Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
banUwVSwBY.xlsx
|
Microsoft Excel 2007+
|
initial sample
|
||
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C23362E2-4535-4ED1-AA68-CA8EECC3E528
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E8405D4B.tif
|
TIFF image data, little-endian, direntries=19, height=1600, bps=53710, compression=LZW, PhotometricIntepretation=RGB, width=1600
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\DEC40000
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu
Jun 27 17:12:41 2019, mtime=Wed Jun 9 06:39:35 2021, atime=Wed Jun 9 06:39:35 2021, length=8192, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\banUwVSwBY.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 06:35:53
2020, mtime=Wed Jun 9 06:39:35 2021, atime=Wed Jun 9 06:39:35 2021, length=338451, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
|
Little-endian UTF-16 Unicode text, with CR line terminators
|
dropped
|
||
C:\Users\user\Desktop\AFC40000
|
data
|
dropped
|
||
C:\Users\user\Desktop\~$banUwVSwBY.xls
|
data
|
dropped
|
||
C:\Users\user\Desktop\~$banUwVSwBY.xlsx
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FC5BF66.tif
|
TIFF image data, little-endian, direntries=19, height=1600, bps=53710, compression=LZW, PhotometricIntepretation=RGB, width=1600
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\060F0000
|
data
|
dropped
|
||
C:\Users\user\Desktop\D60F0000
|
data
|
dropped
|
There are 4 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
|
||
C:\Windows\SysWOW64\regsvr32.exe
|
regsvr32 -s ..\Post.storg
|
||
C:\Windows\SysWOW64\regsvr32.exe
|
regsvr32 -s ..\Post.storg1
|
||
C:\Windows\SysWOW64\regsvr32.exe
|
regsvr32 -s ..\Post.storg2
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
||
C:\Windows\System32\regsvr32.exe
|
regsvr32 -s ..\Post.storg
|
||
C:\Windows\System32\regsvr32.exe
|
regsvr32 -s ..\Post.storg1
|
||
C:\Windows\System32\regsvr32.exe
|
regsvr32 -s ..\Post.storg2
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://api.diagnosticssdf.office.com
|
unknown
|
||
https://login.microsoftonline.com/
|
unknown
|
||
https://shell.suite.office.com:1443
|
unknown
|
||
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
|
unknown
|
||
https://autodiscover-s.outlook.com/
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
|
unknown
|
||
https://cdn.entity.
|
unknown
|
||
https://api.addins.omex.office.net/appinfo/query
|
unknown
|
||
https://clients.config.office.net/user/v1.0/tenantassociationkey
|
unknown
|
||
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
|
unknown
|
||
https://powerlift.acompli.net
|
unknown
|
||
https://rpsticket.partnerservices.getmicrosoftkey.com
|
unknown
|
||
https://lookup.onenote.com/lookup/geolocation/v1
|
unknown
|
||
https://cortana.ai
|
unknown
|
||
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://cloudfiles.onenote.com/upload.aspx
|
unknown
|
||
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://entitlement.diagnosticssdf.office.com
|
unknown
|
||
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
|
unknown
|
||
https://api.aadrm.com/
|
unknown
|
||
https://ofcrecsvcapi-int.azurewebsites.net/
|
unknown
|
||
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
|
unknown
|
||
https://api.microsoftstream.com/api/
|
unknown
|
||
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
|
unknown
|
||
https://cr.office.com
|
unknown
|
||
https://portal.office.com/account/?ref=ClientMeControl
|
unknown
|
||
https://ecs.office.com/config/v2/Office
|
unknown
|
||
https://graph.ppe.windows.net
|
unknown
|
||
https://res.getmicrosoftkey.com/api/redemptionevents
|
unknown
|
||
https://powerlift-frontdesk.acompli.net
|
unknown
|
||
https://tasks.office.com
|
unknown
|
||
https://officeci.azurewebsites.net/api/
|
unknown
|
||
https://sr.outlook.office.net/ws/speech/recognize/assistant/work
|
unknown
|
||
https://store.office.cn/addinstemplate
|
unknown
|
||
https://outlook.office.com/autosuggest/api/v1/init?cvid=
|
unknown
|
||
https://globaldisco.crm.dynamics.com
|
unknown
|
||
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://store.officeppe.com/addinstemplate
|
unknown
|
||
https://dev0-api.acompli.net/autodetect
|
unknown
|
||
https://www.odwebp.svc.ms
|
unknown
|
||
https://api.powerbi.com/v1.0/myorg/groups
|
unknown
|
||
https://web.microsoftstream.com/video/
|
unknown
|
||
https://graph.windows.net
|
unknown
|
||
https://dataservice.o365filtering.com/
|
unknown
|
||
https://officesetup.getmicrosoftkey.com
|
unknown
|
||
https://analysis.windows.net/powerbi/api
|
unknown
|
||
http://190.14.37.134/44356.4024921296.dat
|
190.14.37.134
|
||
https://prod-global-autodetect.acompli.net/autodetect
|
unknown
|
||
https://outlook.office365.com/autodiscover/autodiscover.json
|
unknown
|
||
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
|
unknown
|
||
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
|
unknown
|
||
https://ncus.contentsync.
|
unknown
|
||
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
|
unknown
|
||
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
|
unknown
|
||
http://weather.service.msn.com/data.aspx
|
unknown
|
||
https://apis.live.net/v5.0/
|
unknown
|
||
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
|
unknown
|
||
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
|
unknown
|
||
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
|
unknown
|
||
https://management.azure.com
|
unknown
|
||
https://wus2.contentsync.
|
unknown
|
||
https://incidents.diagnostics.office.com
|
unknown
|
||
https://clients.config.office.net/user/v1.0/ios
|
unknown
|
||
https://insertmedia.bing.office.net/odc/insertmedia
|
unknown
|
||
https://o365auditrealtimeingestion.manage.office.com
|
unknown
|
||
https://outlook.office365.com/api/v1.0/me/Activities
|
unknown
|
||
https://api.office.net
|
unknown
|
||
https://incidents.diagnosticssdf.office.com
|
unknown
|
||
https://asgsmsproxyapi.azurewebsites.net/
|
unknown
|
||
https://clients.config.office.net/user/v1.0/android/policies
|
unknown
|
||
https://entitlement.diagnostics.office.com
|
unknown
|
||
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
|
unknown
|
||
https://outlook.office.com/
|
unknown
|
||
https://storage.live.com/clientlogs/uploadlocation
|
unknown
|
||
https://templatelogging.office.com/client/log
|
unknown
|
||
https://outlook.office365.com/
|
unknown
|
||
https://webshell.suite.office.com
|
unknown
|
||
http://51.89.115.124/44356.4024921296.dat
|
51.89.115.124
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
|
unknown
|
||
https://management.azure.com/
|
unknown
|
||
https://login.windows.net/common/oauth2/authorize
|
unknown
|
||
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://graph.windows.net/
|
unknown
|
||
https://api.powerbi.com/beta/myorg/imports
|
unknown
|
||
https://devnull.onenote.com
|
unknown
|
||
https://ncus.pagecontentsync.
|
unknown
|
||
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
|
unknown
|
||
https://messaging.office.com/
|
unknown
|
||
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://augloop.office.com/v2
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
|
unknown
|
||
https://skyapi.live.net/Activity/
|
unknown
|
||
https://clients.config.office.net/user/v1.0/mac
|
unknown
|
||
https://dataservice.o365filtering.com
|
unknown
|
||
https://api.cortana.ai
|
unknown
|
||
https://onedrive.live.com
|
unknown
|
||
https://ovisualuiapp.azurewebsites.net/pbiagave/
|
unknown
|
||
https://visio.uservoice.com/forums/368202-visio-on-devices
|
unknown
|
||
https://directory.services.
|
unknown
|
||
http://51.89.115.124/44356.3971392361.dat
|
51.89.115.124
|
||
http://190.14.37.134/44356.3971392361.dat
|
190.14.37.134
|
||
http://servername/isapibackend.dll
|
unknown
|
There are 93 hidden URLs, click here to show them.
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
190.14.37.134
|
unknown
|
Panama
|
||
51.89.115.124
|
unknown
|
France
|
||
37.1.196.25
|
unknown
|
Ukraine
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
f;
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
g;
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
RemoteClearDate
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
Last
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
FilePath
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
StartDate
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
EndDate
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
Properties
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
Url
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastClean
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableWinHttpCertAuth
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableIsOwnerRegex
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableSessionAwareHttpClose
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableADALForExtendedApps
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DisableADALSetSilentAuth
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
msoridDisableGuestCredProvider
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
msoridDisableOstringReplace
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastBootTime
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ReviewToken
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4B709
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
VBAFiles
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
MSForms
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
MSComctlLib
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
1
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
UpdateComplete
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DefaultSheetR2L
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
UseSystemSeparators
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ThousandsSeparator
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
DecimalSeparator
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4BF36
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4C0CD
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4C282
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4C3E9
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4C570
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4C6D7
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4C85E
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4CA23
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4CB8B
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4CCE2
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4CE3A
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4CF34
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
4CFFF
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
:|
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
5FD92
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
5FFE4
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
FileFormatBallotBoxAppIDBootedOnce
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
en-US
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
en-US
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
EXCELFiles
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
RoamingConfigurableSettings
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
RoamingLastSyncTime
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
RoamingLastWriteTime
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
CacheReady
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastRequest
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
CacheReady
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastUpdate
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
NextUpdate
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastBootTime
|
||
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
LastPurgeTime
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
md8
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
MTTT
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ReviewToken
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EF834
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
VBAFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DefaultSheetR2L
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
UseSystemSeparators
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ThousandsSeparator
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DecimalSeparator
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EFCE5
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EFDDF
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EFEAA
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EFFA3
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F009D
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F0158
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F0252
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F031C
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F03E7
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F04B2
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F05AC
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F0676
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F0741
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
{w8
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
LastPurgeTime
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1013FE
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1016BC
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EXCELFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SavedLegacySettings
|
There are 177 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
7FF5CCB97000
|
unkown
|
page readonly
|
||
2821BA69000
|
unkown
|
page read and write
|
||
2BB6000
|
unkown
|
page readonly
|
||
7FF584B52000
|
unkown
|
page readonly
|
||
7FF584A4C000
|
unkown
|
page readonly
|
||
286639D0000
|
unkown
|
page readonly
|
||
7FF506194000
|
unkown
|
page readonly
|
||
7FF5060DC000
|
unkown
|
page readonly
|
||
2FA0000
|
heap default
|
page read and write
|
||
7FF503D9C000
|
unkown
|
page readonly
|
||
7FF5CCF04000
|
unkown
|
page readonly
|
||
7FF4EDED2000
|
unkown
|
page readonly
|
||
219E3F00000
|
heap default
|
page read and write
|
||
18D88531000
|
unkown
|
page read and write
|
||
18D88600000
|
unkown
|
page readonly
|
||
2821B930000
|
heap default
|
page read and write
|
||
5624F77000
|
unkown
|
page read and write
|
||
7FF503E8F000
|
unkown
|
page readonly
|
||
5A0000
|
heap private
|
page read and write
|
||
7FF52FCEF000
|
unkown
|
page readonly
|
||
7FF503E1A000
|
unkown
|
page readonly
|
||
7FF4EE022000
|
unkown
|
page readonly
|
||
7FF57E37C000
|
unkown
|
page readonly
|
||
2BBB000
|
unkown
|
page readonly
|
||
7FF5060B0000
|
unkown
|
page readonly
|
||
219E4040000
|
unkown
|
page read and write
|
||
2821BA69000
|
unkown
|
page read and write
|
||
7FF584ACE000
|
unkown
|
page readonly
|
||
7FF5CCC86000
|
unkown
|
page readonly
|
||
1BB4A500000
|
unkown
|
page read and write
|
||
7FF506052000
|
unkown
|
page readonly
|
||
2B9F000
|
unkown
|
page readonly
|
||
7FF505D7A000
|
unkown
|
page readonly
|
||
1BB4A290000
|
unkown
|
page readonly
|
||
7FF4EDFAD000
|
unkown
|
page readonly
|
||
5D0000
|
unkown
|
page readonly
|
||
7FF52FCBE000
|
unkown
|
page readonly
|
||
18D8B000000
|
unkown
|
page read and write
|
||
2821BA69000
|
unkown
|
page read and write
|
||
2B8D000
|
unkown
|
page readonly
|
||
18D8A260000
|
unkown
|
page read and write
|
||
2C33000
|
unkown
|
page readonly
|
||
2E23E259000
|
unkown
|
page read and write
|
||
7FF57E175000
|
unkown
|
page readonly
|
||
2C33000
|
unkown
|
page readonly
|
||
2BA1000
|
unkown
|
page readonly
|
||
18D8A5AB000
|
unkown
|
page read and write
|
||
7FF4EDED0000
|
unkown
|
page readonly
|
||
1BB4A47F000
|
unkown
|
page read and write
|
||
219E4102000
|
unkown
|
page read and write
|
||
18D8A250000
|
unkown
|
page readonly
|
||
7FF5A9A86000
|
unkown
|
page readonly
|
||
28661E55000
|
unkown
|
page read and write
|
||
D1C000
|
unkown
|
page read and write
|
||
2821B8D0000
|
heap private
|
page read and write
|
||
7FF5A9D04000
|
unkown
|
page readonly
|
||
2C28000
|
unkown
|
page readonly
|
||
F635C7E000
|
unkown
|
page read and write
|
||
2B9A000
|
unkown
|
page readonly
|
||
5DB5DFF000
|
unkown
|
page read and write
|
||
18D8A702000
|
unkown
|
page read and write
|
||
2E23E200000
|
unkown
|
page read and write
|
||
18D8A5F4000
|
unkown
|
page read and write
|
||
219E3FE0000
|
unkown
|
page readonly
|
||
18D8AA00000
|
unkown
|
page read and write
|
||
7FF5CCD11000
|
unkown
|
page readonly
|
||
2821BA6D000
|
unkown
|
page read and write
|
||
7FF584A4A000
|
unkown
|
page readonly
|
||
2E0D0F13000
|
unkown
|
page read and write
|
||
18D8A782000
|
unkown
|
page read and write
|
||
219E4250000
|
unkown
|
page readonly
|
||
19A50413000
|
unkown
|
page read and write
|
||
7FF506073000
|
unkown
|
page readonly
|
||
7FF5847E0000
|
unkown
|
page readonly
|
||
7FF5061A2000
|
unkown
|
page readonly
|
||
18D8A59F000
|
unkown
|
page read and write
|
||
7FF5A9D1E000
|
unkown
|
page readonly
|
||
6FA000
|
heap default
|
page read and write
|
||
7FF52FCC5000
|
unkown
|
page readonly
|
||
73757FB000
|
unkown
|
page read and write
|
||
2BB6000
|
unkown
|
page readonly
|
||
3200000
|
unkown
|
page readonly
|
||
7FF57E43A000
|
unkown
|
page readonly
|
||
2E23E202000
|
unkown
|
page read and write
|
||
2821BCD0000
|
unkown
|
page readonly
|
||
7FF503F14000
|
unkown
|
page readonly
|
||
7FF584ABF000
|
unkown
|
page readonly
|
||
1BB4A48A000
|
unkown
|
page read and write
|
||
18D88571000
|
unkown
|
page read and write
|
||
7FF584A5A000
|
unkown
|
page readonly
|
||
7FF584AD6000
|
unkown
|
page readonly
|
||
2821B990000
|
unkown
|
page readonly
|
||
7FF5CCC9F000
|
unkown
|
page readonly
|
||
18D884B9000
|
unkown
|
page read and write
|
||
7FF5A9521000
|
unkown
|
page readonly
|
||
18D88457000
|
unkown
|
page read and write
|
||
18D8A535000
|
unkown
|
page read and write
|
||
CF6A27F000
|
unkown
|
page read and write
|
||
2821BC00000
|
unkown
|
page readonly
|
||
C35757D000
|
unkown
|
page read and write
|
||
7FF503E84000
|
unkown
|
page readonly
|
||
2BA1000
|
unkown
|
page readonly
|
||
1BB4A402000
|
unkown
|
page read and write
|
||
2E70000
|
unkown
|
page readonly
|
||
400000
|
unkown
|
page readonly
|
||
18D8A5E6000
|
unkown
|
page read and write
|
||
18D8B010000
|
unkown
|
page read and write
|
||
7FF5A9CCB000
|
unkown
|
page readonly
|
||
7FF52F97C000
|
unkown
|
page readonly
|
||
7FF584A97000
|
unkown
|
page readonly
|
||
7FF506126000
|
unkown
|
page readonly
|
||
18D88400000
|
unkown
|
page read and write
|
||
7FF503CD3000
|
unkown
|
page readonly
|
||
19A50429000
|
unkown
|
page read and write
|
||
7FF584620000
|
unkown
|
page readonly
|
||
5DB677F000
|
unkown
|
page read and write
|
||
7FF5CCFB2000
|
unkown
|
page readonly
|
||
2BB2000
|
unkown
|
page readonly
|
||
7FF5A9C62000
|
unkown
|
page readonly
|
||
18D8A1E0000
|
unkown
|
page read and write
|
||
73758F7000
|
unkown
|
page read and write
|
||
2B70000
|
unkown
|
page readonly
|
||
7FF5A9D39000
|
unkown
|
page readonly
|
||
7FF5849CC000
|
unkown
|
page readonly
|
||
7FF5CCD19000
|
unkown
|
page readonly
|
||
18D89EA0000
|
unkown
|
page readonly
|
||
19A50600000
|
unkown
|
page readonly
|
||
2821BA6D000
|
unkown
|
page read and write
|
||
219E5AF0000
|
unkown
|
page readonly
|
||
7FF5A9D2E000
|
unkown
|
page readonly
|
||
7FF5A9AE1000
|
unkown
|
page readonly
|
||
7FF503D2E000
|
unkown
|
page readonly
|
||
7FF52FD31000
|
unkown
|
page readonly
|
||
7FF4EDFA6000
|
unkown
|
page readonly
|
||
18D8A1F0000
|
unkown
|
page readonly
|
||
2E23E130000
|
unkown
|
page readonly
|
||
19A50488000
|
unkown
|
page read and write
|
||
7FF505F91000
|
unkown
|
page readonly
|
||
2C01000
|
unkown
|
page readonly
|
||
7FF5060FA000
|
unkown
|
page readonly
|
||
2B6C000
|
unkown
|
page readonly
|
||
18D8A677000
|
unkown
|
page read and write
|
||
7FF57E3C1000
|
unkown
|
page readonly
|
||
5DB59BE000
|
unkown
|
page read and write
|
||
18D8A5F4000
|
unkown
|
page read and write
|
||
7FF5CCEAA000
|
unkown
|
page readonly
|
||
18D8A632000
|
unkown
|
page read and write
|
||
7FF4ED791000
|
unkown
|
page readonly
|
||
2E0D0F02000
|
unkown
|
page read and write
|
||
2B55000
|
unkown
|
page readonly
|
||
2821BB00000
|
unkown
|
page read and write
|
||
7FF5CCE5C000
|
unkown
|
page readonly
|
||
18D8846E000
|
unkown
|
page read and write
|
||
2C05000
|
unkown
|
page readonly
|
||
18D8843F000
|
unkown
|
page read and write
|
||
18D8B310000
|
unkown
|
page read and write
|
||
F635CFA000
|
unkown
|
page read and write
|
||
7FF50612D000
|
unkown
|
page readonly
|
||
2B85000
|
unkown
|
page readonly
|
||
18D884DB000
|
unkown
|
page read and write
|
||
28661E02000
|
unkown
|
page read and write
|
||
7FF5CC7C1000
|
unkown
|
page readonly
|
||
DF0000
|
unkown
|
page readonly
|
||
7FF50610E000
|
unkown
|
page readonly
|
||
7FF52FD3D000
|
unkown
|
page readonly
|
||
1BB4AA60000
|
unkown
|
page readonly
|
||
7FF5061A1000
|
unkown
|
page readonly
|
||
2B6C000
|
unkown
|
page readonly
|
||
5DB5EFB000
|
unkown
|
page read and write
|
||
7FF4EDE38000
|
unkown
|
page readonly
|
||
18D88550000
|
unkown
|
page read and write
|
||
7FF584B44000
|
unkown
|
page readonly
|
||
5DB5E7B000
|
unkown
|
page read and write
|
||
7FF584AC8000
|
unkown
|
page readonly
|
||
2E0D0E56000
|
unkown
|
page read and write
|
||
1BB4AC02000
|
unkown
|
page read and write
|
||
7FF503E5F000
|
unkown
|
page readonly
|
||
7FF4EDBFA000
|
unkown
|
page readonly
|
||
2B70000
|
unkown
|
page readonly
|
||
7FF4EE021000
|
unkown
|
page readonly
|
||
7FF5A9CC0000
|
unkown
|
page readonly
|
||
7FF5A9CBA000
|
unkown
|
page readonly
|
||
7FF57E355000
|
unkown
|
page readonly
|
||
2B33000
|
unkown
|
page readonly
|
||
7FF57E350000
|
unkown
|
page readonly
|
||
7FF5060AE000
|
unkown
|
page readonly
|
||
7FF5CC71D000
|
unkown
|
page readonly
|
||
2E23E240000
|
unkown
|
page read and write
|
||
3C8000
|
unkown
|
page read and write
|
||
2821BA29000
|
unkown
|
page read and write
|
||
7FF52FD36000
|
unkown
|
page readonly
|
||
7FF4EDBEC000
|
unkown
|
page readonly
|
||
18D8A260000
|
unkown
|
page read and write
|
||
2821BB02000
|
unkown
|
page read and write
|
||
7FF57E231000
|
unkown
|
page readonly
|
||
2821D570000
|
unkown
|
page readonly
|
||
2E23E313000
|
unkown
|
page read and write
|
||
19A50513000
|
unkown
|
page read and write
|
||
7FF5A9A7B000
|
unkown
|
page readonly
|
||
7FF506129000
|
unkown
|
page readonly
|
||
7FF5CCEC0000
|
unkown
|
page readonly
|
||
C35747A000
|
unkown
|
page read and write
|
||
7FF52F98F000
|
unkown
|
page readonly
|
||
7FF503D94000
|
unkown
|
page readonly
|
||
2E23E229000
|
unkown
|
page read and write
|
||
18D8846E000
|
unkown
|
page read and write
|
||
1BB4A426000
|
unkown
|
page read and write
|
||
2C01000
|
unkown
|
page readonly
|
||
5624B7F000
|
unkown
|
page read and write
|
||
7FF57E1A9000
|
unkown
|
page readonly
|
||
2821BA6F000
|
unkown
|
page read and write
|
||
1BB4A370000
|
unkown
|
page readonly
|
||
5624E7F000
|
unkown
|
page read and write
|
||
7FF503E74000
|
unkown
|
page readonly
|
||
7FF5A9CF8000
|
unkown
|
page readonly
|
||
7FF57E2F2000
|
unkown
|
page readonly
|
||
2BBB000
|
unkown
|
page readonly
|
||
2B93000
|
unkown
|
page readonly
|
||
E86F8FF000
|
unkown
|
page read and write
|
||
7FF52FBC3000
|
unkown
|
page readonly
|
||
18D8A67B000
|
unkown
|
page read and write
|
||
2C33000
|
unkown
|
page readonly
|
||
5DB63FB000
|
unkown
|
page read and write
|
||
19A50290000
|
heap default
|
page read and write
|
||
7FF52FDB1000
|
unkown
|
page readonly
|
||
2C14000
|
unkown
|
page readonly
|
||
7FF5CCE0D000
|
unkown
|
page readonly
|
||
7FF5CCE83000
|
unkown
|
page readonly
|
||
1A0000
|
unkown
|
page readonly
|
||
7FF52FB19000
|
unkown
|
page readonly
|
||
83D8FFF000
|
unkown
|
page read and write
|
||
2C33000
|
unkown
|
page readonly
|
||
18D884DF000
|
unkown
|
page read and write
|
||
18D8A694000
|
unkown
|
page read and write
|
||
2821BA6F000
|
unkown
|
page read and write
|
||
2C22000
|
unkown
|
page readonly
|
||
5DB627B000
|
unkown
|
page read and write
|
||
2B5C000
|
unkown
|
page readonly
|
||
7FF503F1A000
|
unkown
|
page readonly
|
||
19A50500000
|
unkown
|
page read and write
|
||
18D8AA42000
|
unkown
|
page read and write
|
||
18D8846D000
|
unkown
|
page read and write
|
||
7FF584941000
|
unkown
|
page readonly
|
||
7FF4EDF3B000
|
unkown
|
page readonly
|
||
18D8B110000
|
unkown
|
page read and write
|
||
18D8A538000
|
unkown
|
page read and write
|
||
219E406A000
|
unkown
|
page read and write
|
||
5DB60FB000
|
unkown
|
page read and write
|
||
7FF503BA7000
|
unkown
|
page readonly
|
||
7FF57E3BE000
|
unkown
|
page readonly
|
||
2821BA6D000
|
unkown
|
page read and write
|
||
7FF52FC83000
|
unkown
|
page readonly
|
||
219E4054000
|
unkown
|
page read and write
|
||
7FF5CCE8F000
|
unkown
|
page readonly
|
||
7FF4EDF84000
|
unkown
|
page readonly
|
||
7FF584A77000
|
unkown
|
page readonly
|
||
5DB657B000
|
unkown
|
page read and write
|
||
7FF5CCEBA000
|
unkown
|
page readonly
|
||
18D884DB000
|
unkown
|
page read and write
|
||
18D8A5BA000
|
unkown
|
page read and write
|
||
2B55000
|
unkown
|
page readonly
|
||
2E0D0E13000
|
unkown
|
page read and write
|
||
18D8B510000
|
unkown
|
page read and write
|
||
18D884DB000
|
unkown
|
page read and write
|
||
19A50E00000
|
unkown
|
page readonly
|
||
1BB4A600000
|
unkown
|
page readonly
|
||
18D8A290000
|
unkown
|
page read and write
|
||
35D0000
|
unkown
|
page readonly
|
||
5DB5FFB000
|
unkown
|
page read and write
|
||
2B8D000
|
unkown
|
page readonly
|
||
CC000
|
unkown
|
page read and write
|
||
2821BA6D000
|
unkown
|
page read and write
|
||
7FF57E434000
|
unkown
|
page readonly
|
||
2E0D0E02000
|
unkown
|
page read and write
|
||
2C05000
|
unkown
|
page readonly
|
||
2E23DFA0000
|
heap private
|
page read and write
|
||
7FF506104000
|
unkown
|
page readonly
|
||
18D884DF000
|
unkown
|
page read and write
|
||
7FF503E1C000
|
unkown
|
page readonly
|
||
7FF503E2E000
|
unkown
|
page readonly
|
||
2B33000
|
unkown
|
page readonly
|
||
1BB4A452000
|
unkown
|
page read and write
|
||
7FF52FCC0000
|
unkown
|
page readonly
|
||
7FF5CCEC5000
|
unkown
|
page readonly
|
||
2E0D2C30000
|
unkown
|
page read and write
|
||
18D8A700000
|
unkown
|
page read and write
|
||
18D884CC000
|
unkown
|
page read and write
|
||
2E0D0CF0000
|
unkown
|
page readonly
|
||
5DB593B000
|
unkown
|
page read and write
|
||
2B3A000
|
unkown
|
page readonly
|
||
219E3F10000
|
unkown
|
page readonly
|
||
19C000
|
unkown
|
page read and write
|
||
18D8A600000
|
unkown
|
page read and write
|
||
7FF50611E000
|
unkown
|
page readonly
|
||
2B5C000
|
unkown
|
page readonly
|
||
7FF5CCCE1000
|
unkown
|
page readonly
|
||
7FF5CCF31000
|
unkown
|
page readonly
|
||
18D8846E000
|
unkown
|
page read and write
|
||
18D88543000
|
unkown
|
page read and write
|
||
7FF57E10B000
|
unkown
|
page readonly
|
||
2B2C000
|
unkown
|
page readonly
|
||
7FF503C81000
|
unkown
|
page readonly
|
||
7FF5CCB7C000
|
unkown
|
page readonly
|
||
7FF503E30000
|
unkown
|
page readonly
|
||
19A50400000
|
unkown
|
page read and write
|
||
83D9079000
|
unkown
|
page read and write
|
||
2B79000
|
unkown
|
page readonly
|
||
2B2C000
|
unkown
|
page readonly
|
||
19A50452000
|
unkown
|
page read and write
|
||
7FF50619A000
|
unkown
|
page readonly
|
||
7FF52FDB2000
|
unkown
|
page readonly
|
||
18D8B410000
|
unkown
|
page read and write
|
||
7FF5CCE9F000
|
unkown
|
page readonly
|
||
7FF503E98000
|
unkown
|
page readonly
|
||
35C0000
|
heap private
|
page read and write
|
||
3300000
|
heap default
|
page read and write
|
||
19A50508000
|
unkown
|
page read and write
|
||
7FF5A9C60000
|
unkown
|
page readonly
|
||
7FF5A997C000
|
unkown
|
page readonly
|
||
2E0D0C80000
|
heap private
|
page read and write
|
||
18D88290000
|
heap default
|
page read and write
|
||
7FF503BB0000
|
unkown
|
page readonly
|
||
73759FC000
|
unkown
|
page read and write
|
||
C3572FF000
|
unkown
|
page read and write
|
||
7FF584AD9000
|
unkown
|
page readonly
|
||
7FF5CCDC8000
|
unkown
|
page readonly
|
||
7FF57E394000
|
unkown
|
page readonly
|
||
2B29000
|
unkown
|
page readonly
|
||
7FF52FD1E000
|
unkown
|
page readonly
|
||
2832000
|
unkown
|
page readonly
|
||
7FF5A9D36000
|
unkown
|
page readonly
|
||
2B79000
|
unkown
|
page readonly
|
||
7FF5CCEEF000
|
unkown
|
page readonly
|
||
7FF5CCA22000
|
unkown
|
page readonly
|
||
7FF57E2F0000
|
unkown
|
page readonly
|
||
18D8A517000
|
unkown
|
page read and write
|
||
7FF5A9CC5000
|
unkown
|
page readonly
|
||
2B29000
|
unkown
|
page readonly
|
||
F635D79000
|
unkown
|
page read and write
|
||
7FF503D7D000
|
unkown
|
page readonly
|
||
330A000
|
heap default
|
page read and write
|
||
18D8A800000
|
unkown
|
page readonly
|
||
7FF4EE014000
|
unkown
|
page readonly
|
||
28662320000
|
unkown
|
page readonly
|
||
7FF5060DF000
|
unkown
|
page readonly
|
||
7FF584A8C000
|
unkown
|
page readonly
|
||
7FF52FCD7000
|
unkown
|
page readonly
|
||
7FF52FAE1000
|
unkown
|
page readonly
|
||
28661E00000
|
unkown
|
page read and write
|
||
18D8846D000
|
unkown
|
page read and write
|
||
5DB5F7B000
|
unkown
|
page read and write
|
||
18D8A5F4000
|
unkown
|
page read and write
|
||
7FF5CCA99000
|
unkown
|
page readonly
|
||
7FF5A9D31000
|
unkown
|
page readonly
|
||
7FF4EDF35000
|
unkown
|
page readonly
|
||
5D0000
|
unkown
|
page readonly
|
||
1BB4A513000
|
unkown
|
page read and write
|
||
7FF52FCCB000
|
unkown
|
page readonly
|
||
F63594B000
|
unkown
|
page read and write
|
||
190000
|
unkown
|
page readonly
|
||
7FF584B4A000
|
unkown
|
page readonly
|
||
83D90FF000
|
unkown
|
page read and write
|
||
2A60000
|
unkown
|
page readonly
|
||
19A50457000
|
unkown
|
page read and write
|
||
18D8A596000
|
unkown
|
page read and write
|
||
19A50A60000
|
unkown
|
page readonly
|
||
2E23E302000
|
unkown
|
page read and write
|
||
219E5E50000
|
unkown
|
page read and write
|
||
DC0000
|
unkown
|
page read and write
|
||
7FF5CCE8B000
|
unkown
|
page readonly
|
||
18D8A500000
|
unkown
|
page read and write
|
||
18D884D9000
|
unkown
|
page read and write
|
||
2C05000
|
unkown
|
page readonly
|
||
7FF5CCE06000
|
unkown
|
page readonly
|
||
18D884A8000
|
unkown
|
page read and write
|
||
7FF503E2A000
|
unkown
|
page readonly
|
||
7FF503E9E000
|
unkown
|
page readonly
|
||
7FF5849B3000
|
unkown
|
page readonly
|
||
7FF5A9AE5000
|
unkown
|
page readonly
|
||
2B5C000
|
unkown
|
page readonly
|
||
2E0D27F0000
|
unkown
|
page read and write
|
||
2821BA02000
|
unkown
|
page read and write
|
||
7FF4EDF2E000
|
unkown
|
page readonly
|
||
2B3A000
|
unkown
|
page readonly
|
||
7FF52FDA4000
|
unkown
|
page readonly
|
||
7FF503E7A000
|
unkown
|
page readonly
|
||
18D884DF000
|
unkown
|
page read and write
|
||
18D8A512000
|
unkown
|
page read and write
|
||
7FF505D6C000
|
unkown
|
page readonly
|
||
2E0D0E3F000
|
unkown
|
page read and write
|
||
219E4002000
|
unkown
|
page read and write
|
||
5624A7B000
|
unkown
|
page read and write
|
||
7FF4EDF5F000
|
unkown
|
page readonly
|
||
28661E3F000
|
unkown
|
page read and write
|
||
5DB5C7E000
|
unkown
|
page read and write
|
||
7375AFF000
|
unkown
|
page read and write
|
||
2B93000
|
unkown
|
page readonly
|
||
E86FA7F000
|
unkown
|
page read and write
|
||
7FF5847D7000
|
unkown
|
page readonly
|
||
2B87000
|
unkown
|
page readonly
|
||
7FF505FB8000
|
unkown
|
page readonly
|
||
2BBB000
|
unkown
|
page readonly
|
||
2821BB13000
|
unkown
|
page read and write
|
||
18D8AA02000
|
unkown
|
page read and write
|
||
7FF52FC62000
|
unkown
|
page readonly
|
||
7FF5849C4000
|
unkown
|
page readonly
|
||
8F0000
|
unkown
|
page readonly
|
||
1BB4A43C000
|
unkown
|
page read and write
|
||
6D0000
|
heap default
|
page read and write
|
||
219E4000000
|
unkown
|
page read and write
|
||
7FF5A998A000
|
unkown
|
page readonly
|
||
18D8B410000
|
unkown
|
page read and write
|
||
7FF4EDF7A000
|
unkown
|
page readonly
|
||
19A502A0000
|
unkown
|
page readonly
|
||
2B8D000
|
unkown
|
page readonly
|
||
2C22000
|
unkown
|
page readonly
|
||
7FF52F521000
|
unkown
|
page readonly
|
||
7FF503E67000
|
unkown
|
page readonly
|
||
7FF4EDE11000
|
unkown
|
page readonly
|
||
28661D90000
|
heap private
|
page read and write
|
||
2821BA6F000
|
unkown
|
page read and write
|
||
DE0000
|
unkown
|
page readonly
|
||
1BB4A470000
|
unkown
|
page read and write
|
||
1BB4A360000
|
unkown
|
page readonly
|
||
7FF5CCCE5000
|
unkown
|
page readonly
|
||
7FF5A9D3D000
|
unkown
|
page readonly
|
||
5DB61FB000
|
unkown
|
page read and write
|
||
28661E29000
|
unkown
|
page read and write
|
||
18D88550000
|
unkown
|
page read and write
|
||
2B93000
|
unkown
|
page readonly
|
||
7FF584A8F000
|
unkown
|
page readonly
|
||
18D8846E000
|
unkown
|
page read and write
|
||
7FF5CCDC3000
|
unkown
|
page readonly
|
||
18D8A782000
|
unkown
|
page read and write
|
||
7FF57E39A000
|
unkown
|
page readonly
|
||
7FF584903000
|
unkown
|
page readonly
|
||
7FF5CCF39000
|
unkown
|
page readonly
|
||
18D8A270000
|
unkown
|
page read and write
|
||
35B000
|
unkown
|
page read and write
|
||
7FF57E116000
|
unkown
|
page readonly
|
||
5DB637B000
|
unkown
|
page read and write
|
||
E86F9F9000
|
unkown
|
page read and write
|
||
7FF505D87000
|
unkown
|
page readonly
|
||
18D8B510000
|
unkown
|
page read and write
|
||
7FF52FC60000
|
unkown
|
page readonly
|
||
7FF4EDC07000
|
unkown
|
page readonly
|
||
7FF5CCFB1000
|
unkown
|
page readonly
|
||
7FF584A65000
|
unkown
|
page readonly
|
||
2E23E0E0000
|
unkown
|
page write copy
|
||
1BB4A44F000
|
unkown
|
page read and write
|
||
2B87000
|
unkown
|
page readonly
|
||
2BB6000
|
unkown
|
page readonly
|
||
F635DFE000
|
unkown
|
page read and write
|
||
7FF4EDF47000
|
unkown
|
page readonly
|
||
18D8A641000
|
unkown
|
page read and write
|
||
7FF5A9BBB000
|
unkown
|
page readonly
|
||
5DB62FB000
|
unkown
|
page read and write
|
||
7FF57E34A000
|
unkown
|
page readonly
|
||
3140000
|
unkown
|
page read and write
|
||
7FF5CCEEC000
|
unkown
|
page readonly
|
||
18D8A570000
|
unkown
|
page read and write
|
||
7FF584A6B000
|
unkown
|
page readonly
|
||
18D884EE000
|
unkown
|
page read and write
|
||
7FF57E3AE000
|
unkown
|
page readonly
|
||
737532F000
|
unkown
|
page read and write
|
||
E40000
|
heap private
|
page read and write
|
||
18D884E4000
|
unkown
|
page read and write
|
||
2832000
|
unkown
|
page readonly
|
||
7FF5A9DA4000
|
unkown
|
page readonly
|
||
7FF4EDF30000
|
unkown
|
page readonly
|
||
7FF503E5C000
|
unkown
|
page readonly
|
||
7FF503F21000
|
unkown
|
page readonly
|
||
170000
|
unkown
|
page read and write
|
||
7FF50367E000
|
unkown
|
page readonly
|
||
7FF52F98A000
|
unkown
|
page readonly
|
||
7FF5CCF36000
|
unkown
|
page readonly
|
||
2E23FCA0000
|
unkown
|
page readonly
|
||
7FF5CCC7B000
|
unkown
|
page readonly
|
||
7FF52FA7B000
|
unkown
|
page readonly
|
||
73756F5000
|
unkown
|
page read and write
|
||
5624AFF000
|
unkown
|
page read and write
|
||
562517F000
|
unkown
|
page read and write
|
||
7FF57E027000
|
unkown
|
page readonly
|
||
7FF4EDD55000
|
unkown
|
page readonly
|
||
C3573FF000
|
unkown
|
page read and write
|
||
7FF57E35B000
|
unkown
|
page readonly
|
||
2821BA40000
|
unkown
|
page read and write
|
||
2821B940000
|
unkown
|
page write copy
|
||
2B2C000
|
unkown
|
page readonly
|
||
7FF52FCEC000
|
unkown
|
page readonly
|
||
18D8A643000
|
unkown
|
page read and write
|
||
7FF5CCED7000
|
unkown
|
page readonly
|
||
19A50470000
|
unkown
|
page read and write
|
||
1BB4A502000
|
unkown
|
page read and write
|
||
2C14000
|
unkown
|
page readonly
|
||
7FF57E3C9000
|
unkown
|
page readonly
|
||
2B87000
|
unkown
|
page readonly
|
||
7FF52F997000
|
unkown
|
page readonly
|
||
2821BA6C000
|
unkown
|
page read and write
|
||
18D8B010000
|
unkown
|
page read and write
|
||
7FF5A9BC8000
|
unkown
|
page readonly
|
||
E86F5AB000
|
unkown
|
page read and write
|
||
7FF5CCF14000
|
unkown
|
page readonly
|
||
7FF5849AD000
|
unkown
|
page readonly
|
||
2E23E213000
|
unkown
|
page read and write
|
||
7FF4EDFA9000
|
unkown
|
page readonly
|
||
711000
|
heap default
|
page read and write
|
||
2821BA6D000
|
unkown
|
page read and write
|
||
18D884F2000
|
unkown
|
page read and write
|
||
2B55000
|
unkown
|
page readonly
|
||
2821BA35000
|
unkown
|
page read and write
|
||
7FF503D11000
|
unkown
|
page readonly
|
||
7FF503D83000
|
unkown
|
page readonly
|
||
7FF52FAE5000
|
unkown
|
page readonly
|
||
2B70000
|
unkown
|
page readonly
|
||
7FF503E3B000
|
unkown
|
page readonly
|
||
7FF505E76000
|
unkown
|
page readonly
|
||
7FF505E6B000
|
unkown
|
page readonly
|
||
18D8A2A0000
|
unkown
|
page readonly
|
||
7FF5A9CEC000
|
unkown
|
page readonly
|
||
7FF4EDF2A000
|
unkown
|
page readonly
|
||
7FF5CCF0A000
|
unkown
|
page readonly
|
||
5DB66FC000
|
unkown
|
page read and write
|
||
7FF584B51000
|
unkown
|
page readonly
|
||
7FF52FA86000
|
unkown
|
page readonly
|
||
18D8A53A000
|
unkown
|
page read and write
|
||
460000
|
unkown
|
page readonly
|
||
2E0D0E00000
|
unkown
|
page read and write
|
||
7FF5060C7000
|
unkown
|
page readonly
|
||
18D8A260000
|
unkown
|
page read and write
|
||
7FF5060F4000
|
unkown
|
page readonly
|
||
7FF57E367000
|
unkown
|
page readonly
|
||
7FF5060B5000
|
unkown
|
page readonly
|
||
83D917E000
|
unkown
|
page read and write
|
||
E86FB7F000
|
unkown
|
page read and write
|
||
1BB4A508000
|
unkown
|
page read and write
|
||
18D8A402000
|
unkown
|
page read and write
|
||
18D8B210000
|
unkown
|
page read and write
|
||
18D883C0000
|
unkown
|
page readonly
|
||
7FF5039F0000
|
unkown
|
page readonly
|
||
440000
|
unkown
|
page read and write
|
||
28661F13000
|
unkown
|
page read and write
|
||
19A50380000
|
unkown
|
page readonly
|
||
7FF4EDCF6000
|
unkown
|
page readonly
|
||
5C0000
|
heap private
|
page read and write
|
||
7FF5CCB8F000
|
unkown
|
page readonly
|
||
7FF5CCCF4000
|
unkown
|
page readonly
|
||
18D88230000
|
heap private
|
page read and write
|
||
7FF5060E8000
|
unkown
|
page readonly
|
||
2B6C000
|
unkown
|
page readonly
|
||
2B79000
|
unkown
|
page readonly
|
||
2B85000
|
unkown
|
page readonly
|
||
7FF52FDAA000
|
unkown
|
page readonly
|
||
7FF505FAB000
|
unkown
|
page readonly
|
||
18D88581000
|
unkown
|
page read and write
|
||
2821BA00000
|
unkown
|
page read and write
|
||
7FF52F51D000
|
unkown
|
page readonly
|
||
5DB64FA000
|
unkown
|
page read and write
|
||
2A60000
|
unkown
|
page readonly
|
||
7FF506121000
|
unkown
|
page readonly
|
||
219E4029000
|
unkown
|
page read and write
|
||
2E0D0DC0000
|
unkown
|
page readonly
|
||
18D8A5AF000
|
unkown
|
page read and write
|
||
7FF57E388000
|
unkown
|
page readonly
|
||
7FF505F09000
|
unkown
|
page readonly
|
||
7FF57E258000
|
unkown
|
page readonly
|
||
7FF506118000
|
unkown
|
page readonly
|
||
18D884D1000
|
unkown
|
page read and write
|
||
19A5043C000
|
unkown
|
page read and write
|
||
18D8B013000
|
unkown
|
page read and write
|
||
7FF5039F6000
|
unkown
|
page readonly
|
||
7FF57E3B8000
|
unkown
|
page readonly
|
||
2832000
|
unkown
|
page readonly
|
||
2B9A000
|
unkown
|
page readonly
|
||
7FF503F22000
|
unkown
|
page readonly
|
||
19A50454000
|
unkown
|
page read and write
|
||
7FF4ED78D000
|
unkown
|
page readonly
|
||
5DB667C000
|
unkown
|
page read and write
|
||
7FF5CCEF7000
|
unkown
|
page readonly
|
||
7FF5A9D14000
|
unkown
|
page readonly
|
||
7FF57E24B000
|
unkown
|
page readonly
|
||
7FF5CCC98000
|
unkown
|
page readonly
|
||
2E23E010000
|
unkown
|
page readonly
|
||
7FF503EA9000
|
unkown
|
page readonly
|
||
7FF5A9DAA000
|
unkown
|
page readonly
|
||
2B8F000
|
unkown
|
page readonly
|
||
7FF5CCEAC000
|
unkown
|
page readonly
|
||
2BB2000
|
unkown
|
page readonly
|
||
7FF57E313000
|
unkown
|
page readonly
|
||
18D8A200000
|
heap private
|
page read and write
|
||
18D885B2000
|
unkown
|
page read and write
|
||
18D88482000
|
unkown
|
page read and write
|
||
7FF52FCF8000
|
unkown
|
page readonly
|
||
500000
|
unkown
|
page readonly
|
||
7FF503E47000
|
unkown
|
page readonly
|
||
7FF52FD28000
|
unkown
|
page readonly
|
||
7FF5CCFAA000
|
unkown
|
page readonly
|
||
18D89DA0000
|
unkown
|
page read and write
|
||
E86F97A000
|
unkown
|
page read and write
|
||
7FF57E3C6000
|
unkown
|
page readonly
|
||
2B63000
|
unkown
|
page readonly
|
||
83D8EFE000
|
unkown
|
page read and write
|
||
E86FAFB000
|
unkown
|
page read and write
|
||
28661F02000
|
unkown
|
page read and write
|
||
7FF4EDCEB000
|
unkown
|
page readonly
|
||
18D88429000
|
unkown
|
page read and write
|
||
2BB2000
|
unkown
|
page readonly
|
||
219E59F0000
|
unkown
|
page read and write
|
||
18D88530000
|
unkown
|
page read and write
|
||
2C33000
|
unkown
|
page readonly
|
||
7FF505FB3000
|
unkown
|
page readonly
|
||
7FF5A9B19000
|
unkown
|
page readonly
|
||
1BB4A220000
|
heap private
|
page read and write
|
||
7FF5CCE94000
|
unkown
|
page readonly
|
||
7FF57E01A000
|
unkown
|
page readonly
|
||
7FF503678000
|
unkown
|
page readonly
|
||
19A50C02000
|
unkown
|
page read and write
|
||
2B9A000
|
unkown
|
page readonly
|
||
CF6A47E000
|
unkown
|
page read and write
|
||
2E0D28F0000
|
unkown
|
page readonly
|
||
2E0D1000000
|
unkown
|
page write copy
|
||
7FF57E37F000
|
unkown
|
page readonly
|
||
7FF5A9BA1000
|
unkown
|
page readonly
|
||
1BB4A429000
|
unkown
|
page read and write
|
||
7FF4EDF74000
|
unkown
|
page readonly
|
||
7FF57E00C000
|
unkown
|
page readonly
|
||
2C22000
|
unkown
|
page readonly
|
||
286620D0000
|
unkown
|
page write copy
|
||
CF6A3FA000
|
unkown
|
page read and write
|
||
7FF503E35000
|
unkown
|
page readonly
|
||
2E0D0E29000
|
unkown
|
page read and write
|
||
2B85000
|
unkown
|
page readonly
|
||
7FF4EDF98000
|
unkown
|
page readonly
|
||
7FF4EDD89000
|
unkown
|
page readonly
|
||
7FF584635000
|
unkown
|
page readonly
|
||
CF6A2FA000
|
unkown
|
page read and write
|
||
7FF4EDE33000
|
unkown
|
page readonly
|
||
7FF5060AA000
|
unkown
|
page readonly
|
||
7FF4EDF5C000
|
unkown
|
page readonly
|
||
C357379000
|
unkown
|
page read and write
|
||
7FF584AA4000
|
unkown
|
page readonly
|
||
7FF5CCE62000
|
unkown
|
page readonly
|
||
2E23E400000
|
unkown
|
page readonly
|
||
18D88413000
|
unkown
|
page read and write
|
||
7FF5CCF28000
|
unkown
|
page readonly
|
||
7FF5A9997000
|
unkown
|
page readonly
|
||
7FF4EDD51000
|
unkown
|
page readonly
|
||
18D8A742000
|
unkown
|
page read and write
|
||
7FF4EDF8E000
|
unkown
|
page readonly
|
||
28662120000
|
unkown
|
page readonly
|
||
7FF4EDFA1000
|
unkown
|
page readonly
|
||
7375BFF000
|
unkown
|
page read and write
|
||
3321000
|
heap default
|
page read and write
|
||
7FF584ADD000
|
unkown
|
page readonly
|
||
F6359CE000
|
unkown
|
page read and write
|
||
19A50426000
|
unkown
|
page read and write
|
||
2E23E000000
|
heap default
|
page read and write
|
||
83D8F7A000
|
unkown
|
page read and write
|
||
7FF5A9D0A000
|
unkown
|
page readonly
|
||
7FF5CCECB000
|
unkown
|
page readonly
|
||
8E0000
|
heap private
|
page read and write
|
||
7FF4EDEF3000
|
unkown
|
page readonly
|
||
18D8AB00000
|
unkown
|
page read and write
|
||
7FF5CCF2E000
|
unkown
|
page readonly
|
||
2E0D0CE0000
|
heap default
|
page read and write
|
||
19A50502000
|
unkown
|
page read and write
|
||
470000
|
unkown
|
page readonly
|
||
7FF5A9CEF000
|
unkown
|
page readonly
|
||
7FF506050000
|
unkown
|
page readonly
|
||
7FF5060BB000
|
unkown
|
page readonly
|
||
73753AF000
|
unkown
|
page read and write
|
||
CF6A37F000
|
unkown
|
page read and write
|
||
1BB4A413000
|
unkown
|
page read and write
|
||
7FF5842BD000
|
unkown
|
page readonly
|
||
19A5047D000
|
unkown
|
page read and write
|
||
18D8852D000
|
unkown
|
page read and write
|
||
18D8A5C0000
|
unkown
|
page read and write
|
||
7FF52FD04000
|
unkown
|
page readonly
|
||
2C14000
|
unkown
|
page readonly
|
||
18D8A615000
|
unkown
|
page read and write
|
||
219E3EA0000
|
heap private
|
page read and write
|
||
C35727B000
|
unkown
|
page read and write
|
||
7FF5A998F000
|
unkown
|
page readonly
|
||
18D8A2C0000
|
unkown
|
page readonly
|
||
7FF5CCD01000
|
unkown
|
page readonly
|
||
1BB4A44C000
|
unkown
|
page read and write
|
||
7FF5A9C83000
|
unkown
|
page readonly
|
||
7FF50590D000
|
unkown
|
page readonly
|
||
18D8A566000
|
unkown
|
page read and write
|
||
7FF4EDE2B000
|
unkown
|
page readonly
|
||
2B9F000
|
unkown
|
page readonly
|
||
219E4013000
|
unkown
|
page read and write
|
||
19A5044C000
|
unkown
|
page read and write
|
||
18D8A530000
|
unkown
|
page read and write
|
||
2B63000
|
unkown
|
page readonly
|
||
1BB4AE00000
|
unkown
|
page readonly
|
||
7FF4EDF9E000
|
unkown
|
page readonly
|
||
83D8BFB000
|
unkown
|
page read and write
|
||
5DB647B000
|
unkown
|
page read and write
|
||
7FF5CCE52000
|
unkown
|
page readonly
|
||
7FF57DBAD000
|
unkown
|
page readonly
|
||
7FF584AB4000
|
unkown
|
page readonly
|
||
7FF58495E000
|
unkown
|
page readonly
|
||
6F1000
|
heap default
|
page read and write
|
||
7FF57E3A4000
|
unkown
|
page readonly
|
||
2BA1000
|
unkown
|
page readonly
|
||
6DA000
|
heap default
|
page read and write
|
||
D5B000
|
unkown
|
page read and write
|
||
5DB5CFA000
|
unkown
|
page read and write
|
||
313C000
|
unkown
|
page read and write
|
||
7FF52FBA1000
|
unkown
|
page readonly
|
||
7FF5CCDBB000
|
unkown
|
page readonly
|
||
18D88513000
|
unkown
|
page read and write
|
||
4F0000
|
heap default
|
page read and write
|
||
2C33000
|
unkown
|
page readonly
|
||
7FF57E253000
|
unkown
|
page readonly
|
||
10B000
|
unkown
|
page read and write
|
||
2821D470000
|
unkown
|
page read and write
|
||
2821BA57000
|
unkown
|
page read and write
|
||
7FF4EE01A000
|
unkown
|
page readonly
|
||
2B63000
|
unkown
|
page readonly
|
||
7FF505ED5000
|
unkown
|
page readonly
|
||
2C01000
|
unkown
|
page readonly
|
||
19A50370000
|
unkown
|
page readonly
|
||
7FF5A951D000
|
unkown
|
page readonly
|
||
28661DF0000
|
heap default
|
page read and write
|
||
1BB4A280000
|
heap default
|
page read and write
|
||
7FF52FD0A000
|
unkown
|
page readonly
|
||
7FF57E442000
|
unkown
|
page readonly
|
||
7FF503A05000
|
unkown
|
page readonly
|
||
18D8A280000
|
unkown
|
page read and write
|
||
2B3A000
|
unkown
|
page readonly
|
||
7FF5CCF1E000
|
unkown
|
page readonly
|
||
18D885B3000
|
unkown
|
page read and write
|
||
7FF5A9BC3000
|
unkown
|
page readonly
|
||
7F0000
|
unkown
|
page readonly
|
||
73752AC000
|
unkown
|
page read and write
|
||
18D882A0000
|
unkown
|
page readonly
|
||
1BB4A400000
|
unkown
|
page read and write
|
||
28661E13000
|
unkown
|
page read and write
|
||
7FF503EA6000
|
unkown
|
page readonly
|
||
18D8A58D000
|
unkown
|
page read and write
|
||
2C28000
|
unkown
|
page readonly
|
||
5DB617A000
|
unkown
|
page read and write
|
||
18D8B310000
|
unkown
|
page read and write
|
||
7FF5A9CD7000
|
unkown
|
page readonly
|
||
2B8F000
|
unkown
|
page readonly
|
||
18D8A5B8000
|
unkown
|
page read and write
|
||
7FF5CCDA1000
|
unkown
|
page readonly
|
||
18D8B110000
|
unkown
|
page read and write
|
||
7FF57E01F000
|
unkown
|
page readonly
|
||
7FF52FD14000
|
unkown
|
page readonly
|
||
CF6A4FF000
|
unkown
|
page read and write
|
||
219E4200000
|
unkown
|
page write copy
|
||
7FF5CCB8A000
|
unkown
|
page readonly
|
||
1DB000
|
unkown
|
page read and write
|
||
19A5044F000
|
unkown
|
page read and write
|
||
7FF5848B1000
|
unkown
|
page readonly
|
||
7FF5CCCF6000
|
unkown
|
page readonly
|
||
CF69F8B000
|
unkown
|
page read and write
|
||
7FF5A9DB2000
|
unkown
|
page readonly
|
||
19A50230000
|
heap private
|
page read and write
|
||
18D8B510000
|
unkown
|
page read and write
|
||
286638D0000
|
unkown
|
page read and write
|
||
18D8A544000
|
unkown
|
page read and write
|
||
2E0D1050000
|
unkown
|
page readonly
|
||
28662000000
|
unkown
|
page readonly
|
||
5DB607D000
|
unkown
|
page read and write
|
||
7FF584626000
|
unkown
|
page readonly
|
||
18D8AB02000
|
unkown
|
page read and write
|
||
2B9F000
|
unkown
|
page readonly
|
||
35F000
|
unkown
|
page read and write
|
||
7FF57E171000
|
unkown
|
page readonly
|
||
2B8F000
|
unkown
|
page readonly
|
||
7FF5A9CBE000
|
unkown
|
page readonly
|
||
7FF57E34E000
|
unkown
|
page readonly
|
||
5DB65FB000
|
unkown
|
page read and write
|
||
C3574FF000
|
unkown
|
page read and write
|
||
7FF5CC721000
|
unkown
|
page readonly
|
||
18D88370000
|
unkown
|
page write copy
|
||
4DA0000
|
heap private
|
page read and write
|
||
2821BA13000
|
unkown
|
page read and write
|
||
7FF52FCBA000
|
unkown
|
page readonly
|
||
7FF503EAD000
|
unkown
|
page readonly
|
||
7FF505D7F000
|
unkown
|
page readonly
|
||
2B33000
|
unkown
|
page readonly
|
||
18D884DF000
|
unkown
|
page read and write
|
||
2E23FBA0000
|
unkown
|
page read and write
|
||
7FF584A60000
|
unkown
|
page readonly
|
||
7FF5CCFA4000
|
unkown
|
page readonly
|
||
1BB4A380000
|
unkown
|
page read and write
|
||
7FF584AAA000
|
unkown
|
page readonly
|
||
7FF57E441000
|
unkown
|
page readonly
|
||
18D8A663000
|
unkown
|
page read and write
|
||
19A50390000
|
unkown
|
page read and write
|
||
7FF52FBC8000
|
unkown
|
page readonly
|
||
28663D40000
|
unkown
|
page read and write
|
||
7FF52FBBB000
|
unkown
|
page readonly
|
||
7FF505ED1000
|
unkown
|
page readonly
|
||
7FF5A9D28000
|
unkown
|
page readonly
|
||
2B29000
|
unkown
|
page readonly
|
||
7FF57E3CD000
|
unkown
|
page readonly
|
||
7FF57DBB1000
|
unkown
|
page readonly
|
||
7FF5CCEBE000
|
unkown
|
page readonly
|
||
7FF505911000
|
unkown
|
page readonly
|
||
83D8E7E000
|
unkown
|
page read and write
|
||
7FF52FD2E000
|
unkown
|
page readonly
|
||
510000
|
heap default
|
page read and write
|
||
E86F87E000
|
unkown
|
page read and write
|
||
18D88572000
|
unkown
|
page read and write
|
||
6F0000
|
heap default
|
page read and write
|
||
7FF58495B000
|
unkown
|
page readonly
|
||
7FF4EDBFF000
|
unkown
|
page readonly
|
||
5624D7B000
|
unkown
|
page read and write
|
||
7FF5A9DB1000
|
unkown
|
page readonly
|
||
7FF584A5E000
|
unkown
|
page readonly
|
||
18D8B210000
|
unkown
|
page read and write
|
||
7FF4EDF68000
|
unkown
|
page readonly
|
||
2C28000
|
unkown
|
page readonly
|
||
18D8A260000
|
unkown
|
page read and write
|
||
7FF5842B7000
|
unkown
|
page readonly
|
||
7FF52FD39000
|
unkown
|
page readonly
|
||
7FF503D2B000
|
unkown
|
page readonly
|
||
7FF5CCE60000
|
unkown
|
page readonly
|
||
5DB5D79000
|
unkown
|
page read and write
|
||
18D88487000
|
unkown
|
page read and write
|
||
562507E000
|
unkown
|
page read and write
|
||
2A60000
|
unkown
|
page readonly
|
There are 818 hidden memdumps, click here to show them.