
|
heap default
|
page read and write
|
|
|
|
6AF0000
|
heap private
|
page read and write
|
|
|
|
DB2000
|
unkown image
|
page execute read
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
524F000
|
unkown
|
page read and write
|
|
|
|
230000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
6F2000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
9BE000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
70A000
|
unkown
|
page read and write
|
|
|
|
4FF5000
|
unkown
|
page read and write
|
|
|
|
B60000
|
unkown
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
5705000
|
heap private
|
page read and write
|
|
|
|
AC0000
|
unkown
|
page read and write
|
|
|
|
7EF40000
|
unkown
|
page execute and read and write
|
|
|
|
AE0000
|
unkown
|
page read and write
|
|
|
|
500000
|
heap default
|
page read and write
|
|
|
|
890000
|
unkown
|
page readonly
|
|
|
|
C12E000
|
stack
|
page read and write
|
|
|
|
4670000
|
unkown
|
page read and write
|
|
|
|
4630000
|
unkown
|
page readonly
|
|
|
|
5CA5000
|
unkown
|
page readonly
|
|
|
|
5B5E000
|
unkown
|
page read and write
|
|
|
|
24BF000
|
unkown
|
page read and write
|
|
|
|
2D0000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
715000
|
unkown
|
page read and write
|
|
|
|
4690000
|
unkown
|
page read and write
|
|
|
|
C6D000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
4928000
|
heap private
|
page read and write
|
|
|
|
3E8F000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
6A0000
|
unkown
|
page read and write
|
|
|
|
8E0000
|
unkown
|
page readonly
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
4B0000
|
unkown
|
page read and write
|
|
|
|
452000
|
unkown
|
page read and write
|
|
|
|
5C42000
|
unkown
|
page readonly
|
|
|
|
5BB2000
|
unkown
|
page readonly
|
|
|
|
495E000
|
unkown
|
page read and write
|
|
|
|
6A0000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
2515000
|
unkown
|
page read and write
|
|
|
|
5722000
|
heap private
|
page read and write
|
|
|
|
BD3E000
|
stack
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
157000
|
unkown
|
page read and write
|
|
|
|
478000
|
unkown
|
page read and write
|
|
|
|
4ADE000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
5DC0000
|
unkown
|
page readonly
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
E56000
|
unkown image
|
page readonly
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
524E000
|
unkown
|
page read and write | page guard
|
|
|
|
34A000
|
heap default
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
240000
|
heap default
|
page read and write
|
|
|
|
5C82000
|
unkown
|
page readonly
|
|
|
|
52B4000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
BF0000
|
heap private
|
page read and write
|
|
|
|
2B0000
|
heap default
|
page read and write
|
|
|
|
556E000
|
unkown
|
page read and write | page guard
|
|
|
|
4AA2000
|
heap private
|
page read and write
|
|
|
|
2E3000
|
unkown
|
page execute and read and write
|
|
|
|
6C5000
|
unkown
|
page read and write
|
|
|
|
4F77000
|
unkown
|
page read and write
|
|
|
|
5E0000
|
unkown
|
page readonly
|
|
|
|
9C0000
|
unkown
|
page readonly
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
7EFDF000
|
unkown
|
page read and write
|
|
|
|
4A0000
|
unkown
|
page read and write
|
|
|
|
B86C000
|
unkown
|
page read and write
|
|
|
|
6D0000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
25A1000
|
unkown
|
page read and write
|
|
|
|
4EE8000
|
unkown
|
page read and write
|
|
|
|
682000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
B7CD000
|
stack
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
5F9E000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
325000
|
unkown
|
page execute and read and write
|
|
|
|
47B000
|
unkown
|
page read and write
|
|
|
|
BDE000
|
unkown
|
page read and write
|
|
|
|
6A0000
|
unkown
|
page read and write
|
|
|
|
6E7000
|
heap private
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
910000
|
unkown
|
page read and write
|
|
|
|
5C36000
|
unkown
|
page readonly
|
|
|
|
C70000
|
unkown
|
page readonly
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
8B0000
|
unkown
|
page read and write
|
|
|
|
692F000
|
unkown
|
page read and write
|
|
|
|
5CB9000
|
unkown
|
page readonly
|
|
|
|
25A4000
|
unkown
|
page read and write
|
|
|
|
5A6F000
|
unkown
|
page read and write
|
|
|
|
D90000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
4C0000
|
heap default
|
page read and write
|
|
|
|
7EF58000
|
unkown
|
page execute and read and write
|
|
|
|
490000
|
unkown
|
page read and write
|
|
|
|
4FB0000
|
unkown
|
page read and write
|
|
|
|
5982000
|
unkown
|
page readonly
|
|
|
|
310000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
42D000
|
unkown
|
page execute and read and write
|
|
|
|
48FF000
|
stack
|
page read and write
|
|
|
|
680000
|
unkown
|
page execute and read and write
|
|
|
|
23AD000
|
unkown
|
page read and write
|
|
|
|
23A1000
|
unkown
|
page read and write
|
|
|
|
508E000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
2548000
|
unkown
|
page read and write
|
|
|
|
34C1000
|
unkown
|
page read and write
|
|
|
|
3665000
|
unkown
|
page read and write
|
|
|
|
8B0000
|
unkown
|
page read and write
|
|
|
|
5FDE000
|
unkown
|
page read and write
|
|
|
|
540000
|
heap private
|
page read and write
|
|
|
|
485000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
AD0000
|
unkown
|
page read and write
|
|
|
|
556F000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
51CE000
|
unkown
|
page read and write
|
|
|
|
D90000
|
unkown
|
page read and write
|
|
|
|
262E000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
239F000
|
unkown
|
page read and write
|
|
|
|
DB2000
|
unkown image
|
page execute read
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
5BD6000
|
unkown
|
page readonly
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
6D20000
|
heap private
|
page read and write
|
|
|
|
4F71000
|
unkown
|
page read and write
|
|
|
|
424000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
6B0000
|
unkown
|
page read and write
|
|
|
|
6B0000
|
unkown
|
page read and write
|
|
|
|
940000
|
heap private
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
46E0000
|
unkown
|
page read and write
|
|
|
|
5B82000
|
unkown
|
page readonly
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
490000
|
unkown
|
page read and write
|
|
|
|
B20000
|
heap private
|
page execute and read and write
|
|
|
|
4FAE000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
DA0000
|
unkown
|
page read and write
|
|
|
|
3D0000
|
heap private
|
page execute and read and write
|
|
|
|
B6BE000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
6B0000
|
unkown
|
page read and write
|
|
|
|
5C69000
|
unkown
|
page readonly
|
|
|
|
5ED0000
|
unkown
|
page readonly
|
|
|
|
DB2000
|
unkown image
|
page execute read
|
|
|
|
6A4E000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
569D000
|
unkown
|
page read and write
|
|
|
|
32B000
|
unkown
|
page execute and read and write
|
|
|
|
260D000
|
unkown
|
page read and write
|
|
|
|
930000
|
unkown
|
page read and write
|
|
|
|
423000
|
unkown
|
page execute and read and write
|
|
|
|
AE0000
|
unkown
|
page read and write
|
|
|
|
AC0000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
602E000
|
unkown
|
page read and write
|
|
|
|
47AC000
|
unkown
|
page read and write
|
|
|
|
8A0000
|
unkown
|
page read and write
|
|
|
|
58BE000
|
unkown
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
2290000
|
unkown
|
page read and write
|
|
|
|
530D000
|
unkown
|
page read and write
|
|
|
|
44A000
|
unkown
|
page execute and read and write
|
|
|
|
2290000
|
unkown
|
page read and write
|
|
|
|
53F0000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
D64000
|
heap private
|
page read and write
|
|
|
|
5C66000
|
unkown
|
page readonly
|
|
|
|
4F5F000
|
unkown
|
page read and write
|
|
|
|
5251000
|
unkown
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
B0C000
|
unkown
|
page read and write
|
|
|
|
82B6000
|
unkown
|
page read and write
|
|
|
|
8B0000
|
unkown
|
page read and write
|
|
|
|
880000
|
unkown
|
page read and write
|
|
|
|
6D0000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
D60000
|
heap private
|
page read and write
|
|
|
|
53E0000
|
unkown
|
page read and write
|
|
|
|
BF6E000
|
stack
|
page read and write
|
|
|
|
4A6F000
|
unkown
|
page read and write
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
24BE000
|
unkown
|
page read and write | page guard
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
5B42000
|
unkown
|
page readonly
|
|
|
|
462E000
|
unkown
|
page read and write
|
|
|
|
5988000
|
unkown
|
page readonly
|
|
|
|
DB0000
|
unkown image
|
page readonly
|
|
|
|
39C000
|
heap default
|
page read and write
|
|
|
|
239E000
|
unkown
|
page read and write | page guard
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
49F0000
|
unkown
|
page read and write
|
|
|
|
645E000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
43A0000
|
unkown
|
page readonly
|
|
|
|
523E000
|
unkown
|
page read and write
|
|
|
|
49E5000
|
heap private
|
page read and write
|
|
|
|
4F8C000
|
unkown
|
page read and write
|
|
|
|
5D0000
|
unkown
|
page execute and read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
BB9F000
|
unkown
|
page read and write
|
|
|
|
5CD5000
|
unkown
|
page readonly
|
|
|
|
DB0000
|
unkown image
|
page readonly
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
1C0000
|
unkown
|
page readonly
|
|
|
|
322000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
C7D000
|
stack
|
page read and write
|
|
|
|
DA0000
|
unkown
|
page read and write
|
|
|
|
5F0000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
AC0000
|
unkown
|
page execute and read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
5AAE000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
4E4000
|
heap default
|
page read and write
|
|
|
|
532D000
|
unkown
|
page read and write
|
|
|
|
640000
|
heap private
|
page execute and read and write
|
|
|
|
714000
|
unkown
|
page read and write
|
|
|
|
47C0000
|
heap private
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
7EFDF000
|
unkown
|
page read and write
|
|
|
|
5700000
|
heap private
|
page read and write
|
|
|
|
D90000
|
unkown
|
page read and write
|
|
|
|
4680000
|
unkown
|
page read and write
|
|
|
|
6C6000
|
unkown
|
page read and write
|
|
|
|
4700000
|
heap private
|
page execute and read and write
|
|
|
|
480000
|
unkown
|
page read and write
|
|
|
|
457000
|
unkown
|
page execute and read and write
|
|
|
|
5CE9000
|
unkown
|
page readonly
|
|
|
|
4F7D000
|
unkown
|
page read and write
|
|
|
|
910000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page readonly
|
|
|
|
5C06000
|
unkown
|
page readonly
|
|
|
|
717000
|
unkown
|
page read and write
|
|
|
|
5C89000
|
unkown
|
page readonly
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
4C60000
|
unkown
|
page readonly
|
|
|
|
5600000
|
unkown
|
page readonly
|
|
|
|
54D0000
|
heap private
|
page read and write
|
|
|
|
2FC000
|
heap default
|
page read and write
|
|
|
|
430000
|
unkown
|
page read and write
|
|
|
|
327000
|
unkown
|
page execute and read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown
|
page execute and read and write
|
|
|
|
140000
|
unkown
|
page readonly
|
|
|
|
43D000
|
unkown
|
page execute and read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
410000
|
unkown
|
page read and write
|
|
|
|
AF0000
|
unkown
|
page read and write
|
|
|
|
6F5000
|
unkown
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
AC0000
|
unkown
|
page read and write
|
|
|
|
AD5000
|
unkown
|
page read and write
|
|
|
|
693000
|
unkown
|
page read and write
|
|
|
|
549000
|
heap private
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
DB0000
|
unkown image
|
page readonly
|
|
|
|
2ED000
|
unkown
|
page execute and read and write
|
|
|
|
AC0000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
442000
|
unkown
|
page read and write
|
|
|
|
5A82000
|
unkown
|
page readonly
|
|
|
|
20000
|
unkown
|
page read and write
|
|
|
|
5A7000
|
heap default
|
page read and write
|
|
|
|
612E000
|
stack
|
page read and write
|
|
|
|
5B44000
|
unkown
|
page readonly
|
|
|
|
5BE2000
|
unkown
|
page readonly
|
|
|
|
6F0000
|
unkown
|
page readonly
|
|
|
|
B4E000
|
unkown
|
page read and write
|
|
|
|
682000
|
unkown
|
page read and write
|
|
|
|
ABE000
|
unkown
|
page read and write
|
|
|
|
D90000
|
unkown
|
page read and write
|
|
|
|
62AE000
|
unkown
|
page read and write
|
|
|
|
33A1000
|
unkown
|
page read and write
|
|
|
|
5C12000
|
unkown
|
page readonly
|
|
|
|
5C25000
|
unkown
|
page readonly
|
|
|
|
2F0000
|
heap private
|
page read and write
|
|
|
|
5350000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
6B0000
|
unkown
|
page read and write
|
|
|
|
455000
|
unkown
|
page execute and read and write
|
|
|
|
56DE000
|
unkown
|
page read and write
|
|
|
|
555000
|
heap default
|
page read and write
|
|
|
|
4EAE000
|
stack
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
398000
|
unkown
|
page read and write
|
|
|
|
6E0000
|
unkown
|
page readonly
|
|
|
|
45B000
|
unkown
|
page execute and read and write
|
|
|
|
488000
|
unkown
|
page read and write
|
|
|
|
90E000
|
unkown
|
page read and write
|
|
|
|
2608000
|
unkown
|
page read and write
|
|
|
|
5C0000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
4F5D000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
711000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
AC0000
|
unkown
|
page read and write
|
|
|
|
5BF5000
|
unkown
|
page readonly
|
|
|
|
DB0000
|
unkown image
|
page readonly
|
|
|
|
4A0000
|
unkown
|
page readonly
|
|
|
|
6D0000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
55E0000
|
unkown
|
page readonly
|
|
|
|
E56000
|
unkown image
|
page readonly
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
AC0000
|
unkown
|
page read and write
|
|
|
|
530000
|
unkown
|
page execute and read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
655E000
|
unkown
|
page read and write
|
|
|
|
5E72000
|
unkown
|
page readonly
|
|
|
|
6D0000
|
unkown
|
page read and write
|
|
|
|
B50000
|
unkown
|
page read and write
|
|
|
|
5C55000
|
unkown
|
page readonly
|
|
|
|
8C0000
|
unkown
|
page read and write
|
|
|
|
300000
|
unkown
|
page read and write
|
|
|
|
31A000
|
unkown
|
page execute and read and write
|
|
|
|
591E000
|
unkown
|
page read and write
|
|
|
|
25E8000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
AD0000
|
unkown
|
page read and write
|
|
|
|
4AC0000
|
unkown
|
page readonly
|
|
|
|
4F39000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
6E0000
|
heap private
|
page read and write
|
|
|
|
440000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
25EE000
|
unkown
|
page read and write
|
|
|
|
316000
|
unkown
|
page execute and read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
2E4000
|
unkown
|
page read and write
|
|
|
|
50E000
|
unkown
|
page read and write
|
|
|
|
4C7000
|
heap default
|
page read and write
|
|
|
|
E56000
|
unkown image
|
page readonly
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
6DB000
|
unkown
|
page read and write
|
|
|
|
C0000
|
heap default
|
page read and write
|
|
|
|
2B7000
|
heap default
|
page read and write
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
BB9E000
|
unkown
|
page read and write | page guard
|
|
|
|
4920000
|
heap private
|
page read and write
|
|
|
|
312000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
D8E000
|
stack
|
page read and write
|
|
|
|
689000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
50D000
|
heap default
|
page read and write
|
|
|
|
D90000
|
unkown
|
page read and write
|
|
|
|
25F6000
|
unkown
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
DA0000
|
unkown
|
page execute and read and write
|
|
|
|
4F46000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
30D000
|
unkown
|
page execute and read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
2A8000
|
stack
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page readonly
|
|
|
|
50B0000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
261D000
|
unkown
|
page read and write
|
|
|
|
460000
|
unkown
|
page read and write
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
DB0000
|
unkown image
|
page readonly
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
5EB0000
|
unkown
|
page readonly
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
447000
|
unkown
|
page execute and read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
E56000
|
unkown image
|
page readonly
|
|
|
|
66D0000
|
heap private
|
page read and write
|
|
|
|
4EB0000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
AE9000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
51BE000
|
unkown
|
page read and write
|
|
|
|
B70000
|
unkown
|
page read and write
|
|
|
|
5310000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
D90000
|
unkown
|
page read and write
|
|
|
|
4924000
|
heap private
|
page read and write
|
|
|
|
D82000
|
heap private
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
711000
|
unkown
|
page read and write
|
|
|
|
480000
|
unkown
|
page read and write
|
|
|
|
8C4000
|
unkown
|
page read and write
|
|
|
|
5410000
|
unkown
|
page write copy
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
5CE2000
|
unkown
|
page readonly
|
|
|
|
475000
|
unkown
|
page read and write
|
|
|
|
DB2000
|
unkown image
|
page execute read
|
|
|
|
25F0000
|
unkown
|
page read and write
|
|
|
|
B65C000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
6A0000
|
unkown
|
page read and write
|
|
|
|
4B0000
|
unkown
|
page readonly
|
|
|
|
E90000
|
unkown
|
page readonly
|
|
|
|
DB0000
|
unkown image
|
page readonly
|
|
|
|
39E000
|
heap default
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
5740000
|
unkown
|
page read and write
|
|
|
|
5B62000
|
unkown
|
page readonly
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
4F14000
|
unkown
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
66AE000
|
unkown
|
page read and write
|
|
|
|
583000
|
heap default
|
page read and write
|
|
|
|
2D4000
|
heap default
|
page read and write
|
|
|
|
8AB000
|
unkown
|
page read and write
|
|
|
|
8A000
|
unkown
|
page read and write
|
|
|
|
450000
|
unkown
|
page execute and read and write
|
|
|
|
5B7000
|
heap default
|
page read and write
|
|
|
|
478000
|
unkown
|
page read and write
|
|
|
|
480000
|
unkown
|
page read and write
|
|
|
|
550000
|
heap private
|
page read and write
|
|
|
|
33A9000
|
unkown
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
5C6D000
|
unkown
|
page readonly
|
|
|
|
480000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
5B84000
|
unkown
|
page readonly
|
|
|
|
4C20000
|
heap private
|
page execute and read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
4F36000
|
unkown
|
page read and write
|
|
|
|
C80000
|
unkown
|
page read and write
|
|
|
|
B00000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
B9EE000
|
stack
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
682E000
|
unkown
|
page read and write
|
|
|
|
4A84000
|
heap private
|
page read and write
|
|
|
|
44C0000
|
unkown
|
page readonly
|
|
|
|
19A000
|
unkown
|
page read and write
|
|
|
|
D90000
|
unkown
|
page read and write
|
|
|
|
5BC5000
|
unkown
|
page readonly
|
|
|
|
4960000
|
unkown
|
page readonly
|
|
|
|
49E0000
|
heap private
|
page read and write
|
|
|
|
480000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
5D05000
|
unkown
|
page readonly
|
|
|
|
63D000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
710000
|
unkown
|
page read and write
|
|
|
|
6A0000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
5DBC000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
AC0000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page read and write
|
|
|
|
685000
|
unkown
|
page read and write
|
|
|
|
D9E000
|
unkown
|
page read and write
|
|
|
|
6C0000
|
unkown
|
page read and write
|
|
|
|
5130000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
5EF0000
|
unkown
|
page readonly
|
|
|
|
20000
|
unkown
|
page read and write
|
|
|
|
560000
|
unkown
|
page readonly
|
|
|
|
6C5000
|
unkown
|
page read and write
|
|
|
|
57C000
|
heap default
|
page read and write
|
|
|
|
4A80000
|
heap private
|
page read and write
|
|
|
|
5250000
|
unkown
|
page read and write
|
|
|
|
5CB2000
|
unkown
|
page readonly
|
|
There are 547 hidden memdumps, click here to show them.