Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
54402971_by_Libranalysis.xls
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: van-van, Last Saved
By: vi-vi, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date:
Wed May 12 08:24:11 2021, Security: 0
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\221B862E-D5CA-4C51-AEC1-C42AA63B593F
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Temp\9CB40000
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\54402971_by_Libranalysis.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 06:35:52
2020, mtime=Wed May 12 13:46:15 2021, atime=Wed May 12 13:46:15 2021, length=177152, window=hide
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu
Jun 27 17:12:41 2019, mtime=Wed May 12 13:46:15 2021, atime=Wed May 12 13:46:15 2021, length=16384, window=hide
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
|
Little-endian UTF-16 Unicode text, with CR line terminators
|
dropped
|
|
|
|
C:\Users\user\Desktop\BDB40000
|
Applesoft BASIC program data, first line number 16
|
dropped
|
|
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, 59863 bytes, 1 file
|
dropped
|
|
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\08DE0000
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\CabE31F.tmp
|
Microsoft Cabinet archive data, 59863 bytes, 1 file
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\TarE320.tmp
|
data
|
dropped
|
|
|
|
C:\Users\user\Desktop\09DE0000
|
Applesoft BASIC program data, first line number 16
|
dropped
|
|
There are 6 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32 ..\ritofm.cvm,DllRegisterServer
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32 ..\ritofm.cvm1,DllRegisterServer
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32 ..\ritofm.cvm,DllRegisterServer
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32 ..\ritofm.cvm1,DllRegisterServer
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.diagnosticssdf.office.com
|
unknown
|
|
|
|
https://login.microsoftonline.com/
|
unknown
|
|
|
|
https://shell.suite.office.com:1443
|
unknown
|
|
|
|
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
|
unknown
|
|
|
|
https://autodiscover-s.outlook.com/
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
|
unknown
|
|
|
|
https://cdn.entity.
|
unknown
|
|
|
|
https://api.addins.omex.office.net/appinfo/query
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/tenantassociationkey
|
unknown
|
|
|
|
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
|
unknown
|
|
|
|
https://powerlift.acompli.net
|
unknown
|
|
|
|
https://rpsticket.partnerservices.getmicrosoftkey.com
|
unknown
|
|
|
|
https://lookup.onenote.com/lookup/geolocation/v1
|
unknown
|
|
|
|
https://cortana.ai
|
unknown
|
|
|
|
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
|
|
|
https://cloudfiles.onenote.com/upload.aspx
|
unknown
|
|
|
|
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
|
|
|
https://entitlement.diagnosticssdf.office.com
|
unknown
|
|
|
|
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
|
unknown
|
|
|
|
https://api.aadrm.com/
|
unknown
|
|
|
|
https://ofcrecsvcapi-int.azurewebsites.net/
|
unknown
|
|
|
|
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
|
unknown
|
|
|
|
https://api.microsoftstream.com/api/
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
|
unknown
|
|
|
|
https://cr.office.com
|
unknown
|
|
|
|
https://portal.office.com/account/?ref=ClientMeControl
|
unknown
|
|
|
|
https://ecs.office.com/config/v2/Office
|
unknown
|
|
|
|
https://graph.ppe.windows.net
|
unknown
|
|
|
|
https://res.getmicrosoftkey.com/api/redemptionevents
|
unknown
|
|
|
|
https://powerlift-frontdesk.acompli.net
|
unknown
|
|
|
|
https://tasks.office.com
|
unknown
|
|
|
|
https://officeci.azurewebsites.net/api/
|
unknown
|
|
|
|
https://sr.outlook.office.net/ws/speech/recognize/assistant/work
|
unknown
|
|
|
|
https://store.office.cn/addinstemplate
|
unknown
|
|
|
|
https://outlook.office.com/autosuggest/api/v1/init?cvid=
|
unknown
|
|
|
|
https://globaldisco.crm.dynamics.com
|
unknown
|
|
|
|
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
|
|
|
https://store.officeppe.com/addinstemplate
|
unknown
|
|
|
|
https://dev0-api.acompli.net/autodetect
|
unknown
|
|
|
|
https://www.odwebp.svc.ms
|
unknown
|
|
|
|
https://api.powerbi.com/v1.0/myorg/groups
|
unknown
|
|
|
|
https://web.microsoftstream.com/video/
|
unknown
|
|
|
|
https://graph.windows.net
|
unknown
|
|
|
|
https://dataservice.o365filtering.com/
|
unknown
|
|
|
|
https://officesetup.getmicrosoftkey.com
|
unknown
|
|
|
|
https://analysis.windows.net/powerbi/api
|
unknown
|
|
|
|
https://prod-global-autodetect.acompli.net/autodetect
|
unknown
|
|
|
|
https://outlook.office365.com/autodiscover/autodiscover.json
|
unknown
|
|
|
|
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
|
unknown
|
|
|
|
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
|
|
|
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
|
unknown
|
|
|
|
https://ncus.contentsync.
|
unknown
|
|
|
|
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
|
unknown
|
|
|
|
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
|
unknown
|
|
|
|
http://weather.service.msn.com/data.aspx
|
unknown
|
|
|
|
https://apis.live.net/v5.0/
|
unknown
|
|
|
|
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
|
unknown
|
|
|
|
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
|
unknown
|
|
|
|
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
|
unknown
|
|
|
|
https://management.azure.com
|
unknown
|
|
|
|
https://wus2.contentsync.
|
unknown
|
|
|
|
https://incidents.diagnostics.office.com
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/ios
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/odc/insertmedia
|
unknown
|
|
|
|
https://o365auditrealtimeingestion.manage.office.com
|
unknown
|
|
|
|
https://outlook.office365.com/api/v1.0/me/Activities
|
unknown
|
|
|
|
https://api.office.net
|
unknown
|
|
|
|
https://incidents.diagnosticssdf.office.com
|
unknown
|
|
|
|
https://asgsmsproxyapi.azurewebsites.net/
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/android/policies
|
unknown
|
|
|
|
https://entitlement.diagnostics.office.com
|
unknown
|
|
|
|
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
|
unknown
|
|
|
|
https://outlook.office.com/
|
unknown
|
|
|
|
https://storage.live.com/clientlogs/uploadlocation
|
unknown
|
|
|
|
https://templatelogging.office.com/client/log
|
unknown
|
|
|
|
https://outlook.office365.com/
|
unknown
|
|
|
|
https://webshell.suite.office.com
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
|
unknown
|
|
|
|
https://management.azure.com/
|
unknown
|
|
|
|
https://login.windows.net/common/oauth2/authorize
|
unknown
|
|
|
|
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
|
|
|
https://graph.windows.net/
|
unknown
|
|
|
|
https://api.powerbi.com/beta/myorg/imports
|
unknown
|
|
|
|
https://devnull.onenote.com
|
unknown
|
|
|
|
https://ncus.pagecontentsync.
|
unknown
|
|
|
|
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
|
unknown
|
|
|
|
https://messaging.office.com/
|
unknown
|
|
|
|
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
|
|
|
https://augloop.office.com/v2
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
|
unknown
|
|
|
|
https://skyapi.live.net/Activity/
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/mac
|
unknown
|
|
|
|
https://dataservice.o365filtering.com
|
unknown
|
|
|
|
https://api.cortana.ai
|
unknown
|
|
|
|
https://onedrive.live.com
|
unknown
|
|
|
|
https://ovisualuiapp.azurewebsites.net/pbiagave/
|
unknown
|
|
|
|
https://visio.uservoice.com/forums/368202-visio-on-devices
|
unknown
|
|
|
|
https://directory.services.
|
unknown
|
|
|
|
https://login.windows-ppe.net/common/oauth2/authorize
|
unknown
|
|
|
|
https://staging.cortana.ai
|
unknown
|
|
|
|
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
|
unknown
|
|
|
|
http://www.windows.com/pctv.
|
unknown
|
|
|
|
http://investor.msn.com
|
unknown
|
|
|
|
http://www.msnbc.com/news/ticker.txt
|
unknown
|
|
|
|
http://www.icra.org/vocabulary/.
|
unknown
|
|
|
|
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
|
unknown
|
|
|
|
http://www.hotmail.com/oe
|
unknown
|
|
|
|
http://investor.msn.com/
|
unknown
|
|
There are 98 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
signifysystem.com
|
192.185.39.58
|
|
|
|
fcventasyservicios.cl
|
192.185.32.232
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
192.185.39.58
|
signifysystem.com
|
United States
|
|
|
|
192.185.32.232
|
fcventasyservicios.cl
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
*q?
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
+q?
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
RemoteClearDate
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
Last
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
FilePath
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
StartDate
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
EndDate
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
Properties
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
Url
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastClean
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableWinHttpCertAuth
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableIsOwnerRegex
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableSessionAwareHttpClose
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableADALForExtendedApps
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableADALSetSilentAuth
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
msoridDisableGuestCredProvider
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
msoridDisableOstringReplace
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastBootTime
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ReviewToken
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4B1D8
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
VBAFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
MSForms
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
MSComctlLib
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
1
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
UpdateComplete
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DefaultSheetR2L
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
UseSystemSeparators
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ThousandsSeparator
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DecimalSeparator
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4B8AE
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4BA74
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4BB9C
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4BD04
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4BE8A
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
u'
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
60B8C
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
612D0
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
en-US
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
en-US
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
EXCELFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
RoamingConfigurableSettings
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
RoamingLastSyncTime
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
RoamingLastWriteTime
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
CacheReady
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastRequest
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
CacheReady
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastUpdate
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
NextUpdate
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastBootTime
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastPurgeTime
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
$j3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
MTTT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ReviewToken
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED28B
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
VBAFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DefaultSheetR2L
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
UseSystemSeparators
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ThousandsSeparator
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DecimalSeparator
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED5A7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED6A0
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED79A
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED894
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED9FA
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
5v3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
@%SystemRoot%\system32\qagentrt.dll,-10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
@%SystemRoot%\System32\fveui.dll,-843
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
@%SystemRoot%\System32\fveui.dll,-844
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
@%SystemRoot%\System32\wuaueng.dll,-400
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
LastPurgeTime
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
114164
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
115071
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EXCELFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SavedLegacySettings
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Blob
|
|
There are 176 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7FF54BC22000
|
unkown
|
page readonly
|
|
|
|
7FF597FDE000
|
unkown
|
page readonly
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
15FEF6A4000
|
unkown
|
page read and write
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
2D6A2742000
|
unkown
|
page read and write
|
|
|
|
7FF4F922E000
|
unkown
|
page readonly
|
|
|
|
1EF0E802000
|
unkown
|
page read and write
|
|
|
|
1D1760B1000
|
unkown
|
page read and write
|
|
|
|
1D176999000
|
unkown
|
page read and write
|
|
|
|
7FF5B4FBE000
|
unkown
|
page readonly
|
|
|
|
2EA2000
|
unkown
|
page readonly
|
|
|
|
2D02000
|
unkown
|
page readonly
|
|
|
|
15FEF5E8000
|
unkown
|
page read and write
|
|
|
|
3510000
|
unkown
|
page readonly
|
|
|
|
1D176978000
|
unkown
|
page read and write
|
|
|
|
3500000
|
heap private
|
page read and write
|
|
|
|
7FF5E7940000
|
unkown
|
page readonly
|
|
|
|
1D175F80000
|
unkown
|
page readonly
|
|
|
|
1643AC70000
|
unkown
|
page read and write
|
|
|
|
7FF5B4EBC000
|
unkown
|
page readonly
|
|
|
|
7FF4F9009000
|
unkown
|
page readonly
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
7FF505875000
|
unkown
|
page readonly
|
|
|
|
1D1769DA000
|
unkown
|
page read and write
|
|
|
|
7FF506973000
|
unkown
|
page readonly
|
|
|
|
7FF4F628B000
|
unkown
|
page readonly
|
|
|
|
3507000
|
heap private
|
page read and write
|
|
|
|
227E1950000
|
unkown
|
page write copy
|
|
|
|
7FF4EDE7D000
|
unkown
|
page readonly
|
|
|
|
15FED4B5000
|
unkown
|
page read and write
|
|
|
|
7FF4F929C000
|
unkown
|
page readonly
|
|
|
|
7FF4F63F8000
|
unkown
|
page readonly
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
2F23000
|
unkown
|
page readonly
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
1F869908000
|
unkown
|
page read and write
|
|
|
|
7FF598071000
|
unkown
|
page readonly
|
|
|
|
1D1760EA000
|
unkown
|
page read and write
|
|
|
|
5DD49AE000
|
unkown
|
page read and write
|
|
|
|
1643AD00000
|
unkown
|
page read and write
|
|
|
|
1D176988000
|
unkown
|
page read and write
|
|
|
|
1D17693F000
|
unkown
|
page read and write
|
|
|
|
7FF505C02000
|
unkown
|
page readonly
|
|
|
|
15FEF500000
|
unkown
|
page read and write
|
|
|
|
1643B402000
|
unkown
|
page read and write
|
|
|
|
2E3D000
|
unkown
|
page readonly
|
|
|
|
15FEF543000
|
unkown
|
page read and write
|
|
|
|
2E8A000
|
unkown
|
page readonly
|
|
|
|
2062B513000
|
unkown
|
page read and write
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
D5557F000
|
unkown
|
page read and write
|
|
|
|
227E1A3F000
|
unkown
|
page read and write
|
|
|
|
7FF4F647A000
|
unkown
|
page readonly
|
|
|
|
2F18000
|
unkown
|
page readonly
|
|
|
|
7FF50706A000
|
unkown
|
page readonly
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
1D175FF0000
|
unkown
|
page readonly
|
|
|
|
7FF5B4F4E000
|
unkown
|
page readonly
|
|
|
|
7FF597FAC000
|
unkown
|
page readonly
|
|
|
|
1B6B5C6C000
|
unkown
|
page read and write
|
|
|
|
D556FE000
|
unkown
|
page read and write
|
|
|
|
2D0E000
|
unkown
|
page readonly
|
|
|
|
1D176E02000
|
unkown
|
page read and write
|
|
|
|
1643ABE0000
|
unkown
|
page readonly
|
|
|
|
1D176925000
|
unkown
|
page read and write
|
|
|
|
15FED4F0000
|
unkown
|
page read and write
|
|
|
|
7FF597C4F000
|
unkown
|
page readonly
|
|
|
|
1D176956000
|
unkown
|
page read and write
|
|
|
|
14F8B400000
|
unkown
|
page read and write
|
|
|
|
3160000
|
unkown
|
page readonly
|
|
|
|
7FF5E7978000
|
unkown
|
page readonly
|
|
|
|
7FF5E7A31000
|
unkown
|
page readonly
|
|
|
|
7FF4F6353000
|
unkown
|
page readonly
|
|
|
|
1643AAA0000
|
heap private
|
page read and write
|
|
|
|
2062B400000
|
unkown
|
page read and write
|
|
|
|
2D50000
|
unkown
|
page readonly
|
|
|
|
1F86988E000
|
unkown
|
page read and write
|
|
|
|
1D17695A000
|
unkown
|
page read and write
|
|
|
|
1D176969000
|
unkown
|
page read and write
|
|
|
|
7FF5B4754000
|
unkown
|
page readonly
|
|
|
|
7FF505BAD000
|
unkown
|
page readonly
|
|
|
|
7FF4F8EF6000
|
unkown
|
page readonly
|
|
|
|
27B61F5000
|
unkown
|
page read and write
|
|
|
|
D5577F000
|
unkown
|
page read and write
|
|
|
|
2E53000
|
unkown
|
page readonly
|
|
|
|
1D17695A000
|
unkown
|
page read and write
|
|
|
|
1EF0E873000
|
unkown
|
page read and write
|
|
|
|
1510B79000
|
unkown
|
page read and write
|
|
|
|
7FF505C4C000
|
unkown
|
page readonly
|
|
|
|
1D176983000
|
unkown
|
page read and write
|
|
|
|
7FF54BF11000
|
unkown
|
page readonly
|
|
|
|
1005F7000
|
unkown
|
page read and write
|
|
|
|
2062CE70000
|
unkown
|
page read and write
|
|
|
|
1004F5000
|
unkown
|
page read and write
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
1D17693F000
|
unkown
|
page read and write
|
|
|
|
EEA000
|
unkown
|
page read and write
|
|
|
|
7FF4F63D4000
|
unkown
|
page readonly
|
|
|
|
7FF5E7821000
|
unkown
|
page readonly
|
|
|
|
227E1A29000
|
unkown
|
page read and write
|
|
|
|
E34C4F9000
|
unkown
|
page read and write
|
|
|
|
7FF4EE637000
|
unkown
|
page readonly
|
|
|
|
A4B000
|
unkown
|
page read and write
|
|
|
|
1D17604D000
|
unkown
|
page read and write
|
|
|
|
7FF55F2BB000
|
unkown
|
page readonly
|
|
|
|
1EF0E86B000
|
unkown
|
page read and write
|
|
|
|
4968D8F000
|
unkown
|
page read and write
|
|
|
|
7FF55F1AB000
|
unkown
|
page readonly
|
|
|
|
1D1760D0000
|
unkown
|
page read and write
|
|
|
|
7FF5B4DA1000
|
unkown
|
page readonly
|
|
|
|
7FF4F605A000
|
unkown
|
page readonly
|
|
|
|
7FF505BC4000
|
unkown
|
page readonly
|
|
|
|
15FEF2C0000
|
unkown
|
page read and write
|
|
|
|
7FF4F8F05000
|
unkown
|
page readonly
|
|
|
|
15FED4D1000
|
unkown
|
page read and write
|
|
|
|
15FED47D000
|
unkown
|
page read and write
|
|
|
|
7FF5B4CC7000
|
unkown
|
page readonly
|
|
|
|
1D17696F000
|
unkown
|
page read and write
|
|
|
|
1643AC3C000
|
unkown
|
page read and write
|
|
|
|
7FF4EE691000
|
unkown
|
page readonly
|
|
|
|
7FF4F6395000
|
unkown
|
page readonly
|
|
|
|
3619000
|
unkown
|
page read and write
|
|
|
|
15FF0510000
|
unkown
|
page read and write
|
|
|
|
1007FD000
|
unkown
|
page read and write
|
|
|
|
7FF54C0AA000
|
unkown
|
page readonly
|
|
|
|
1D17693F000
|
unkown
|
page read and write
|
|
|
|
7FF5E7A32000
|
unkown
|
page readonly
|
|
|
|
E34C18F000
|
unkown
|
page read and write
|
|
|
|
7FF55EAB4000
|
unkown
|
page readonly
|
|
|
|
49696F7000
|
unkown
|
page read and write
|
|
|
|
1D176951000
|
unkown
|
page read and write
|
|
|
|
1D176962000
|
unkown
|
page read and write
|
|
|
|
7FF50573E000
|
unkown
|
page readonly
|
|
|
|
2D6A2970000
|
unkown
|
page readonly
|
|
|
|
7FF597DD9000
|
unkown
|
page readonly
|
|
|
|
7FF4EE528000
|
unkown
|
page readonly
|
|
|
|
7FF4EE2F7000
|
unkown
|
page readonly
|
|
|
|
7FF507111000
|
unkown
|
page readonly
|
|
|
|
7FF4F9422000
|
unkown
|
page readonly
|
|
|
|
7FF5977DD000
|
unkown
|
page readonly
|
|
|
|
1F8696D0000
|
heap private
|
page read and write
|
|
|
|
2E91000
|
unkown
|
page readonly
|
|
|
|
361E000
|
unkown
|
page read and write
|
|
|
|
7FF5B4E31000
|
unkown
|
page readonly
|
|
|
|
1D17692B000
|
unkown
|
page read and write
|
|
|
|
7FF597D46000
|
unkown
|
page readonly
|
|
|
|
35F0000
|
heap default
|
page read and write
|
|
|
|
7FF597F20000
|
unkown
|
page readonly
|
|
|
|
14F8B600000
|
unkown
|
page readonly
|
|
|
|
7FF505B5E000
|
unkown
|
page readonly
|
|
|
|
361A000
|
unkown
|
page read and write
|
|
|
|
1D176941000
|
unkown
|
page read and write
|
|
|
|
2F23000
|
unkown
|
page readonly
|
|
|
|
227E1A00000
|
unkown
|
page read and write
|
|
|
|
7FF505A1B000
|
unkown
|
page readonly
|
|
|
|
15FF0310000
|
unkown
|
page read and write
|
|
|
|
2062B46D000
|
unkown
|
page read and write
|
|
|
|
7FF597E83000
|
unkown
|
page readonly
|
|
|
|
15FF0010000
|
unkown
|
page read and write
|
|
|
|
1D176956000
|
unkown
|
page read and write
|
|
|
|
7FF4F9374000
|
unkown
|
page readonly
|
|
|
|
7FF54C006000
|
unkown
|
page readonly
|
|
|
|
15FEF902000
|
unkown
|
page read and write
|
|
|
|
1643AC8C000
|
unkown
|
page read and write
|
|
|
|
7FF54BE86000
|
unkown
|
page readonly
|
|
|
|
1D17697C000
|
unkown
|
page read and write
|
|
|
|
15FEF800000
|
unkown
|
page read and write
|
|
|
|
1D1760C5000
|
unkown
|
page read and write
|
|
|
|
7FF4EE64F000
|
unkown
|
page readonly
|
|
|
|
CF0000
|
unkown
|
page readonly
|
|
|
|
79647B000
|
unkown
|
page read and write
|
|
|
|
4D272FB000
|
unkown
|
page read and write
|
|
|
|
15FED513000
|
unkown
|
page read and write
|
|
|
|
F6D000
|
unkown
|
page read and write
|
|
|
|
15FF0110000
|
unkown
|
page read and write
|
|
|
|
1EF0E740000
|
heap default
|
page read and write
|
|
|
|
1D176780000
|
unkown
|
page read and write
|
|
|
|
7FF507064000
|
unkown
|
page readonly
|
|
|
|
7FF50546A000
|
unkown
|
page readonly
|
|
|
|
15FEF5B1000
|
unkown
|
page read and write
|
|
|
|
2E8F000
|
unkown
|
page readonly
|
|
|
|
49692FE000
|
unkown
|
page read and write
|
|
|
|
15FEF982000
|
unkown
|
page read and write
|
|
|
|
1EF10370000
|
unkown
|
page readonly
|
|
|
|
7FF54C136000
|
unkown
|
page readonly
|
|
|
|
361D000
|
unkown
|
page read and write
|
|
|
|
1D176969000
|
unkown
|
page read and write
|
|
|
|
15FED43F000
|
unkown
|
page read and write
|
|
|
|
27B6477000
|
unkown
|
page read and write
|
|
|
|
2D02000
|
unkown
|
page readonly
|
|
|
|
1D176081000
|
unkown
|
page read and write
|
|
|
|
4D2737F000
|
unkown
|
page read and write
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
5DD4D7A000
|
unkown
|
page read and write
|
|
|
|
7FF4EE658000
|
unkown
|
page readonly
|
|
|
|
2E19000
|
unkown
|
page readonly
|
|
|
|
7FF55F326000
|
unkown
|
page readonly
|
|
|
|
7FF507025000
|
unkown
|
page readonly
|
|
|
|
840D9FE000
|
unkown
|
page read and write
|
|
|
|
1D17693D000
|
unkown
|
page read and write
|
|
|
|
1D17693F000
|
unkown
|
page read and write
|
|
|
|
1D17694F000
|
unkown
|
page read and write
|
|
|
|
7FF4F61B1000
|
unkown
|
page readonly
|
|
|
|
7FF55EF89000
|
unkown
|
page readonly
|
|
|
|
7FF54C09F000
|
unkown
|
page readonly
|
|
|
|
15FED4E8000
|
unkown
|
page read and write
|
|
|
|
7FF4F941A000
|
unkown
|
page readonly
|
|
|
|
227E19A0000
|
unkown
|
page readonly
|
|
|
|
5DD492B000
|
unkown
|
page read and write
|
|
|
|
5DD4DFE000
|
unkown
|
page read and write
|
|
|
|
1B6B59A0000
|
heap private
|
page read and write
|
|
|
|
7FF4EE66A000
|
unkown
|
page readonly
|
|
|
|
4D27E7A000
|
unkown
|
page read and write
|
|
|
|
7FF54C139000
|
unkown
|
page readonly
|
|
|
|
1D176116000
|
unkown
|
page read and write
|
|
|
|
7FF5B5042000
|
unkown
|
page readonly
|
|
|
|
15FEF5EF000
|
unkown
|
page read and write
|
|
|
|
1D17694A000
|
unkown
|
page read and write
|
|
|
|
1060000
|
unkown
|
page read and write
|
|
|
|
7FF54C083000
|
unkown
|
page readonly
|
|
|
|
7FF54C1B1000
|
unkown
|
page readonly
|
|
|
|
1F86984D000
|
unkown
|
page read and write
|
|
|
|
7FF55F2B0000
|
unkown
|
page readonly
|
|
|
|
4D27D7B000
|
unkown
|
page read and write
|
|
|
|
7FF54C0C0000
|
unkown
|
page readonly
|
|
|
|
1D177000000
|
unkown
|
page readonly
|
|
|
|
15FEF5CA000
|
unkown
|
page read and write
|
|
|
|
15FEEDE0000
|
unkown
|
page read and write
|
|
|
|
1D176949000
|
unkown
|
page read and write
|
|
|
|
1D1760E6000
|
unkown
|
page read and write
|
|
|
|
7FF597FCA000
|
unkown
|
page readonly
|
|
|
|
15FEEE10000
|
unkown
|
page read and write
|
|
|
|
1D176968000
|
unkown
|
page read and write
|
|
|
|
15FF0310000
|
unkown
|
page read and write
|
|
|
|
1643AB00000
|
heap default
|
page read and write
|
|
|
|
1F869850000
|
unkown
|
page read and write
|
|
|
|
F65000
|
unkown
|
page read and write
|
|
|
|
49694FF000
|
unkown
|
page read and write
|
|
|
|
15FF0710000
|
unkown
|
page read and write
|
|
|
|
15FED45A000
|
unkown
|
page read and write
|
|
|
|
840DA7F000
|
unkown
|
page read and write
|
|
|
|
7FF5B4F50000
|
unkown
|
page readonly
|
|
|
|
1F869A00000
|
unkown
|
page readonly
|
|
|
|
15FEEDF0000
|
unkown
|
page readonly
|
|
|
|
7FF4F639B000
|
unkown
|
page readonly
|
|
|
|
7FF597FC4000
|
unkown
|
page readonly
|
|
|
|
7FF4F93A6000
|
unkown
|
page readonly
|
|
|
|
7FF5055B7000
|
unkown
|
page readonly
|
|
|
|
7FF54C060000
|
unkown
|
page readonly
|
|
|
|
E67000
|
heap private
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
2E45000
|
unkown
|
page readonly
|
|
|
|
15FED540000
|
unkown
|
page read and write
|
|
|
|
796577000
|
unkown
|
page read and write
|
|
|
|
7FF4F6406000
|
unkown
|
page readonly
|
|
|
|
7FF54C052000
|
unkown
|
page readonly
|
|
|
|
7FF505CCE000
|
unkown
|
page readonly
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
7FF54BD97000
|
unkown
|
page readonly
|
|
|
|
1D176051000
|
unkown
|
page read and write
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
151079B000
|
unkown
|
page read and write
|
|
|
|
2D50000
|
unkown
|
page readonly
|
|
|
|
15FEF56D000
|
unkown
|
page read and write
|
|
|
|
7FF55F203000
|
unkown
|
page readonly
|
|
|
|
7FF4F604C000
|
unkown
|
page readonly
|
|
|
|
1B6B6740000
|
unkown
|
page readonly
|
|
|
|
2D6A2726000
|
heap default
|
page read and write
|
|
|
|
2062B3C0000
|
unkown
|
page readonly
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
14F8B3A0000
|
unkown
|
page readonly
|
|
|
|
1D176943000
|
unkown
|
page read and write
|
|
|
|
1D176978000
|
unkown
|
page read and write
|
|
|
|
15FED413000
|
unkown
|
page read and write
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
2062B6D0000
|
unkown
|
page readonly
|
|
|
|
7FF4F9421000
|
unkown
|
page readonly
|
|
|
|
1643AC55000
|
unkown
|
page read and write
|
|
|
|
7FF4F938F000
|
unkown
|
page readonly
|
|
|
|
7FF505CD6000
|
unkown
|
page readonly
|
|
|
|
2D6A2610000
|
unkown
|
page readonly
|
|
|
|
1B6B5D02000
|
unkown
|
page read and write
|
|
|
|
7FF55F2DF000
|
unkown
|
page readonly
|
|
|
|
7FF5B475A000
|
unkown
|
page readonly
|
|
|
|
7FF54C00D000
|
unkown
|
page readonly
|
|
|
|
7FF55F31E000
|
unkown
|
page readonly
|
|
|
|
7FF55F1FD000
|
unkown
|
page readonly
|
|
|
|
2EF1000
|
unkown
|
page readonly
|
|
|
|
7FF505A94000
|
unkown
|
page readonly
|
|
|
|
15FEF402000
|
unkown
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
7FF54C10A000
|
unkown
|
page readonly
|
|
|
|
15FEF743000
|
unkown
|
page read and write
|
|
|
|
7FF4EE61E000
|
unkown
|
page readonly
|
|
|
|
1EF0E83F000
|
unkown
|
page read and write
|
|
|
|
F65000
|
unkown
|
page read and write
|
|
|
|
1D17692C000
|
unkown
|
page read and write
|
|
|
|
7FF5057CE000
|
unkown
|
page readonly
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
1D176900000
|
unkown
|
page read and write
|
|
|
|
1D176730000
|
unkown
|
page write copy
|
|
|
|
1EF0E7A0000
|
unkown
|
page readonly
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
7FF505877000
|
unkown
|
page readonly
|
|
|
|
1D176952000
|
unkown
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
2D6A2965000
|
heap private
|
page read and write
|
|
|
|
1D176013000
|
unkown
|
page read and write
|
|
|
|
1D176E61000
|
unkown
|
page read and write
|
|
|
|
7FF5B4F67000
|
unkown
|
page readonly
|
|
|
|
7FF54C0BE000
|
unkown
|
page readonly
|
|
|
|
2062B370000
|
unkown
|
page write copy
|
|
|
|
1643AC13000
|
unkown
|
page read and write
|
|
|
|
112E000
|
unkown
|
page read and write
|
|
|
|
3639000
|
unkown
|
page read and write
|
|
|
|
1D176934000
|
unkown
|
page read and write
|
|
|
|
7FF505B68000
|
unkown
|
page readonly
|
|
|
|
7FF4F931C000
|
unkown
|
page readonly
|
|
|
|
7FF55EE76000
|
unkown
|
page readonly
|
|
|
|
1D17696A000
|
unkown
|
page read and write
|
|
|
|
7FF5E7799000
|
unkown
|
page readonly
|
|
|
|
1D176999000
|
unkown
|
page read and write
|
|
|
|
15FEF684000
|
unkown
|
page read and write
|
|
|
|
1D176961000
|
unkown
|
page read and write
|
|
|
|
2B93000
|
unkown
|
page readonly
|
|
|
|
79667F000
|
unkown
|
page read and write
|
|
|
|
14F8B429000
|
unkown
|
page read and write
|
|
|
|
F6D000
|
unkown
|
page read and write
|
|
|
|
1D17693D000
|
unkown
|
page read and write
|
|
|
|
14F8B350000
|
unkown
|
page write copy
|
|
|
|
15FED572000
|
unkown
|
page read and write
|
|
|
|
15FEF842000
|
unkown
|
page read and write
|
|
|
|
15FEEE00000
|
heap private
|
page read and write
|
|
|
|
1D1769B5000
|
unkown
|
page read and write
|
|
|
|
15FEF900000
|
unkown
|
page read and write
|
|
|
|
15FEF54D000
|
unkown
|
page read and write
|
|
|
|
2062B429000
|
unkown
|
page read and write
|
|
|
|
15FEF2A0000
|
unkown
|
page read and write
|
|
|
|
7FF54C0BA000
|
unkown
|
page readonly
|
|
|
|
9F0000
|
unkown
|
page read and write
|
|
|
|
F69000
|
unkown
|
page read and write
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
7FF4F91D3000
|
unkown
|
page readonly
|
|
|
|
15FF0610000
|
unkown
|
page read and write
|
|
|
|
7FF5B4EA3000
|
unkown
|
page readonly
|
|
|
|
6660000
|
unkown
|
page readonly
|
|
|
|
7FF505C2B000
|
unkown
|
page readonly
|
|
|
|
496977E000
|
unkown
|
page read and write
|
|
|
|
F71000
|
unkown
|
page read and write
|
|
|
|
15FED4E7000
|
unkown
|
page read and write
|
|
|
|
496987A000
|
unkown
|
page read and write
|
|
|
|
227E1A6E000
|
unkown
|
page read and write
|
|
|
|
1D17698B000
|
unkown
|
page read and write
|
|
|
|
7FF54C114000
|
unkown
|
page readonly
|
|
|
|
496927A000
|
unkown
|
page read and write
|
|
|
|
1D176931000
|
unkown
|
page read and write
|
|
|
|
15FF0710000
|
unkown
|
page read and write
|
|
|
|
1510BF9000
|
unkown
|
page read and write
|
|
|
|
7FF4EE68E000
|
unkown
|
page readonly
|
|
|
|
7FF597FD4000
|
unkown
|
page readonly
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
7FF4EE3DB000
|
unkown
|
page readonly
|
|
|
|
2E75000
|
unkown
|
page readonly
|
|
|
|
7FF505464000
|
unkown
|
page readonly
|
|
|
|
1D176029000
|
unkown
|
page read and write
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
1643AC02000
|
unkown
|
page read and write
|
|
|
|
64D0000
|
unkown
|
page read and write
|
|
|
|
2D6A2810000
|
unkown
|
page read and write
|
|
|
|
27B657F000
|
unkown
|
page read and write
|
|
|
|
15FED52D000
|
unkown
|
page read and write
|
|
|
|
15FED2D0000
|
heap default
|
page read and write
|
|
|
|
1510A7E000
|
unkown
|
page read and write
|
|
|
|
15FF0110000
|
unkown
|
page read and write
|
|
|
|
4D27F7B000
|
unkown
|
page read and write
|
|
|
|
1EF0EA00000
|
unkown
|
page readonly
|
|
|
|
7FF597F43000
|
unkown
|
page readonly
|
|
|
|
1D1769A4000
|
unkown
|
page read and write
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
4D2807B000
|
unkown
|
page read and write
|
|
|
|
15FEF942000
|
unkown
|
page read and write
|
|
|
|
1D175F90000
|
unkown
|
page read and write
|
|
|
|
7FF4EE2DC000
|
unkown
|
page readonly
|
|
|
|
2E7D000
|
unkown
|
page readonly
|
|
|
|
1D1760E0000
|
unkown
|
page read and write
|
|
|
|
4D27AF9000
|
unkown
|
page read and write
|
|
|
|
7FF505C4A000
|
unkown
|
page readonly
|
|
|
|
227E1940000
|
heap default
|
page read and write
|
|
|
|
7FF597C57000
|
unkown
|
page readonly
|
|
|
|
1EF0E829000
|
unkown
|
page read and write
|
|
|
|
15FED462000
|
unkown
|
page read and write
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
79627D000
|
unkown
|
page read and write
|
|
|
|
7FF507088000
|
unkown
|
page readonly
|
|
|
|
7FF4EE5C2000
|
unkown
|
page readonly
|
|
|
|
7FF505820000
|
unkown
|
page readonly
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
12FA000
|
unkown
|
page readonly
|
|
|
|
35FA000
|
heap default
|
page read and write
|
|
|
|
7FF597F8B000
|
unkown
|
page readonly
|
|
|
|
2E2A000
|
unkown
|
page readonly
|
|
|
|
1D176954000
|
unkown
|
page read and write
|
|
|
|
7FF54C08F000
|
unkown
|
page readonly
|
|
|
|
14F8B6D0000
|
unkown
|
page readonly
|
|
|
|
1D17694F000
|
unkown
|
page read and write
|
|
|
|
227E1A6A000
|
unkown
|
page read and write
|
|
|
|
1D176978000
|
unkown
|
page read and write
|
|
|
|
2E75000
|
unkown
|
page readonly
|
|
|
|
7FF55EE70000
|
unkown
|
page readonly
|
|
|
|
15FED51A000
|
unkown
|
page read and write
|
|
|
|
7FF5B4F4A000
|
unkown
|
page readonly
|
|
|
|
7FF5B4E4E000
|
unkown
|
page readonly
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
1F869740000
|
unkown
|
page readonly
|
|
|
|
1D17693D000
|
unkown
|
page read and write
|
|
|
|
1D176988000
|
unkown
|
page read and write
|
|
|
|
2E69000
|
unkown
|
page readonly
|
|
|
|
1D176999000
|
unkown
|
page read and write
|
|
|
|
1F869AD0000
|
unkown
|
page readonly
|
|
|
|
2E4C000
|
unkown
|
page readonly
|
|
|
|
15FF0210000
|
unkown
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
7FF505A60000
|
unkown
|
page readonly
|
|
|
|
15FEF570000
|
unkown
|
page read and write
|
|
|
|
7FF5B4EB4000
|
unkown
|
page readonly
|
|
|
|
1B6B5C88000
|
unkown
|
page read and write
|
|
|
|
2E19000
|
unkown
|
page readonly
|
|
|
|
2E4C000
|
unkown
|
page readonly
|
|
|
|
2F12000
|
unkown
|
page readonly
|
|
|
|
1D176963000
|
unkown
|
page read and write
|
|
|
|
15FEF2D0000
|
unkown
|
page readonly
|
|
|
|
7FF4EE441000
|
unkown
|
page readonly
|
|
|
|
1F869730000
|
heap default
|
page read and write
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
15FED530000
|
unkown
|
page read and write
|
|
|
|
1EF0E902000
|
unkown
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
7FF5E75FC000
|
unkown
|
page readonly
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
1643AC4A000
|
unkown
|
page read and write
|
|
|
|
7FF50709D000
|
unkown
|
page readonly
|
|
|
|
7FF50702B000
|
unkown
|
page readonly
|
|
|
|
15FED4D8000
|
unkown
|
page read and write
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
7FF5E799E000
|
unkown
|
page readonly
|
|
|
|
14F8B2E0000
|
heap private
|
page read and write
|
|
|
|
2B1E000
|
unkown
|
page readonly
|
|
|
|
5DD4C7F000
|
unkown
|
page read and write
|
|
|
|
7FF54C104000
|
unkown
|
page readonly
|
|
|
|
7FF5B4FC9000
|
unkown
|
page readonly
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
1D176956000
|
unkown
|
page read and write
|
|
|
|
1D1769DA000
|
unkown
|
page read and write
|
|
|
|
E70000
|
unkown
|
page readonly
|
|
|
|
1D175FB0000
|
unkown
|
page readonly
|
|
|
|
7FF4EE445000
|
unkown
|
page readonly
|
|
|
|
1D176780000
|
unkown
|
page read and write
|
|
|
|
7FF505CB4000
|
unkown
|
page readonly
|
|
|
|
7FF54BC99000
|
unkown
|
page readonly
|
|
|
|
2EAB000
|
unkown
|
page readonly
|
|
|
|
7FF4EE70A000
|
unkown
|
page readonly
|
|
|
|
15FED551000
|
unkown
|
page read and write
|
|
|
|
15FEF517000
|
unkown
|
page read and write
|
|
|
|
2D0E000
|
unkown
|
page readonly
|
|
|
|
7FF54C0C5000
|
unkown
|
page readonly
|
|
|
|
1D176973000
|
unkown
|
page read and write
|
|
|
|
1D176942000
|
unkown
|
page read and write
|
|
|
|
2E7F000
|
unkown
|
page readonly
|
|
|
|
15FED46B000
|
unkown
|
page read and write
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
1643AD13000
|
unkown
|
page read and write
|
|
|
|
15FED4EC000
|
unkown
|
page read and write
|
|
|
|
7FF5B4F3C000
|
unkown
|
page readonly
|
|
|
|
227E1A6A000
|
unkown
|
page read and write
|
|
|
|
15FF0510000
|
unkown
|
page read and write
|
|
|
|
1510C7F000
|
unkown
|
page read and write
|
|
|
|
7FF4F931A000
|
unkown
|
page readonly
|
|
|
|
1B6B5A00000
|
heap default
|
page read and write
|
|
|
|
1D17695A000
|
unkown
|
page read and write
|
|
|
|
7FF54BD8F000
|
unkown
|
page readonly
|
|
|
|
6A60000
|
unkown
|
page read and write
|
|
|
|
7FF597F22000
|
unkown
|
page readonly
|
|
|
|
7FF5B4F7C000
|
unkown
|
page readonly
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
2EAB000
|
unkown
|
page readonly
|
|
|
|
1B6B5C3C000
|
unkown
|
page read and write
|
|
|
|
4D278FB000
|
unkown
|
page read and write
|
|
|
|
1F869852000
|
unkown
|
page read and write
|
|
|
|
E0E000
|
unkown
|
page read and write
|
|
|
|
2E83000
|
unkown
|
page readonly
|
|
|
|
7FF55EABA000
|
unkown
|
page readonly
|
|
|
|
1D1769A1000
|
unkown
|
page read and write
|
|
|
|
1643AE00000
|
unkown
|
page readonly
|
|
|
|
2062CF70000
|
unkown
|
page readonly
|
|
|
|
1D176925000
|
unkown
|
page read and write
|
|
|
|
7FF54BE7B000
|
unkown
|
page readonly
|
|
|
|
1D176951000
|
unkown
|
page read and write
|
|
|
|
7FF597FF6000
|
unkown
|
page readonly
|
|
|
|
15FED480000
|
unkown
|
page read and write
|
|
|
|
15FEF512000
|
unkown
|
page read and write
|
|
|
|
7FF54C094000
|
unkown
|
page readonly
|
|
|
|
15FED2E0000
|
unkown
|
page readonly
|
|
|
|
7FF505A26000
|
unkown
|
page readonly
|
|
|
|
1D176972000
|
unkown
|
page read and write
|
|
|
|
15FEF5B7000
|
unkown
|
page read and write
|
|
|
|
2E8A000
|
unkown
|
page readonly
|
|
|
|
7FF55F027000
|
unkown
|
page readonly
|
|
|
|
7FF4F6390000
|
unkown
|
page readonly
|
|
|
|
7FF597FAF000
|
unkown
|
page readonly
|
|
|
|
7FF4EE62B000
|
unkown
|
page readonly
|
|
|
|
227E1A6A000
|
unkown
|
page read and write
|
|
|
|
7FF4F63BF000
|
unkown
|
page readonly
|
|
|
|
7FF505BB3000
|
unkown
|
page readonly
|
|
|
|
7FF5E798A000
|
unkown
|
page readonly
|
|
|
|
15FED530000
|
unkown
|
page read and write
|
|
|
|
7FF4F63E4000
|
unkown
|
page readonly
|
|
|
|
7FF597E88000
|
unkown
|
page readonly
|
|
|
|
361D000
|
unkown
|
page read and write
|
|
|
|
1B6B5D08000
|
unkown
|
page read and write
|
|
|
|
15FED4EC000
|
unkown
|
page read and write
|
|
|
|
7FF597E61000
|
unkown
|
page readonly
|
|
|
|
7FF54BEF6000
|
unkown
|
page readonly
|
|
|
|
15FEF58C000
|
unkown
|
page read and write
|
|
|
|
1EF0E914000
|
unkown
|
page read and write
|
|
|
|
2F04000
|
unkown
|
page readonly
|
|
|
|
1F86984A000
|
unkown
|
page read and write
|
|
|
|
7FF4F6293000
|
unkown
|
page readonly
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
1D176956000
|
unkown
|
page read and write
|
|
|
|
7FF4F6298000
|
unkown
|
page readonly
|
|
|
|
1006FE000
|
unkown
|
page read and write
|
|
|
|
7FF55F30F000
|
unkown
|
page readonly
|
|
|
|
7FF4EE5C0000
|
unkown
|
page readonly
|
|
|
|
D8F000
|
unkown
|
page read and write
|
|
|
|
1B6B5C00000
|
unkown
|
page read and write
|
|
|
|
7FF54C11E000
|
unkown
|
page readonly
|
|
|
|
7FF50707E000
|
unkown
|
page readonly
|
|
|
|
15FEF570000
|
unkown
|
page read and write
|
|
|
|
E34C10E000
|
unkown
|
page read and write
|
|
|
|
1D176961000
|
unkown
|
page read and write
|
|
|
|
15FEF290000
|
unkown
|
page readonly
|
|
|
|
7FF4EE712000
|
unkown
|
page readonly
|
|
|
|
3619000
|
unkown
|
page read and write
|
|
|
|
15FEF2A0000
|
unkown
|
page read and write
|
|
|
|
15FEF5FB000
|
unkown
|
page read and write
|
|
|
|
15FEEF10000
|
unkown
|
page readonly
|
|
|
|
1B6B5E00000
|
unkown
|
page readonly
|
|
|
|
7FF55F29A000
|
unkown
|
page readonly
|
|
|
|
840D8F9000
|
unkown
|
page read and write
|
|
|
|
7FF4F9330000
|
unkown
|
page readonly
|
|
|
|
1D17694F000
|
unkown
|
page read and write
|
|
|
|
D3E000
|
unkown
|
page read and write
|
|
|
|
15FEF2F0000
|
unkown
|
page readonly
|
|
|
|
F2B000
|
unkown
|
page read and write
|
|
|
|
7FF55F318000
|
unkown
|
page readonly
|
|
|
|
1D176988000
|
unkown
|
page read and write
|
|
|
|
4D281FE000
|
unkown
|
page read and write
|
|
|
|
D90000
|
unkown
|
page read and write
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
7FF54C0F7000
|
unkown
|
page readonly
|
|
|
|
15FED429000
|
unkown
|
page read and write
|
|
|
|
1643AC7F000
|
unkown
|
page read and write
|
|
|
|
3621000
|
unkown
|
page read and write
|
|
|
|
7FF4EE625000
|
unkown
|
page readonly
|
|
|
|
1EF0E6E0000
|
heap private
|
page read and write
|
|
|
|
227E1A6A000
|
unkown
|
page read and write
|
|
|
|
7FF54C0EF000
|
unkown
|
page readonly
|
|
|
|
2062B360000
|
heap default
|
page read and write
|
|
|
|
7FF4EE696000
|
unkown
|
page readonly
|
|
|
|
7FF4F9398000
|
unkown
|
page readonly
|
|
|
|
7FF597F97000
|
unkown
|
page readonly
|
|
|
|
7FF54C0AC000
|
unkown
|
page readonly
|
|
|
|
7FF4F614B000
|
unkown
|
page readonly
|
|
|
|
1D17693D000
|
unkown
|
page read and write
|
|
|
|
7FF5E71A1000
|
unkown
|
page readonly
|
|
|
|
1D17697A000
|
unkown
|
page read and write
|
|
|
|
1D17604E000
|
unkown
|
page read and write
|
|
|
|
1643B600000
|
unkown
|
page readonly
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
1D17693F000
|
unkown
|
page read and write
|
|
|
|
15FED4E8000
|
unkown
|
page read and write
|
|
|
|
15FEF802000
|
unkown
|
page read and write
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
1643AC00000
|
unkown
|
page read and write
|
|
|
|
15FEF700000
|
unkown
|
page read and write
|
|
|
|
1D1769C9000
|
unkown
|
page read and write
|
|
|
|
1B6B5BD0000
|
unkown
|
page read and write
|
|
|
|
7FF4F605F000
|
unkown
|
page readonly
|
|
|
|
1F869829000
|
unkown
|
page read and write
|
|
|
|
F6D000
|
unkown
|
page read and write
|
|
|
|
7FF5E719D000
|
unkown
|
page readonly
|
|
|
|
7FF5E79B9000
|
unkown
|
page readonly
|
|
|
|
1B6B5C55000
|
unkown
|
page read and write
|
|
|
|
15FF0610000
|
unkown
|
page read and write
|
|
|
|
7FF505CA4000
|
unkown
|
page readonly
|
|
|
|
7FF4F61E9000
|
unkown
|
page readonly
|
|
|
|
7FF4F9367000
|
unkown
|
page readonly
|
|
|
|
7FF4EE699000
|
unkown
|
page readonly
|
|
|
|
1D17693F000
|
unkown
|
page read and write
|
|
|
|
15FF0510000
|
unkown
|
page read and write
|
|
|
|
15FEF653000
|
unkown
|
page read and write
|
|
|
|
7FF4F6330000
|
unkown
|
page readonly
|
|
|
|
1D17695A000
|
unkown
|
page read and write
|
|
|
|
1D176925000
|
unkown
|
page read and write
|
|
|
|
7FF507058000
|
unkown
|
page readonly
|
|
|
|
7FF505C5A000
|
unkown
|
page readonly
|
|
|
|
2062B463000
|
unkown
|
page read and write
|
|
|
|
7FF55F2DC000
|
unkown
|
page readonly
|
|
|
|
15FEF5E8000
|
unkown
|
page read and write
|
|
|
|
1EF0E900000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page readonly
|
|
|
|
7FF54BFBB000
|
unkown
|
page readonly
|
|
|
|
7FF505C97000
|
unkown
|
page readonly
|
|
|
|
7FF5E7903000
|
unkown
|
page readonly
|
|
|
|
1D176988000
|
unkown
|
page read and write
|
|
|
|
1D176925000
|
unkown
|
page read and write
|
|
|
|
1D175FE0000
|
unkown
|
page readonly
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
2062B472000
|
unkown
|
page read and write
|
|
|
|
4969978000
|
unkown
|
page read and write
|
|
|
|
7FF598064000
|
unkown
|
page readonly
|
|
|
|
15FEF569000
|
unkown
|
page read and write
|
|
|
|
27B607E000
|
unkown
|
page read and write
|
|
|
|
7FF4F8EF0000
|
unkown
|
page readonly
|
|
|
|
2E3D000
|
unkown
|
page readonly
|
|
|
|
7FF4F9283000
|
unkown
|
page readonly
|
|
|
|
3632000
|
unkown
|
page read and write
|
|
|
|
2EF5000
|
unkown
|
page readonly
|
|
|
|
227E1A6A000
|
unkown
|
page read and write
|
|
|
|
1D176780000
|
unkown
|
page readonly
|
|
|
|
1D176925000
|
unkown
|
page read and write
|
|
|
|
7FF4EE5E3000
|
unkown
|
page readonly
|
|
|
|
1D176941000
|
unkown
|
page read and write
|
|
|
|
840D5DF000
|
unkown
|
page read and write
|
|
|
|
7FF4F5BF1000
|
unkown
|
page readonly
|
|
|
|
1D1760BF000
|
unkown
|
page read and write
|
|
|
|
840D97A000
|
unkown
|
page read and write
|
|
|
|
15FEF600000
|
unkown
|
page read and write
|
|
|
|
1B6B5BC0000
|
unkown
|
page readonly
|
|
|
|
496907E000
|
unkown
|
page read and write
|
|
|
|
7FF505C8F000
|
unkown
|
page readonly
|
|
|
|
1643AC29000
|
unkown
|
page read and write
|
|
|
|
1F86A002000
|
unkown
|
page read and write
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
7FF5E7945000
|
unkown
|
page readonly
|
|
|
|
1B6B6202000
|
unkown
|
page read and write
|
|
|
|
1D176978000
|
unkown
|
page read and write
|
|
|
|
15FEF5FA000
|
unkown
|
page read and write
|
|
|
|
3170000
|
unkown
|
page readonly
|
|
|
|
D55679000
|
unkown
|
page read and write
|
|
|
|
C00000
|
unkown
|
page readonly
|
|
|
|
227E1A6A000
|
unkown
|
page read and write
|
|
|
|
7FF4EE501000
|
unkown
|
page readonly
|
|
|
|
361D000
|
unkown
|
page read and write
|
|
|
|
7FF5B4B10000
|
unkown
|
page readonly
|
|
|
|
7FF4F935C000
|
unkown
|
page readonly
|
|
|
|
1D17695A000
|
unkown
|
page read and write
|
|
|
|
1D176E02000
|
unkown
|
page read and write
|
|
|
|
6184000
|
heap private
|
page read and write
|
|
|
|
7FF54BE98000
|
unkown
|
page readonly
|
|
|
|
15FED4A4000
|
unkown
|
page read and write
|
|
|
|
79677C000
|
unkown
|
page read and write
|
|
|
|
F4A000
|
heap default
|
page read and write
|
|
|
|
4D27FFB000
|
unkown
|
page read and write
|
|
|
|
7FF4F6156000
|
unkown
|
page readonly
|
|
|
|
1EF0E86B000
|
unkown
|
page read and write
|
|
|
|
4D27679000
|
unkown
|
page read and write
|
|
|
|
1643B2A0000
|
unkown
|
page readonly
|
|
|
|
1643ABF0000
|
unkown
|
page readonly
|
|
|
|
2E2A000
|
unkown
|
page readonly
|
|
|
|
E60000
|
heap private
|
page read and write
|
|
|
|
1643AB10000
|
unkown
|
page readonly
|
|
|
|
227E18E0000
|
heap private
|
page read and write
|
|
|
|
1D176983000
|
unkown
|
page read and write
|
|
|
|
7FF597F80000
|
unkown
|
page readonly
|
|
|
|
14F8B442000
|
unkown
|
page read and write
|
|
|
|
1D176976000
|
unkown
|
page read and write
|
|
|
|
1D17698F000
|
unkown
|
page read and write
|
|
|
|
227E1A02000
|
unkown
|
page read and write
|
|
|
|
7FF5E7706000
|
unkown
|
page readonly
|
|
|
|
1D17698B000
|
unkown
|
page read and write
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
7FF5B4B16000
|
unkown
|
page readonly
|
|
|
|
7FF597FE8000
|
unkown
|
page readonly
|
|
|
|
7FF54C0CB000
|
unkown
|
page readonly
|
|
|
|
7FF54B9C1000
|
unkown
|
page readonly
|
|
|
|
227E1B00000
|
unkown
|
page read and write
|
|
|
|
A4F000
|
unkown
|
page read and write
|
|
|
|
7FF5E760F000
|
unkown
|
page readonly
|
|
|
|
2E60000
|
unkown
|
page readonly
|
|
|
|
7FF5B4F87000
|
unkown
|
page readonly
|
|
|
|
1B6B5D13000
|
unkown
|
page read and write
|
|
|
|
1D17603C000
|
unkown
|
page read and write
|
|
|
|
2F23000
|
unkown
|
page readonly
|
|
|
|
840D55B000
|
unkown
|
page read and write
|
|
|
|
15FF0710000
|
unkown
|
page read and write
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
1D176925000
|
unkown
|
page read and write
|
|
|
|
7FF4F939E000
|
unkown
|
page readonly
|
|
|
|
69A0000
|
unkown
|
page read and write
|
|
|
|
4D2777A000
|
unkown
|
page read and write
|
|
|
|
7FF5B4FB8000
|
unkown
|
page readonly
|
|
|
|
7FF4F927D000
|
unkown
|
page readonly
|
|
|
|
1D176988000
|
unkown
|
page read and write
|
|
|
|
7FF54C131000
|
unkown
|
page readonly
|
|
|
|
7FF4F9335000
|
unkown
|
page readonly
|
|
|
|
7FF507074000
|
unkown
|
page readonly
|
|
|
|
F82000
|
unkown
|
page read and write
|
|
|
|
7FF54C1B2000
|
unkown
|
page readonly
|
|
|
|
7FF5E7617000
|
unkown
|
page readonly
|
|
|
|
7FF505CAA000
|
unkown
|
page readonly
|
|
|
|
1D176979000
|
unkown
|
page read and write
|
|
|
|
2062B600000
|
unkown
|
page readonly
|
|
|
|
7FF4F9181000
|
unkown
|
page readonly
|
|
|
|
1D176928000
|
unkown
|
page read and write
|
|
|
|
1B6B5C13000
|
unkown
|
page read and write
|
|
|
|
1EF0E86B000
|
unkown
|
page read and write
|
|
|
|
15FEF882000
|
unkown
|
page read and write
|
|
|
|
7FF5B5034000
|
unkown
|
page readonly
|
|
|
|
15FED4A7000
|
unkown
|
page read and write
|
|
|
|
7FF4F93A9000
|
unkown
|
page readonly
|
|
|
|
1643AC72000
|
unkown
|
page read and write
|
|
|
|
1F869900000
|
unkown
|
page read and write
|
|
|
|
1D175F70000
|
unkown
|
page readonly
|
|
|
|
7FF5E79B6000
|
unkown
|
page readonly
|
|
|
|
7FF4F6482000
|
unkown
|
page readonly
|
|
|
|
1EF0E86B000
|
unkown
|
page read and write
|
|
|
|
15FEF517000
|
unkown
|
page read and write
|
|
|
|
7FF4F6474000
|
unkown
|
page readonly
|
|
|
|
795F5C000
|
unkown
|
page read and write
|
|
|
|
227E1B13000
|
unkown
|
page read and write
|
|
|
|
15FED800000
|
unkown
|
page readonly
|
|
|
|
2D6A2742000
|
heap default
|
page read and write
|
|
|
|
15FED4A5000
|
unkown
|
page read and write
|
|
|
|
7FF4EE2EA000
|
unkown
|
page readonly
|
|
|
|
7FF54C062000
|
unkown
|
page readonly
|
|
|
|
7FF55F214000
|
unkown
|
page readonly
|
|
|
|
4D27DFA000
|
unkown
|
page read and write
|
|
|
|
1B6B5A10000
|
unkown
|
page readonly
|
|
|
|
49693F7000
|
unkown
|
page read and write
|
|
|
|
7FF505C65000
|
unkown
|
page readonly
|
|
|
|
3180000
|
unkown
|
page readonly
|
|
|
|
7FF4EE2EF000
|
unkown
|
page readonly
|
|
|
|
15FF0000000
|
unkown
|
page read and write
|
|
|
|
2E53000
|
unkown
|
page readonly
|
|
|
|
7FF505C8C000
|
unkown
|
page readonly
|
|
|
|
7FF55F32D000
|
unkown
|
page readonly
|
|
|
|
7FF505C34000
|
unkown
|
page readonly
|
|
|
|
2062D2B0000
|
unkown
|
page read and write
|
|
|
|
1D17693D000
|
unkown
|
page read and write
|
|
|
|
15FF0610000
|
unkown
|
page read and write
|
|
|
|
D554FE000
|
unkown
|
page read and write
|
|
|
|
7FF5B4DF3000
|
unkown
|
page readonly
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
1D176000000
|
unkown
|
page read and write
|
|
|
|
D5547B000
|
unkown
|
page read and write
|
|
|
|
1EF0E854000
|
unkown
|
page read and write
|
|
|
|
7FF4F937A000
|
unkown
|
page readonly
|
|
|
|
7FF505C77000
|
unkown
|
page readonly
|
|
|
|
2E45000
|
unkown
|
page readonly
|
|
|
|
7FF4F933B000
|
unkown
|
page readonly
|
|
|
|
1D1769C9000
|
unkown
|
page read and write
|
|
|
|
E34C08A000
|
unkown
|
page read and write
|
|
|
|
1D176969000
|
unkown
|
page read and write
|
|
|
|
1D176A00000
|
unkown
|
page readonly
|
|
|
|
1F869813000
|
unkown
|
page read and write
|
|
|
|
7FF4F6401000
|
unkown
|
page readonly
|
|
|
|
7FF505CBF000
|
unkown
|
page readonly
|
|
|
|
15FEF612000
|
unkown
|
page read and write
|
|
|
|
7FF55F2F4000
|
unkown
|
page readonly
|
|
|
|
2062B413000
|
unkown
|
page read and write
|
|
|
|
1D176102000
|
unkown
|
page read and write
|
|
|
|
665F000
|
unkown
|
page read and write
|
|
|
|
1510AFE000
|
unkown
|
page read and write
|
|
|
|
1F869913000
|
unkown
|
page read and write
|
|
|
|
F69000
|
unkown
|
page read and write
|
|
|
|
7FF50704F000
|
unkown
|
page readonly
|
|
|
|
15FED468000
|
unkown
|
page read and write
|
|
|
|
7FF4EE69D000
|
unkown
|
page readonly
|
|
|
|
1D176951000
|
unkown
|
page read and write
|
|
|
|
1F869849000
|
unkown
|
page read and write
|
|
|
|
1D176108000
|
unkown
|
page read and write
|
|
|
|
2062B402000
|
unkown
|
page read and write
|
|
|
|
7FF505B63000
|
unkown
|
page readonly
|
|
|
|
7FF5E7957000
|
unkown
|
page readonly
|
|
|
|
1D17693F000
|
unkown
|
page read and write
|
|
|
|
F40000
|
heap default
|
page read and write
|
|
|
|
1D17604F000
|
unkown
|
page read and write
|
|
|
|
15FED455000
|
unkown
|
page read and write
|
|
|
|
7FF505D4A000
|
unkown
|
page readonly
|
|
|
|
7FF5B4F9A000
|
unkown
|
page readonly
|
|
|
|
7FF55F39A000
|
unkown
|
page readonly
|
|
|
|
7FF5E79BD000
|
unkown
|
page readonly
|
|
|
|
7FF5B4F55000
|
unkown
|
page readonly
|
|
|
|
7FF5057C2000
|
unkown
|
page readonly
|
|
|
|
1D176916000
|
unkown
|
page read and write
|
|
|
|
7FF54BE9F000
|
unkown
|
page readonly
|
|
|
|
1D17604A000
|
unkown
|
page read and write
|
|
|
|
15FEF566000
|
unkown
|
page read and write
|
|
|
|
1D176979000
|
unkown
|
page read and write
|
|
|
|
7FF5E793A000
|
unkown
|
page readonly
|
|
|
|
7FF4EE674000
|
unkown
|
page readonly
|
|
|
|
3639000
|
unkown
|
page read and write
|
|
|
|
7FF5B4C29000
|
unkown
|
page readonly
|
|
|
|
2E77000
|
unkown
|
page readonly
|
|
|
|
7FF54B91D000
|
unkown
|
page readonly
|
|
|
|
15FEF783000
|
unkown
|
page read and write
|
|
|
|
7FF4F63A7000
|
unkown
|
page readonly
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
1D176924000
|
unkown
|
page read and write
|
|
|
|
7FF5E796F000
|
unkown
|
page readonly
|
|
|
|
3400000
|
unkown
|
page readonly
|
|
|
|
7FF505B5B000
|
unkown
|
page readonly
|
|
|
|
3615000
|
unkown
|
page read and write
|
|
|
|
1D176999000
|
unkown
|
page read and write
|
|
|
|
7FF597C3C000
|
unkown
|
page readonly
|
|
|
|
E34C47A000
|
unkown
|
page read and write
|
|
|
|
1D176070000
|
unkown
|
page read and write
|
|
|
|
DC0000
|
unkown
|
page read and write
|
|
|
|
7FF5E78E0000
|
unkown
|
page readonly
|
|
|
|
7FF4F640D000
|
unkown
|
page readonly
|
|
|
|
7FF505C00000
|
unkown
|
page readonly
|
|
|
|
F90000
|
unkown
|
page readonly
|
|
|
|
2062B502000
|
unkown
|
page read and write
|
|
|
|
1D1762D0000
|
unkown
|
page readonly
|
|
|
|
7FF5E7848000
|
unkown
|
page readonly
|
|
|
|
227E3470000
|
unkown
|
page read and write
|
|
|
|
7FF54BFA1000
|
unkown
|
page readonly
|
|
|
|
7FF5B5041000
|
unkown
|
page readonly
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
31C4000
|
heap private
|
page read and write
|
|
|
|
1D176975000
|
unkown
|
page read and write
|
|
|
|
7FF4F935F000
|
unkown
|
page readonly
|
|
|
|
1000FE000
|
unkown
|
page read and write
|
|
|
|
7FF50708E000
|
unkown
|
page readonly
|
|
|
|
7FF5B4FCD000
|
unkown
|
page readonly
|
|
|
|
7FF54C1AA000
|
unkown
|
page readonly
|
|
|
|
15FF0110000
|
unkown
|
page read and write
|
|
|
|
7FF5B503A000
|
unkown
|
page readonly
|
|
|
|
7FF5055B3000
|
unkown
|
page readonly
|
|
|
|
5DD4E79000
|
unkown
|
page read and write
|
|
|
|
15FEF595000
|
unkown
|
page read and write
|
|
|
|
3190000
|
unkown
|
page read and write
|
|
|
|
7FF4F63DA000
|
unkown
|
page readonly
|
|
|
|
7FF597D3B000
|
unkown
|
page readonly
|
|
|
|
7FF55F304000
|
unkown
|
page readonly
|
|
|
|
7FF4EE704000
|
unkown
|
page readonly
|
|
|
|
1D176049000
|
unkown
|
page read and write
|
|
|
|
7FF597C4A000
|
unkown
|
page readonly
|
|
|
|
2E60000
|
unkown
|
page readonly
|
|
|
|
7FF505A96000
|
unkown
|
page readonly
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
1D176952000
|
unkown
|
page read and write
|
|
|
|
1EF0EAD0000
|
unkown
|
page readonly
|
|
|
|
4968D0B000
|
unkown
|
page read and write
|
|
|
|
E4F000
|
unkown
|
page read and write
|
|
|
|
7FF4EE688000
|
unkown
|
page readonly
|
|
|
|
F89000
|
unkown
|
page read and write
|
|
|
|
1130000
|
unkown
|
page read and write
|
|
|
|
7FF4F638A000
|
unkown
|
page readonly
|
|
|
|
7FF4F932E000
|
unkown
|
page readonly
|
|
|
|
14F8B340000
|
heap default
|
page read and write
|
|
|
|
4969A7E000
|
unkown
|
page read and write
|
|
|
|
1D176790000
|
unkown
|
page read and write
|
|
|
|
7FF55F1AE000
|
unkown
|
page readonly
|
|
|
|
15FED581000
|
unkown
|
page read and write
|
|
|
|
5DD4CFA000
|
unkown
|
page read and write
|
|
|
|
4D2817C000
|
unkown
|
page read and write
|
|
|
|
7FF4F6481000
|
unkown
|
page readonly
|
|
|
|
1080000
|
unkown
|
page readonly
|
|
|
|
15FED502000
|
unkown
|
page read and write
|
|
|
|
7FF5E79A8000
|
unkown
|
page readonly
|
|
|
|
94B000
|
unkown
|
page read and write
|
|
|
|
2EA2000
|
unkown
|
page readonly
|
|
|
|
7FF505CC8000
|
unkown
|
page readonly
|
|
|
|
15FEF538000
|
unkown
|
page read and write
|
|
|
|
2B93000
|
unkown
|
page readonly
|
|
|
|
227E1A13000
|
unkown
|
page read and write
|
|
|
|
7FF54BEF4000
|
unkown
|
page readonly
|
|
|
|
7FF597FF1000
|
unkown
|
page readonly
|
|
|
|
7FF55F2FA000
|
unkown
|
page readonly
|
|
|
|
7FF5E796C000
|
unkown
|
page readonly
|
|
|
|
7FF4F9414000
|
unkown
|
page readonly
|
|
|
|
7FF55F29C000
|
unkown
|
page readonly
|
|
|
|
7FF505CD9000
|
unkown
|
page readonly
|
|
|
|
7FF505B0A000
|
unkown
|
page readonly
|
|
|
|
2062B472000
|
unkown
|
page read and write
|
|
|
|
1F86A200000
|
unkown
|
page readonly
|
|
|
|
7FF54C1A4000
|
unkown
|
page readonly
|
|
|
|
1F869760000
|
unkown
|
page read and write
|
|
|
|
10017E000
|
unkown
|
page read and write
|
|
|
|
1510CFF000
|
unkown
|
page read and write
|
|
|
|
2EA6000
|
unkown
|
page readonly
|
|
|
|
2D6A2840000
|
unkown
|
page readonly
|
|
|
|
15FEF5E5000
|
unkown
|
page read and write
|
|
|
|
361D000
|
unkown
|
page read and write
|
|
|
|
7FF598072000
|
unkown
|
page readonly
|
|
|
|
CE0000
|
unkown
|
page readonly
|
|
|
|
15FEF5EF000
|
unkown
|
page read and write
|
|
|
|
1D176930000
|
unkown
|
page read and write
|
|
|
|
15FEF743000
|
unkown
|
page read and write
|
|
|
|
7FF54BD8A000
|
unkown
|
page readonly
|
|
|
|
350A000
|
heap private
|
page read and write
|
|
|
|
7FF55F3A1000
|
unkown
|
page readonly
|
|
|
|
2E8F000
|
unkown
|
page readonly
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
1D176950000
|
unkown
|
page read and write
|
|
|
|
36F0000
|
unkown
|
page readonly
|
|
|
|
2D6A271B000
|
heap default
|
page read and write
|
|
|
|
3310000
|
unkown
|
page read and write
|
|
|
|
7FF507104000
|
unkown
|
page readonly
|
|
|
|
1D176946000
|
unkown
|
page read and write
|
|
|
|
4D27C7B000
|
unkown
|
page read and write
|
|
|
|
F6D000
|
unkown
|
page read and write
|
|
|
|
2D6A26E0000
|
unkown
|
page read and write
|
|
|
|
7FF55F329000
|
unkown
|
page readonly
|
|
|
|
7FF597FF9000
|
unkown
|
page readonly
|
|
|
|
15FF0410000
|
unkown
|
page read and write
|
|
|
|
7FF59806A000
|
unkown
|
page readonly
|
|
|
|
2E77000
|
unkown
|
page readonly
|
|
|
|
2E69000
|
unkown
|
page readonly
|
|
|
|
15FEF514000
|
unkown
|
page read and write
|
|
|
|
15FED400000
|
unkown
|
page read and write
|
|
|
|
1643AD08000
|
unkown
|
page read and write
|
|
|
|
7FF4F9294000
|
unkown
|
page readonly
|
|
|
|
7FF55EE85000
|
unkown
|
page readonly
|
|
|
|
7FF5B4FAF000
|
unkown
|
page readonly
|
|
|
|
7FF597DA1000
|
unkown
|
page readonly
|
|
|
|
1D176780000
|
unkown
|
page read and write
|
|
|
|
7FF54BFC8000
|
unkown
|
page readonly
|
|
|
|
15FED45A000
|
unkown
|
page read and write
|
|
|
|
2D6A274F000
|
unkown
|
page read and write
|
|
|
|
1B6B5C02000
|
unkown
|
page read and write
|
|
|
|
4D27CFD000
|
unkown
|
page read and write
|
|
|
|
1B6B5C4F000
|
unkown
|
page read and write
|
|
|
|
14F8B455000
|
unkown
|
page read and write
|
|
|
|
3615000
|
unkown
|
page read and write
|
|
|
|
4D27EFB000
|
unkown
|
page read and write
|
|
|
|
7FF597F7E000
|
unkown
|
page readonly
|
|
|
|
15FF0410000
|
unkown
|
page read and write
|
|
|
|
1D1767A0000
|
unkown
|
page readonly
|
|
|
|
1D176988000
|
unkown
|
page read and write
|
|
|
|
330C000
|
unkown
|
page read and write
|
|
|
|
7FF4F6409000
|
unkown
|
page readonly
|
|
|
|
4D279FB000
|
unkown
|
page read and write
|
|
|
|
2D6A2830000
|
unkown
|
page readonly
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
14F8B413000
|
unkown
|
page read and write
|
|
|
|
15FED4EC000
|
unkown
|
page read and write
|
|
|
|
1F86983C000
|
unkown
|
page read and write
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
6050000
|
unkown
|
page read and write
|
|
|
|
15FEF2A0000
|
unkown
|
page read and write
|
|
|
|
1D176961000
|
unkown
|
page read and write
|
|
|
|
15FEF54E000
|
unkown
|
page read and write
|
|
|
|
7FF54C12E000
|
unkown
|
page readonly
|
|
|
|
1B6B5C29000
|
unkown
|
page read and write
|
|
|
|
7FF4EE67E000
|
unkown
|
page readonly
|
|
|
|
2EA6000
|
unkown
|
page readonly
|
|
|
|
2D6A274E000
|
unkown
|
page read and write
|
|
|
|
7FF55F191000
|
unkown
|
page readonly
|
|
|
|
7FF5B4F94000
|
unkown
|
page readonly
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
98B000
|
unkown
|
page read and write
|
|
|
|
1D17693D000
|
unkown
|
page read and write
|
|
|
|
D40000
|
heap default
|
page read and write
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
1D176956000
|
unkown
|
page read and write
|
|
|
|
7FF4F5BED000
|
unkown
|
page readonly
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
4D280FA000
|
unkown
|
page read and write
|
|
|
|
7FF5E7A2A000
|
unkown
|
page readonly
|
|
|
|
10A0000
|
heap default
|
page read and write
|
|
|
|
7FF54BD7C000
|
unkown
|
page readonly
|
|
|
|
4D27B7B000
|
unkown
|
page read and write
|
|
|
|
6180000
|
heap private
|
page read and write
|
|
|
|
7FF4F93AD000
|
unkown
|
page readonly
|
|
|
|
E50000
|
unkown
|
page read and write
|
|
|
|
1643B260000
|
unkown
|
page read and write
|
|
|
|
7FF597F7A000
|
unkown
|
page readonly
|
|
|
|
1D17604B000
|
unkown
|
page read and write
|
|
|
|
1D17693F000
|
unkown
|
page read and write
|
|
|
|
1F86A540000
|
unkown
|
page readonly
|
|
|
|
7FF55F101000
|
unkown
|
page readonly
|
|
|
|
7FF54BF19000
|
unkown
|
page readonly
|
|
|
|
7FF505B41000
|
unkown
|
page readonly
|
|
|
|
15FED270000
|
heap private
|
page read and write
|
|
|
|
2062B470000
|
unkown
|
page read and write
|
|
|
|
F69000
|
unkown
|
page read and write
|
|
|
|
15FEF5AE000
|
unkown
|
page read and write
|
|
|
|
2E5C000
|
unkown
|
page readonly
|
|
|
|
1D176E02000
|
unkown
|
page read and write
|
|
|
|
7FF5E7843000
|
unkown
|
page readonly
|
|
|
|
7FF50704C000
|
unkown
|
page readonly
|
|
|
|
7FF597FB8000
|
unkown
|
page readonly
|
|
|
|
1D176E00000
|
unkown
|
page read and write
|
|
|
|
E6A000
|
heap private
|
page read and write
|
|
|
|
1643AD02000
|
unkown
|
page read and write
|
|
|
|
7FF597FEE000
|
unkown
|
page readonly
|
|
|
|
27B5DEB000
|
unkown
|
page read and write
|
|
|
|
15FED4A6000
|
unkown
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
7FF507020000
|
unkown
|
page readonly
|
|
|
|
7FF5E79B1000
|
unkown
|
page readonly
|
|
|
|
1D176200000
|
unkown
|
page readonly
|
|
|
|
4D277FF000
|
unkown
|
page read and write
|
|
|
|
1F869750000
|
unkown
|
page readonly
|
|
|
|
31A0000
|
unkown
|
page read and write
|
|
|
|
2F23000
|
unkown
|
page readonly
|
|
|
|
7FF4F6067000
|
unkown
|
page readonly
|
|
|
|
2E23000
|
unkown
|
page readonly
|
|
|
|
1090000
|
unkown
|
page readonly
|
|
|
|
2EF5000
|
unkown
|
page readonly
|
|
|
|
7FF597DA5000
|
unkown
|
page readonly
|
|
|
|
49695F8000
|
unkown
|
page read and write
|
|
|
|
E34C57F000
|
unkown
|
page read and write
|
|
|
|
1F869902000
|
unkown
|
page read and write
|
|
|
|
2062B442000
|
unkown
|
page read and write
|
|
|
|
4D276FE000
|
unkown
|
page read and write
|
|
|
|
7FF505BCC000
|
unkown
|
page readonly
|
|
|
|
7FF55F2AE000
|
unkown
|
page readonly
|
|
|
|
7FF5B4FC6000
|
unkown
|
page readonly
|
|
|
|
7FF4F6332000
|
unkown
|
page readonly
|
|
|
|
7FF55F2B5000
|
unkown
|
page readonly
|
|
|
|
14F8B402000
|
unkown
|
page read and write
|
|
|
|
4D2797B000
|
unkown
|
page read and write
|
|
|
|
7FF4F63C8000
|
unkown
|
page readonly
|
|
|
|
227E3570000
|
unkown
|
page readonly
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
2062B46E000
|
unkown
|
page read and write
|
|
|
|
1643AC7B000
|
unkown
|
page read and write
|
|
|
|
7FF5E7765000
|
unkown
|
page readonly
|
|
|
|
1B6B5AE0000
|
unkown
|
page readonly
|
|
|
|
7FF54C05C000
|
unkown
|
page readonly
|
|
|
|
1D17698E000
|
unkown
|
page read and write
|
|
|
|
7FF55F3A2000
|
unkown
|
page readonly
|
|
|
|
7FF4F9384000
|
unkown
|
page readonly
|
|
|
|
7FF5E793E000
|
unkown
|
page readonly
|
|
|
|
7FF505C60000
|
unkown
|
page readonly
|
|
|
|
1EF0E813000
|
unkown
|
page read and write
|
|
|
|
2062B46F000
|
unkown
|
page read and write
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
7FF4F61B5000
|
unkown
|
page readonly
|
|
|
|
7FF5E78E2000
|
unkown
|
page readonly
|
|
|
|
2062B46D000
|
unkown
|
page read and write
|
|
|
|
7FF505D52000
|
unkown
|
page readonly
|
|
|
|
227E1A5A000
|
unkown
|
page read and write
|
|
|
|
27B62FB000
|
unkown
|
page read and write
|
|
|
|
DB0000
|
unkown
|
page readonly
|
|
|
|
7FF4F90A7000
|
unkown
|
page readonly
|
|
|
|
1D1760F9000
|
unkown
|
page read and write
|
|
|
|
7FF55F21C000
|
unkown
|
page readonly
|
|
|
|
4D273FF000
|
unkown
|
page read and write
|
|
|
|
1B6B6400000
|
unkown
|
page readonly
|
|
|
|
15FED4DC000
|
unkown
|
page read and write
|
|
|
|
1D176943000
|
unkown
|
page read and write
|
|
|
|
7FF4F638E000
|
unkown
|
page readonly
|
|
|
|
2D6A2721000
|
unkown
|
page read and write
|
|
|
|
15FEF2A0000
|
unkown
|
page read and write
|
|
|
|
7FF5B4FA4000
|
unkown
|
page readonly
|
|
|
|
15FEF569000
|
unkown
|
page read and write
|
|
|
|
2E23000
|
unkown
|
page readonly
|
|
|
|
27B637F000
|
unkown
|
page read and write
|
|
|
|
7FF4EE64C000
|
unkown
|
page readonly
|
|
|
|
7FF4F63BC000
|
unkown
|
page readonly
|
|
|
|
15FED531000
|
unkown
|
page read and write
|
|
|
|
7FF505C6B000
|
unkown
|
page readonly
|
|
|
|
1D176988000
|
unkown
|
page read and write
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
2F18000
|
unkown
|
page readonly
|
|
|
|
2E5C000
|
unkown
|
page readonly
|
|
|
|
7FF4EE523000
|
unkown
|
page readonly
|
|
|
|
7FF54BEE5000
|
unkown
|
page readonly
|
|
|
|
15FEFA00000
|
unkown
|
page readonly
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
1D17693D000
|
unkown
|
page read and write
|
|
|
|
7FF4EE51B000
|
unkown
|
page readonly
|
|
|
|
1D176988000
|
unkown
|
page read and write
|
|
|
|
7FF5E7994000
|
unkown
|
page readonly
|
|
|
|
2062B500000
|
unkown
|
page read and write
|
|
|
|
4D2787B000
|
unkown
|
page read and write
|
|
|
|
7FF5E7984000
|
unkown
|
page readonly
|
|
|
|
31C0000
|
heap private
|
page read and write
|
|
|
|
1EF10270000
|
unkown
|
page read and write
|
|
|
|
7FF4F922B000
|
unkown
|
page readonly
|
|
|
|
1D17693D000
|
unkown
|
page read and write
|
|
|
|
F6E000
|
unkown
|
page read and write
|
|
|
|
7FF5E79AE000
|
unkown
|
page readonly
|
|
|
|
7FF4EE61A000
|
unkown
|
page readonly
|
|
|
|
1D17697C000
|
unkown
|
page read and write
|
|
|
|
1EF0E86F000
|
unkown
|
page read and write
|
|
|
|
7FF505561000
|
unkown
|
page readonly
|
|
|
|
7FF505C5E000
|
unkown
|
page readonly
|
|
|
|
1F86984B000
|
unkown
|
page read and write
|
|
|
|
7FF54BFC3000
|
unkown
|
page readonly
|
|
|
|
7FF4F9347000
|
unkown
|
page readonly
|
|
|
|
15FEF5C5000
|
unkown
|
page read and write
|
|
|
|
1643AC4F000
|
unkown
|
page read and write
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
227E1B02000
|
unkown
|
page read and write
|
|
|
|
7FF4EE3E6000
|
unkown
|
page readonly
|
|
|
|
7FF55F153000
|
unkown
|
page readonly
|
|
|
|
1D176988000
|
unkown
|
page read and write
|
|
|
|
7FF4F932A000
|
unkown
|
page readonly
|
|
|
|
2D6A271D000
|
heap default
|
page read and write
|
|
|
|
15FED600000
|
unkown
|
page readonly
|
|
|
|
7FF5B4F3A000
|
unkown
|
page readonly
|
|
|
|
14F8CE70000
|
unkown
|
page read and write
|
|
|
|
7FF54BF01000
|
unkown
|
page readonly
|
|
|
|
7FF505B03000
|
unkown
|
page readonly
|
|
|
|
7FF55F2C7000
|
unkown
|
page readonly
|
|
|
|
F89000
|
unkown
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
7FF4F6271000
|
unkown
|
page readonly
|
|
|
|
4D27A7A000
|
unkown
|
page read and write
|
|
|
|
F6A000
|
unkown
|
page read and write
|
|
|
|
7FF505AB1000
|
unkown
|
page readonly
|
|
|
|
1EF0E86B000
|
unkown
|
page read and write
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
4D27BFB000
|
unkown
|
page read and write
|
|
|
|
1D176E54000
|
unkown
|
page read and write
|
|
|
|
2EF1000
|
unkown
|
page readonly
|
|
|
|
1F869888000
|
unkown
|
page read and write
|
|
|
|
7FF5E7A24000
|
unkown
|
page readonly
|
|
|
|
1D17693E000
|
unkown
|
page read and write
|
|
|
|
F6E000
|
unkown
|
page read and write
|
|
|
|
15FF0010000
|
unkown
|
page read and write
|
|
|
|
7FF4F9211000
|
unkown
|
page readonly
|
|
|
|
1EF0E800000
|
unkown
|
page read and write
|
|
|
|
7FF5B4E4B000
|
unkown
|
page readonly
|
|
|
|
2F04000
|
unkown
|
page readonly
|
|
|
|
7FF55F2AA000
|
unkown
|
page readonly
|
|
|
|
6190000
|
unkown
|
page readonly
|
|
|
|
7FF54C0D7000
|
unkown
|
page readonly
|
|
|
|
14F8B502000
|
unkown
|
page read and write
|
|
|
|
7FF597F85000
|
unkown
|
page readonly
|
|
|
|
7FF505D44000
|
unkown
|
page readonly
|
|
|
|
1D176924000
|
unkown
|
page read and write
|
|
|
|
1D176976000
|
unkown
|
page read and write
|
|
|
|
227E1A6A000
|
unkown
|
page read and write
|
|
|
|
7FF505835000
|
unkown
|
page readonly
|
|
|
|
15FEF58C000
|
unkown
|
page read and write
|
|
|
|
7FF507099000
|
unkown
|
page readonly
|
|
|
|
15FEF520000
|
unkown
|
page read and write
|
|
|
|
7FF505D51000
|
unkown
|
page readonly
|
|
|
|
7FF505AA1000
|
unkown
|
page readonly
|
|
|
|
15FEF2B0000
|
unkown
|
page read and write
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
15FED3B0000
|
unkown
|
page write copy
|
|
|
|
7FF597E7B000
|
unkown
|
page readonly
|
|
|
|
7FF5B4F5B000
|
unkown
|
page readonly
|
|
|
|
7FF597FFD000
|
unkown
|
page readonly
|
|
|
|
1D1760D0000
|
unkown
|
page read and write
|
|
|
|
7FF4EE620000
|
unkown
|
page readonly
|
|
|
|
10007B000
|
unkown
|
page read and write
|
|
|
|
7FF506977000
|
unkown
|
page readonly
|
|
|
|
2D6A2710000
|
heap default
|
page read and write
|
|
|
|
7FF505826000
|
unkown
|
page readonly
|
|
|
|
2E7D000
|
unkown
|
page readonly
|
|
|
|
1008FF000
|
unkown
|
page read and write
|
|
|
|
7FF4EE711000
|
unkown
|
page readonly
|
|
|
|
3619000
|
unkown
|
page read and write
|
|
|
|
227E1C00000
|
unkown
|
page readonly
|
|
|
|
7FF54BEE1000
|
unkown
|
page readonly
|
|
|
|
2B1E000
|
unkown
|
page readonly
|
|
|
|
15FEF528000
|
unkown
|
page read and write
|
|
|
|
7FF4F63EE000
|
unkown
|
page readonly
|
|
|
|
227E1A70000
|
unkown
|
page read and write
|
|
|
|
7FF505939000
|
unkown
|
page readonly
|
|
|
|
1D176983000
|
unkown
|
page read and write
|
|
|
|
1EF0E86F000
|
unkown
|
page read and write
|
|
|
|
27B667C000
|
unkown
|
page read and write
|
|
|
|
7FF5B4B25000
|
unkown
|
page readonly
|
|
|
|
7FF55F2E7000
|
unkown
|
page readonly
|
|
|
|
1D175F00000
|
heap private
|
page read and write
|
|
|
|
15FED4B7000
|
unkown
|
page read and write
|
|
|
|
1EF0E750000
|
unkown
|
page write copy
|
|
|
|
7FF5B4F7F000
|
unkown
|
page readonly
|
|
|
|
15FF0810000
|
unkown
|
page read and write
|
|
|
|
10EE000
|
unkown
|
page read and write
|
|
|
|
7FF4EE479000
|
unkown
|
page readonly
|
|
|
|
15FED571000
|
unkown
|
page read and write
|
|
|
|
1D176956000
|
unkown
|
page read and write
|
|
|
|
7FF54C128000
|
unkown
|
page readonly
|
|
|
|
1F869800000
|
unkown
|
page read and write
|
|
|
|
27B60FE000
|
unkown
|
page read and write
|
|
|
|
1B6B5D00000
|
unkown
|
page read and write
|
|
|
|
2E91000
|
unkown
|
page readonly
|
|
|
|
7FF5E7761000
|
unkown
|
page readonly
|
|
|
|
7FF505C3F000
|
unkown
|
page readonly
|
|
|
|
2D6A2960000
|
heap private
|
page read and write
|
|
|
|
1D176925000
|
unkown
|
page read and write
|
|
|
|
1D176947000
|
unkown
|
page read and write
|
|
|
|
7FF50710A000
|
unkown
|
page readonly
|
|
|
|
1D17693D000
|
unkown
|
page read and write
|
|
|
|
D555F9000
|
unkown
|
page read and write
|
|
|
|
1D176940000
|
unkown
|
page read and write
|
|
|
|
227E1A6A000
|
unkown
|
page read and write
|
|
|
|
1D1760A7000
|
unkown
|
page read and write
|
|
|
|
E34C5FD000
|
unkown
|
page read and write
|
|
|
|
1F86986F000
|
unkown
|
page read and write
|
|
|
|
7FF54C08B000
|
unkown
|
page readonly
|
|
|
|
361E000
|
unkown
|
page read and write
|
|
|
|
1D17694D000
|
unkown
|
page read and write
|
|
|
|
7FF54C0EC000
|
unkown
|
page readonly
|
|
|
|
840D87E000
|
unkown
|
page read and write
|
|
|
|
1D176929000
|
unkown
|
page read and write
|
|
|
|
1D176113000
|
unkown
|
page read and write
|
|
|
|
7FF5E783B000
|
unkown
|
page readonly
|
|
|
|
7FF5E76FB000
|
unkown
|
page readonly
|
|
|
|
7FF4EE664000
|
unkown
|
page readonly
|
|
|
|
661E000
|
unkown
|
page read and write
|
|
|
|
2062B300000
|
heap private
|
page read and write
|
|
|
|
1D176802000
|
unkown
|
page read and write
|
|
|
|
7FF5B4E9D000
|
unkown
|
page readonly
|
|
|
|
14F8CF70000
|
unkown
|
page readonly
|
|
|
|
795FDE000
|
unkown
|
page read and write
|
|
|
|
7FF5059D7000
|
unkown
|
page readonly
|
|
|
|
7FF55F394000
|
unkown
|
page readonly
|
|
|
|
7FF5E794B000
|
unkown
|
page readonly
|
|
|
|
1D1769B5000
|
unkown
|
page read and write
|
|
|
|
2F12000
|
unkown
|
page readonly
|
|
|
|
1EF0E86D000
|
unkown
|
page read and write
|
|
|
|
7FF5057D2000
|
unkown
|
page readonly
|
|
|
|
7FF4F63FE000
|
unkown
|
page readonly
|
|
|
|
7FF5E760A000
|
unkown
|
page readonly
|
|
|
|
1D176967000
|
unkown
|
page read and write
|
|
|
|
1D1760E9000
|
unkown
|
page read and write
|
|
|
|
7FF507112000
|
unkown
|
page readonly
|
|
|
|
1D176983000
|
unkown
|
page read and write
|
|
|
|
2E7F000
|
unkown
|
page readonly
|
|
|
|
7FF505C2F000
|
unkown
|
page readonly
|
|
|
|
15FEF5A6000
|
unkown
|
page read and write
|
|
|
|
2E83000
|
unkown
|
page readonly
|
|
|
|
1D175F60000
|
heap default
|
page read and write
|
|
|
|
227E1CD0000
|
unkown
|
page readonly
|
|
|
|
1D1760A8000
|
unkown
|
page read and write
|
|
There are 1231 hidden memdumps, click here to show them.