Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Quotation.jar
|
Zip archive data, at least v2.0 to extract
|
initial sample
|
 |
|
|
C:\cmdlinestart.log
|
ASCII text, with CRLF, LF line terminators
|
modified
|
|
|
|
C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d83e2.timestamp
|
ASCII text, with CRLF line terminators
|
dropped
|
 |
|
|
C:\jar\META-INF\MANIFEST.MF
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\jar\carLambo\AaISogscfReXxeZKUWBlO.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\BvHpAJlEksWthemKshuQp.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\CSvxxbhsMkFgzwSLJPuno.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\DaHdKpqpmbwOJzFdSfJTr.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\FirstRun.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\GDI32.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\HBrowserNativeApis.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\HhGNtKoTftxMhSSBMJnzt.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\IXoamLVdxZHhnOCKEypnx.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\IjxLOzQLUDkaXnjBGOAoG.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\IsPDtEuhSpLxTtNBFQXAi.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\JJNChPaoaJuTageKFIyUf.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\JXeuHETDDBNayfsmagXfz.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\JZxxYGNZPNJezbPxNUZCd.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\KFplBMCKgMdHvcMkaAGZa.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\Kernel32.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\KosQXPANrWiAsLTBDYIav.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\LTsbSrnXqNHTzSCadLztL.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\ONjFQMbZKhXUIvJECkqdG.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\RdldwsORcdxmkhJVwhbLi.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\SLINEyhIcNChZpywErVgS.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\TlNoUrOpQFTDEOhhEkJkV.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\TwJpMYXWnMJHKsRderDDT.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\UWPKqDtrtuRkfgJqVaIfH.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\User32.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\WinGDI.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\XmcgWVirDwLliVZTBfoxa.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\XtGDgqPPFsffwvuGLMVrE.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\YAscrrsjSCEINprDrLpVw.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\ZYEcYXbRzHYFyZblHqtZQ.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\bblLjaykILRsJuIgHpxpV.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\bmfvovJGUyUbPgySKkkcq.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\bzlBSuuREhLCmheoxRLoe.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\cNhfmljIASGhxQnqNJuWx.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\dYjHcUTAJpBUzZmyvwxcg.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\eauxCIrdjXbTstchfeoOk.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\hBkzOcczVKCAHBldijzvK.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\hWdmIbubOgKXDUyGkTEEB.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\hYsqcGfbELOwxudanKXov.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\hccNzYOZzwIxSugKtwNFq.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\iUmCoRfIFAQoefdxTBoVc.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\jsGSSBxDsfgZgmNRCCRge.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\kKDEXLppEHnYcckGnnxxg.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\kqfTtOdPWqoSaOdKfHjPr.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\ktqJfqRpauSAGkfJbNchr.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\lXiQWxbivgQpkaqCCfVKY.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\mdNVabGLtSgHprawsRQOv.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\nYKUJiPDMFquwRpKFElAD.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\oGMqziBzYYxWXtOgENcol.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\qAnFfCeztBRNXnxmfAymy.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\qNjCcZeKvVwoJRxKdiCbn.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\qSvSnaYHzthBBeWOIMBaB.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\qcwPdWnKTLcdPxDSEKqai.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\resources\config.txt
|
ASCII text, with no line terminators
|
dropped
|
|
|
|
C:\jar\carLambo\sbsQDGLLzqONvAeirLUFR.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\sdQKOtlJzWCBporuolMyN.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\susnFxnUwlidMWpefYbJj.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\tSrrFgcYOfUSarEmZIkay.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\uinODIkCilGXJDaSnyVJx.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\unFpTnLKGCoDhhTwCythd.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\vISXLMxulVKJDJdBSbyBW.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\vPGWlacnCrelHWkRFSJnJ.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\wparXSrkmxMhKOZjMNKKu.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\jar\carLambo\yLBVjlynSgWMgvIJTRRcy.class
|
compiled Java class data, version 49.0 (Java 1.5)
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\83aa4cc77f591dfc2374580bbd95f6ba_d06ed635-68f6-4e9a-955c-4899f5f57b9a
|
data
|
dropped
|
|
There are 59 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe
|
java.exe -jar 'C:\Users\user\Desktop\Quotation.jar' carLambo.FirstRun
|
|
|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Quotation.jar'
|
|
|
|
C:\Windows\System32\7za.exe
|
7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Quotation.jar'
|
|
|
|
C:\Windows\System32\cmd.exe
|
'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\Quotation.jar' carLambo.FirstRun >> C:\cmdlinestart.log
2>&1
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
|
|
C:\Windows\SysWOW64\icacls.exe
|
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c ''C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar'
-jar 'C:\Users\user\Desktop\Quotation.jar'' >> C:\cmdlinestart.log 2>&1
|
|
|
|
C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
|
'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar' -jar
'C:\Users\user\Desktop\Quotation.jar'
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://crl.xrampsecurity.com/XGCA.crl
|
unknown
|
|
|
|
https://repo1.maven.org/maven2/net/java/dev/jna/jna-platform/5.5.0/jna-platform-5.5.0.jar
|
unknown
|
|
|
|
http://crl.chambersign.org/chambersroot.crl0
|
unknown
|
|
|
|
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
|
unknown
|
|
|
|
http://www.certplus.com/CRL/class2.crl
|
unknown
|
|
|
|
http://bugreport.sun.com/bugreport/
|
unknown
|
|
|
|
http://cps.chambersign.org/cps/chambersroot.html0
|
unknown
|
|
|
|
http://java.oracle.com/
|
unknown
|
|
|
|
http://null.oracle.com/
|
unknown
|
|
|
|
http://www.chambersign.org1
|
unknown
|
|
|
|
http://repository.swisssign.com/0
|
unknown
|
|
|
|
https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jar
|
unknown
|
|
|
|
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
|
unknown
|
|
|
|
http://policy.camerfirma.com
|
unknown
|
|
|
|
https://ocsp.quovadisoffshore.com
|
unknown
|
|
|
|
https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.14.2.1/sqlite-jdbc-3.14.2.1.jar
|
unknown
|
|
|
|
http://crl.securetrust.com/STCA.crl0
|
unknown
|
|
|
|
http://www.quovadisglobal.com/cps
|
unknown
|
|
|
|
http://cps.chambersign.org/cps/chambersroot.html
|
unknown
|
|
|
|
http://www.certplus.com/CRL/class3P.crl
|
unknown
|
|
|
|
http://www.certplus.com/CRL/class3P.crl0
|
unknown
|
|
|
|
http://crl.securetrust.com/STCA.crl
|
unknown
|
|
|
|
http://www.certplus.com/CRL/class2.crl0
|
unknown
|
|
|
|
http://www.quovadisglobal.com/cps0
|
unknown
|
|
|
|
http://crl.xrampsecurity.com/XGCA.crl0
|
unknown
|
|
|
|
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
|
unknown
|
|
|
|
http://www.quovadis.bm
|
unknown
|
|
|
|
http://www.quovadis.bm0
|
unknown
|
|
|
|
https://ocsp.quovadisoffshore.com0
|
unknown
|
|
|
|
http://www.allatori.com
|
unknown
|
|
|
|
http://crl.chambersign.org/chambersroot.crl
|
unknown
|
|
|
|
http://repository.swisssign.com/
|
unknown
|
|
|
|
http://www.chambersign.org
|
unknown
|
|
|
|
https://github.com/kristian/system-hook/releases/download/3.5/system-hook-3.5.jar
|
unknown
|
|
|
|
http://policy.camerfirma.com0
|
unknown
|
|
|
|
https://github.com/krist
|
unknown
|
|
There are 26 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
sonatype.map.fastly.net
|
199.232.192.209
|
|
|
|
github.com
|
140.82.121.3
|
|
|
|
repo1.maven.org
|
unknown
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
192.168.2.1
|
unknown
|
unknown
|
|
|
|
199.232.192.209
|
sonatype.map.fastly.net
|
United States
|
|
|
|
140.82.121.3
|
github.com
|
United States
|
|
|
|
140.82.121.4
|
unknown
|
United States
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
53F0000
|
unkown
|
page read and write
|
|
|
|
A7A5000
|
unkown
|
page read and write
|
|
|
|
A76A000
|
unkown
|
page read and write
|
|
|
|
7FF5D2F97000
|
unkown image
|
page readonly
|
|
|
|
D2E000
|
unkown
|
page read and write
|
|
|
|
1FF5BE50000
|
unkown image
|
page readonly
|
|
|
|
A79C000
|
unkown
|
page read and write
|
|
|
|
1FF5C0F0000
|
unkown
|
page read and write
|
|
|
|
AE8000
|
unkown
|
page read and write
|
|
|
|
7DF5DD040000
|
unkown image
|
page readonly
|
|
|
|
25B94E2D000
|
unkown
|
page read and write
|
|
|
|
7FF5D3181000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3154000
|
unkown image
|
page readonly
|
|
|
|
7DF5C2B30000
|
unkown image
|
page readonly
|
|
|
|
25B94E00000
|
unkown
|
page read and write
|
|
|
|
7FF5B8D5A000
|
unkown image
|
page readonly
|
|
|
|
A925000
|
unkown
|
page read and write
|
|
|
|
1FF5C120000
|
heap private
|
page read and write
|
|
|
|
FF462000
|
unkown image
|
page readonly
|
|
|
|
7FF5D2C3A000
|
unkown image
|
page readonly
|
|
|
|
7FF5D323D000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D73000
|
unkown image
|
page readonly
|
|
|
|
7DF4C09F0000
|
unkown image
|
page readonly
|
|
|
|
25B94EF5000
|
unkown
|
page read and write
|
|
|
|
15C8B000
|
unkown
|
page read and write
|
|
|
|
1699E000
|
unkown
|
page read and write
|
|
|
|
12F0000
|
unkown
|
page read and write
|
|
|
|
7FF5D2F2D000
|
unkown image
|
page readonly
|
|
|
|
7FF5D318F000
|
unkown image
|
page readonly
|
|
|
|
2FFE000
|
unkown
|
page read and write
|
|
|
|
2710000
|
unkown
|
page read and write
|
|
|
|
30C2000
|
unkown
|
page execute and read and write
|
|
|
|
7FFC0000
|
unkown image
|
page readonly
|
|
|
|
94D000
|
unkown
|
page read and write
|
|
|
|
7DF5C2B30000
|
unkown image
|
page readonly
|
|
|
|
7FF5D30F1000
|
unkown image
|
page readonly
|
|
|
|
25B8FD30000
|
unkown
|
page read and write
|
|
|
|
7FF5D2DE2000
|
unkown image
|
page readonly
|
|
|
|
3227000
|
heap default
|
page read and write
|
|
|
|
7FF5D31AA000
|
unkown image
|
page readonly
|
|
|
|
25B90501000
|
unkown
|
page read and write
|
|
|
|
7F5B0000
|
unkown image
|
page readonly
|
|
|
|
7FF5D302F000
|
unkown image
|
page readonly
|
|
|
|
7DF5C2B22000
|
unkown image
|
page readonly
|
|
|
|
25B8F676000
|
unkown
|
page read and write
|
|
|
|
7FF5D2C3F000
|
unkown image
|
page readonly
|
|
|
|
1FF5C100000
|
unkown
|
page read and write
|
|
|
|
7DF5C2B32000
|
unkown image
|
page readonly
|
|
|
|
57467BB000
|
unkown
|
page read and write
|
|
|
|
25B8F5E0000
|
unkown image
|
page readonly
|
|
|
|
7FF5D319D000
|
unkown image
|
page readonly
|
|
|
|
505E000
|
unkown
|
page read and write
|
|
|
|
15646000
|
unkown
|
page read and write
|
|
|
|
7FF5B8D87000
|
unkown image
|
page readonly
|
|
|
|
2D61000
|
unkown image
|
page readonly
|
|
|
|
793627F000
|
unkown
|
page read and write
|
|
|
|
D0C000
|
unkown
|
page read and write
|
|
|
|
A8C7000
|
unkown
|
page read and write
|
|
|
|
1FF5C125000
|
heap private
|
page read and write
|
|
|
|
5746C7E000
|
unkown
|
page read and write
|
|
|
|
25B8F5D0000
|
heap default
|
page read and write
|
|
|
|
5746AFE000
|
unkown
|
page read and write
|
|
|
|
25B94C70000
|
unkown
|
page read and write
|
|
|
|
7F5C0000
|
unkown image
|
page readonly
|
|
|
|
1FF5CDE0000
|
unkown
|
page read and write
|
|
|
|
7F5A0000
|
unkown image
|
page readonly
|
|
|
|
A770000
|
unkown
|
page read and write
|
|
|
|
1571D000
|
unkown
|
page read and write
|
|
|
|
7DF5DD022000
|
unkown image
|
page readonly
|
|
|
|
7DF5C2B40000
|
unkown image
|
page readonly
|
|
|
|
15200000
|
unkown
|
page read and write
|
|
|
|
25B8F702000
|
unkown
|
page read and write
|
|
|
|
A7A7000
|
unkown
|
page read and write
|
|
|
|
7FF5D2A50000
|
unkown image
|
page readonly
|
|
|
|
15B3E000
|
unkown
|
page read and write
|
|
|
|
651000
|
unkown
|
page read and write
|
|
|
|
7FF5B8D31000
|
unkown image
|
page readonly
|
|
|
|
25B94C30000
|
unkown
|
page read and write
|
|
|
|
7FF5D2F55000
|
unkown image
|
page readonly
|
|
|
|
990000
|
unkown image
|
page readonly
|
|
|
|
51D9000
|
unkown image
|
page read and write
|
|
|
|
25B94B10000
|
unkown
|
page read and write
|
|
|
|
7FF5B84CB000
|
unkown image
|
page readonly
|
|
|
|
AE0000
|
unkown
|
page read and write
|
|
|
|
9A0000
|
unkown image
|
page readonly
|
|
|
|
1FF5BEF1000
|
heap default
|
page read and write
|
|
|
|
25B8F613000
|
unkown
|
page read and write
|
|
|
|
7DF5DD020000
|
unkown image
|
page readonly
|
|
|
|
520000
|
unkown image
|
page read and write
|
|
|
|
7DF5C2B20000
|
unkown image
|
page readonly
|
|
|
|
7FF5D325A000
|
unkown image
|
page readonly
|
|
|
|
25B8FC50000
|
unkown image
|
page readonly
|
|
|
|
7FF5D317F000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D76000
|
unkown image
|
page readonly
|
|
|
|
7FF5D302A000
|
unkown image
|
page readonly
|
|
|
|
2D30000
|
unkown image
|
page readonly
|
|
|
|
50EE000
|
unkown
|
page read and write
|
|
|
|
1FF5CD70000
|
unkown
|
page readonly
|
|
|
|
25B94C54000
|
unkown
|
page read and write
|
|
|
|
1598E000
|
unkown
|
page read and write
|
|
|
|
990000
|
unkown
|
page read and write
|
|
|
|
15BA2000
|
unkown
|
page read and write
|
|
|
|
15C98000
|
unkown
|
page read and write
|
|
|
|
A8C0000
|
unkown
|
page read and write
|
|
|
|
25B90520000
|
unkown image
|
page read and write
|
|
|
|
25B94C74000
|
unkown
|
page read and write
|
|
|
|
1FF5C0E0000
|
unkown
|
page read and write
|
|
|
|
25B94C30000
|
unkown
|
page read and write
|
|
|
|
FF460000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8C94000
|
unkown image
|
page readonly
|
|
|
|
15660000
|
unkown
|
page read and write
|
|
|
|
1358000
|
heap default
|
page read and write
|
|
|
|
25B94B30000
|
unkown
|
page read and write
|
|
|
|
25B94EA4000
|
unkown
|
page read and write
|
|
|
|
25B94EF9000
|
unkown
|
page read and write
|
|
|
|
25B8FE15000
|
unkown
|
page read and write
|
|
|
|
159DF000
|
unkown
|
page read and write
|
|
|
|
1FF5C130000
|
unkown
|
page read and write
|
|
|
|
AF0000
|
heap default
|
page read and write
|
|
|
|
16AD0000
|
unkown
|
page read and write
|
|
|
|
7FFB2000
|
unkown image
|
page readonly
|
|
|
|
25B8F8D0000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8CA6000
|
unkown image
|
page readonly
|
|
|
|
513F000
|
unkown
|
page read and write
|
|
|
|
8FC000
|
unkown
|
page read and write
|
|
|
|
7FF5D2DB2000
|
unkown image
|
page readonly
|
|
|
|
1FF5BE10000
|
unkown image
|
page read and write
|
|
|
|
7FF5D31CD000
|
unkown image
|
page readonly
|
|
|
|
25B8F5A0000
|
unkown image
|
page readonly
|
|
|
|
FF360000
|
unkown image
|
page readonly
|
|
|
|
25B8FC60000
|
unkown image
|
page readonly
|
|
|
|
1FF5BF2D000
|
unkown
|
page read and write
|
|
|
|
7FF5D2FBE000
|
unkown image
|
page readonly
|
|
|
|
1FF5BE30000
|
unkown image
|
page readonly
|
|
|
|
E80000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3033000
|
unkown image
|
page readonly
|
|
|
|
7FF5D2F79000
|
unkown image
|
page readonly
|
|
|
|
2E38000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D4B000
|
unkown image
|
page readonly
|
|
|
|
25B94B20000
|
unkown
|
page read and write
|
|
|
|
1FF5BE20000
|
unkown
|
page read and write
|
|
|
|
7935E7F000
|
unkown
|
page read and write
|
|
|
|
7FF5B8CD7000
|
unkown image
|
page readonly
|
|
|
|
25B94EEA000
|
unkown
|
page read and write
|
|
|
|
51CF000
|
unkown
|
page read and write
|
|
|
|
15C7B000
|
unkown
|
page read and write
|
|
|
|
793677C000
|
unkown
|
page read and write
|
|
|
|
7FF5D3164000
|
unkown image
|
page readonly
|
|
|
|
A7E3000
|
unkown
|
page read and write
|
|
|
|
7FF5D3105000
|
unkown image
|
page readonly
|
|
|
|
2D5D000
|
unkown image
|
page readonly
|
|
|
|
79361FF000
|
unkown
|
page read and write
|
|
|
|
1FF5CD90000
|
unkown
|
page read and write
|
|
|
|
25B8F6F9000
|
unkown
|
page read and write
|
|
|
|
3020000
|
unkown
|
page execute and read and write
|
|
|
|
25B8F671000
|
unkown
|
page read and write
|
|
|
|
3210000
|
heap default
|
page read and write
|
|
|
|
305A000
|
unkown
|
page execute and read and write
|
|
|
|
25B8FF13000
|
unkown
|
page read and write
|
|
|
|
1620F000
|
unkown
|
page read and write
|
|
|
|
25B94F00000
|
unkown
|
page read and write
|
|
|
|
7F5C0000
|
unkown image
|
page readonly
|
|
|
|
793667E000
|
unkown
|
page read and write
|
|
|
|
E6E000
|
unkown
|
page read and write
|
|
|
|
A841000
|
unkown
|
page read and write
|
|
|
|
1569C000
|
unkown
|
page read and write
|
|
|
|
7FF5D31D9000
|
unkown image
|
page readonly
|
|
|
|
305E000
|
unkown
|
page execute and read and write
|
|
|
|
5E0000
|
heap default
|
page read and write
|
|
|
|
1624E000
|
unkown
|
page read and write
|
|
|
|
2C20000
|
unkown
|
page read and write
|
|
|
|
A920000
|
unkown
|
page read and write
|
|
|
|
5431000
|
unkown
|
page read and write
|
|
|
|
1FF5BF2D000
|
unkown
|
page read and write
|
|
|
|
7FF5D3231000
|
unkown image
|
page readonly
|
|
|
|
7DF5C2B40000
|
unkown image
|
page readonly
|
|
|
|
25B94EF7000
|
unkown
|
page read and write
|
|
|
|
D80000
|
heap default
|
page read and write
|
|
|
|
7DF5DD032000
|
unkown image
|
page readonly
|
|
|
|
25B8FF58000
|
unkown
|
page read and write
|
|
|
|
3217000
|
heap default
|
page read and write
|
|
|
|
7FF5B8CD9000
|
unkown image
|
page readonly
|
|
|
|
16520000
|
unkown
|
page read and write
|
|
|
|
A7CF000
|
unkown
|
page read and write
|
|
|
|
A824000
|
unkown
|
page read and write
|
|
|
|
7FFC0000
|
unkown image
|
page readonly
|
|
|
|
5746A7E000
|
unkown
|
page read and write
|
|
|
|
5200000
|
unkown
|
page read and write
|
|
|
|
7FF5D2F90000
|
unkown image
|
page readonly
|
|
|
|
7FF5D2DFC000
|
unkown image
|
page readonly
|
|
|
|
7FF5D304F000
|
unkown image
|
page readonly
|
|
|
|
8F0000
|
unkown image
|
page readonly
|
|
|
|
15F90000
|
unkown
|
page read and write
|
|
|
|
12F0000
|
unkown image
|
page readonly
|
|
|
|
8E0000
|
unkown image
|
page read and write
|
|
|
|
1FF5CD80000
|
unkown
|
page read and write
|
|
|
|
25B8F68A000
|
unkown
|
page read and write
|
|
|
|
25B90A80000
|
unkown
|
page read and write
|
|
|
|
7935B7D000
|
unkown
|
page read and write
|
|
|
|
170D0000
|
unkown
|
page read and write
|
|
|
|
55A3000
|
unkown
|
page read and write
|
|
|
|
53DE000
|
unkown
|
page read and write
|
|
|
|
25B94D80000
|
unkown
|
page read and write
|
|
|
|
7FF5D2FE4000
|
unkown image
|
page readonly
|
|
|
|
15C8F000
|
unkown
|
page read and write
|
|
|
|
D10000
|
unkown image
|
page readonly
|
|
|
|
8F0000
|
unkown image
|
page readonly
|
|
|
|
A819000
|
unkown
|
page read and write
|
|
|
|
7FF5B8CCD000
|
unkown image
|
page readonly
|
|
|
|
25B94C51000
|
unkown
|
page read and write
|
|
|
|
C60000
|
unkown image
|
page readonly
|
|
|
|
7FF5D2A6B000
|
unkown image
|
page readonly
|
|
|
|
7DF5C2B20000
|
unkown image
|
page readonly
|
|
|
|
7935C7B000
|
unkown
|
page read and write
|
|
|
|
25B8F713000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3148000
|
unkown image
|
page readonly
|
|
|
|
2D5A000
|
unkown image
|
page readonly
|
|
|
|
25B8FF59000
|
unkown
|
page read and write
|
|
|
|
7FF5D3276000
|
unkown image
|
page readonly
|
|
|
|
25B8F656000
|
unkown
|
page read and write
|
|
|
|
25B8F600000
|
unkown
|
page read and write
|
|
|
|
2E10000
|
heap private
|
page read and write
|
|
|
|
25B8F580000
|
unkown image
|
page readonly
|
|
|
|
25B8FAD0000
|
unkown image
|
page readonly
|
|
|
|
1FF5BF2D000
|
unkown
|
page read and write
|
|
|
|
7FF5D2F86000
|
unkown image
|
page readonly
|
|
|
|
25B94C3E000
|
unkown
|
page read and write
|
|
|
|
51E4000
|
unkown image
|
page read and write
|
|
|
|
7FF5D31C6000
|
unkown image
|
page readonly
|
|
|
|
7DF5DD030000
|
unkown image
|
page readonly
|
|
|
|
30BB000
|
unkown
|
page execute and read and write
|
|
|
|
FF470000
|
unkown image
|
page readonly
|
|
|
|
E90000
|
unkown
|
page read and write
|
|
|
|
7FF5D2F48000
|
unkown image
|
page readonly
|
|
|
|
164BD000
|
unkown
|
page read and write
|
|
|
|
7FF5B8738000
|
unkown image
|
page readonly
|
|
|
|
7DF5DD020000
|
unkown image
|
page readonly
|
|
|
|
1FF5C540000
|
unkown image
|
page readonly
|
|
|
|
E20000
|
heap default
|
page read and write
|
|
|
|
DCE000
|
unkown
|
page read and write
|
|
|
|
7FFA0000
|
unkown image
|
page readonly
|
|
|
|
2E20000
|
unkown
|
page read and write
|
|
|
|
15C96000
|
unkown
|
page read and write
|
|
|
|
7DF5DD040000
|
unkown image
|
page readonly
|
|
|
|
15C65000
|
unkown
|
page read and write
|
|
|
|
15B90000
|
unkown
|
page read and write
|
|
|
|
7FFB2000
|
unkown image
|
page readonly
|
|
|
|
1FF5BE60000
|
unkown image
|
page readonly
|
|
|
|
25B906E0000
|
unkown image
|
page readonly
|
|
|
|
16C1F000
|
unkown
|
page read and write
|
|
|
|
169D0000
|
unkown
|
page read and write
|
|
|
|
5746CFB000
|
unkown
|
page read and write
|
|
|
|
7F5A2000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3169000
|
unkown image
|
page readonly
|
|
|
|
25B94D90000
|
unkown
|
page read and write
|
|
|
|
25B94E3F000
|
unkown
|
page read and write
|
|
|
|
7DF5DD032000
|
unkown image
|
page readonly
|
|
|
|
FF480000
|
unkown image
|
page readonly
|
|
|
|
25B94AA0000
|
unkown
|
page read and write
|
|
|
|
25B94EFB000
|
unkown
|
page read and write
|
|
|
|
25B94D90000
|
unkown
|
page read and write
|
|
|
|
25B94E1F000
|
unkown
|
page read and write
|
|
|
|
25B90710000
|
unkown image
|
page readonly
|
|
|
|
C50000
|
unkown image
|
page read and write
|
|
|
|
7935FFF000
|
unkown
|
page read and write
|
|
|
|
7F5A0000
|
unkown image
|
page readonly
|
|
|
|
1610000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3135000
|
unkown image
|
page readonly
|
|
|
|
79356AB000
|
unkown
|
page read and write
|
|
|
|
A8D3000
|
unkown
|
page read and write
|
|
|
|
25B94C60000
|
unkown
|
page read and write
|
|
|
|
1170000
|
unkown image
|
page readonly
|
|
|
|
28A0000
|
unkown
|
page read and write
|
|
|
|
7F5B2000
|
unkown image
|
page readonly
|
|
|
|
25B8F570000
|
heap private
|
page read and write
|
|
|
|
17150000
|
unkown
|
page read and write
|
|
|
|
51D6000
|
unkown image
|
page read and write
|
|
|
|
2EA8000
|
unkown
|
page read and write
|
|
|
|
16330000
|
unkown image
|
page readonly
|
|
|
|
7FF5D2F72000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D34000
|
unkown image
|
page readonly
|
|
|
|
5F0000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3193000
|
unkown image
|
page readonly
|
|
|
|
5A0000
|
unkown image
|
page readonly
|
|
|
|
25B8FF18000
|
unkown
|
page read and write
|
|
|
|
2DFE000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8601000
|
unkown image
|
page readonly
|
|
|
|
25B94D60000
|
unkown
|
page read and write
|
|
|
|
56CF000
|
unkown
|
page read and write
|
|
|
|
25B8F62A000
|
unkown
|
page read and write
|
|
|
|
2DC5000
|
unkown image
|
page readonly
|
|
|
|
2E25000
|
unkown
|
page read and write
|
|
|
|
25B94C60000
|
unkown
|
page read and write
|
|
|
|
AEC000
|
unkown
|
page read and write
|
|
|
|
25B94D00000
|
unkown
|
page read and write
|
|
|
|
1FF5BE80000
|
unkown
|
page read and write
|
|
|
|
7FF5B8D3D000
|
unkown image
|
page readonly
|
|
|
|
25B94C38000
|
unkown
|
page read and write
|
|
|
|
1590000
|
unkown image
|
page readonly
|
|
|
|
164C4000
|
heap private
|
page read and write
|
|
|
|
517E000
|
unkown
|
page read and write
|
|
|
|
7FF5D2F0C000
|
unkown image
|
page readonly
|
|
|
|
2DE1000
|
unkown image
|
page readonly
|
|
|
|
1FF5CD60000
|
unkown
|
page read and write
|
|
|
|
56AB000
|
unkown
|
page read and write
|
|
|
|
1FF5BEC0000
|
unkown image
|
page readonly
|
|
|
|
59D000
|
unkown
|
page read and write
|
|
|
|
25B94EFB000
|
unkown
|
page read and write
|
|
|
|
25B8FF18000
|
unkown
|
page read and write
|
|
|
|
7FF5D3160000
|
unkown image
|
page readonly
|
|
|
|
128C000
|
unkown
|
page read and write
|
|
|
|
7FF5B8D37000
|
unkown image
|
page readonly
|
|
|
|
E0F000
|
unkown
|
page read and write
|
|
|
|
7FF5B84C4000
|
unkown image
|
page readonly
|
|
|
|
FC0000
|
unkown
|
page read and write
|
|
|
|
25B94D90000
|
unkown
|
page read and write
|
|
|
|
25B8F673000
|
unkown
|
page read and write
|
|
|
|
25B94EE0000
|
unkown
|
page read and write
|
|
|
|
162D8000
|
unkown
|
page read and write
|
|
|
|
25B94C50000
|
unkown
|
page read and write
|
|
|
|
E25000
|
heap default
|
page read and write
|
|
|
|
7FF5D3282000
|
unkown image
|
page readonly
|
|
|
|
25B90600000
|
unkown
|
page read and write
|
|
|
|
1FF5C340000
|
unkown image
|
page readonly
|
|
|
|
1810000
|
unkown image
|
page readonly
|
|
|
|
1576E000
|
unkown
|
page read and write
|
|
|
|
15A1E000
|
unkown
|
page read and write
|
|
|
|
7F5B2000
|
unkown image
|
page readonly
|
|
|
|
7FFB0000
|
unkown image
|
page readonly
|
|
|
|
A813000
|
unkown
|
page read and write
|
|
|
|
25B8FD40000
|
unkown image
|
page read and write
|
|
|
|
7FF5B8B98000
|
unkown image
|
page readonly
|
|
|
|
7FF59DC2B000
|
unkown image
|
page readonly
|
|
|
|
2DDE000
|
unkown
|
page read and write
|
|
|
|
98E000
|
unkown
|
page read and write
|
|
|
|
1FF5C6D0000
|
unkown image
|
page readonly
|
|
|
|
7FF5D31B2000
|
unkown image
|
page readonly
|
|
|
|
3022000
|
unkown
|
page execute and read and write
|
|
|
|
15AFE000
|
unkown
|
page read and write
|
|
|
|
1FF5BF2F000
|
unkown
|
page read and write
|
|
|
|
3010000
|
heap private
|
page read and write
|
|
|
|
25B94EAC000
|
unkown
|
page read and write
|
|
|
|
1FF5C129000
|
heap private
|
page read and write
|
|
|
|
3000000
|
unkown
|
page read and write
|
|
|
|
131B000
|
heap default
|
page read and write
|
|
|
|
2D20000
|
unkown
|
page read and write
|
|
|
|
FF472000
|
unkown image
|
page readonly
|
|
|
|
25B90A90000
|
unkown
|
page read and write
|
|
|
|
25B8F686000
|
unkown
|
page read and write
|
|
|
|
25B94D70000
|
unkown
|
page read and write
|
|
|
|
7F5B0000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D87000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8BC8000
|
unkown image
|
page readonly
|
|
|
|
161BE000
|
unkown
|
page read and write
|
|
|
|
7935D79000
|
unkown
|
page read and write
|
|
|
|
7FF5B8CC6000
|
unkown image
|
page readonly
|
|
|
|
FF460000
|
unkown image
|
page readonly
|
|
|
|
7FF5B84CF000
|
unkown image
|
page readonly
|
|
|
|
1347000
|
heap default
|
page read and write
|
|
|
|
E70000
|
unkown image
|
page readonly
|
|
|
|
25B94A90000
|
unkown
|
page read and write
|
|
|
|
25B94D40000
|
unkown
|
page read and write
|
|
|
|
7FF5D301A000
|
unkown image
|
page readonly
|
|
|
|
1FF5BE30000
|
unkown image
|
page readonly
|
|
|
|
7FF5D31DE000
|
unkown image
|
page readonly
|
|
|
|
7FF5D2F5F000
|
unkown image
|
page readonly
|
|
|
|
7DF5C2B32000
|
unkown image
|
page readonly
|
|
|
|
2DEE000
|
unkown image
|
page readonly
|
|
|
|
2890000
|
heap private
|
page read and write
|
|
|
|
7FF5D2FCB000
|
unkown image
|
page readonly
|
|
|
|
15B8E000
|
unkown
|
page read and write
|
|
|
|
25B8F66C000
|
unkown
|
page read and write
|
|
|
|
7FF5B8BC1000
|
unkown image
|
page readonly
|
|
|
|
7FF5D31A6000
|
unkown image
|
page readonly
|
|
|
|
1568F000
|
unkown
|
page read and write
|
|
|
|
79360FF000
|
unkown
|
page read and write
|
|
|
|
25B94F02000
|
unkown
|
page read and write
|
|
|
|
7FF5D31D7000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D47000
|
unkown image
|
page readonly
|
|
|
|
559A000
|
unkown
|
page read and write
|
|
|
|
CEF000
|
unkown
|
page read and write
|
|
|
|
FF470000
|
unkown image
|
page readonly
|
|
|
|
9F0000
|
unkown
|
page read and write
|
|
|
|
F70000
|
unkown image
|
page readonly
|
|
|
|
25B8F6A0000
|
unkown
|
page read and write
|
|
|
|
50AF000
|
unkown
|
page read and write
|
|
|
|
7FFA0000
|
unkown image
|
page readonly
|
|
|
|
7FF5D302D000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3287000
|
unkown image
|
page readonly
|
|
|
|
25B90A83000
|
unkown
|
page read and write
|
|
|
|
54D7000
|
unkown
|
page read and write
|
|
|
|
FF472000
|
unkown image
|
page readonly
|
|
|
|
25B94E4C000
|
unkown
|
page read and write
|
|
|
|
7FFB0000
|
unkown image
|
page readonly
|
|
|
|
112C000
|
unkown
|
page read and write
|
|
|
|
7FF5B8B0C000
|
unkown image
|
page readonly
|
|
|
|
540000
|
unkown image
|
page readonly
|
|
|
|
2DF3000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8945000
|
unkown image
|
page readonly
|
|
|
|
7DF5DD022000
|
unkown image
|
page readonly
|
|
|
|
25B8FE00000
|
unkown
|
page read and write
|
|
|
|
1629F000
|
unkown
|
page read and write
|
|
|
|
AF8000
|
heap default
|
page read and write
|
|
|
|
793617F000
|
unkown
|
page read and write
|
|
|
|
2E38000
|
unkown image
|
page readonly
|
|
|
|
1FF5BEA0000
|
unkown
|
page read and write
|
|
|
|
D20000
|
unkown image
|
page readonly
|
|
|
|
7FFA2000
|
unkown image
|
page readonly
|
|
|
|
164C0000
|
heap private
|
page read and write
|
|
|
|
1642E000
|
unkown
|
page read and write
|
|
|
|
30B5000
|
unkown
|
page execute and read and write
|
|
|
|
25B90730000
|
unkown image
|
page readonly
|
|
|
|
25B94E62000
|
unkown
|
page read and write
|
|
|
|
7FF5D3237000
|
unkown image
|
page readonly
|
|
|
|
16518000
|
unkown
|
page read and write
|
|
|
|
51EE000
|
unkown image
|
page read and write
|
|
|
|
1364000
|
heap default
|
page read and write
|
|
|
|
54D3000
|
unkown
|
page read and write
|
|
|
|
25B94E55000
|
unkown
|
page read and write
|
|
|
|
E00000
|
unkown
|
page read and write
|
|
|
|
7FFA2000
|
unkown image
|
page readonly
|
|
|
|
D4F000
|
unkown
|
page read and write
|
|
|
|
2895000
|
heap private
|
page read and write
|
|
|
|
E10000
|
unkown image
|
page readonly
|
|
|
|
7FF5D2A61000
|
unkown image
|
page readonly
|
|
|
|
25B8F63D000
|
unkown
|
page read and write
|
|
|
|
1647F000
|
unkown
|
page read and write
|
|
|
|
7FF5B8C7F000
|
unkown image
|
page readonly
|
|
|
|
5746B79000
|
unkown
|
page read and write
|
|
|
|
56C9000
|
unkown
|
page read and write
|
|
|
|
25B90720000
|
unkown image
|
page readonly
|
|
|
|
FF462000
|
unkown image
|
page readonly
|
|
|
|
25B8F654000
|
unkown
|
page read and write
|
|
|
|
7FF5D30C1000
|
unkown image
|
page readonly
|
|
|
|
1FF5C6C0000
|
unkown image
|
page readonly
|
|
|
|
793637A000
|
unkown
|
page read and write
|
|
|
|
7FF5D2F8A000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3157000
|
unkown image
|
page readonly
|
|
|
|
5746BF9000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown image
|
page readonly
|
|
|
|
F70000
|
heap private
|
page read and write
|
|
|
|
25B8FE02000
|
unkown
|
page read and write
|
|
|
|
1FF5BEE0000
|
heap default
|
page read and write
|
|
|
|
98C000
|
unkown
|
page read and write
|
|
|
|
15C9E000
|
unkown
|
page read and write
|
|
|
|
7FF5D3244000
|
unkown image
|
page readonly
|
|
|
|
A81E000
|
unkown
|
page read and write
|
|
|
|
306A000
|
unkown
|
page execute and read and write
|
|
|
|
25B8F6B7000
|
unkown
|
page read and write
|
|
|
|
25B94D50000
|
unkown
|
page read and write
|
|
|
|
25B906F0000
|
unkown image
|
page readonly
|
|
|
|
25B94E15000
|
unkown
|
page read and write
|
|
|
|
7FF5D2E09000
|
unkown image
|
page readonly
|
|
|
|
15C74000
|
unkown
|
page read and write
|
|
|
|
25B94D90000
|
unkown
|
page read and write
|
|
|
|
3062000
|
unkown
|
page execute and read and write
|
|
|
|
15441000
|
unkown
|
page read and write
|
|
|
|
1FF5BF26000
|
unkown
|
page read and write
|
|
|
|
793607E000
|
unkown
|
page read and write
|
|
|
|
7FF5D2FC0000
|
unkown image
|
page readonly
|
|
|
|
1FF5CB30000
|
unkown
|
page read and write
|
|
|
|
1310000
|
heap default
|
page read and write
|
|
|
|
7DF5C2B22000
|
unkown image
|
page readonly
|
|
|
|
7FF5D30C8000
|
unkown image
|
page readonly
|
|
|
|
7935F7B000
|
unkown
|
page read and write
|
|
|
|
7DF4DAEF0000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3057000
|
unkown image
|
page readonly
|
|
|
|
56C0000
|
unkown
|
page read and write
|
|
|
|
25B8F698000
|
unkown
|
page read and write
|
|
|
|
FF480000
|
unkown image
|
page readonly
|
|
|
|
3072000
|
unkown
|
page execute and read and write
|
|
|
|
7FF5D3043000
|
unkown image
|
page readonly
|
|
|
|
7935AF8000
|
unkown
|
page read and write
|
|
|
|
F6F000
|
unkown
|
page read and write
|
|
|
|
15A6E000
|
unkown
|
page read and write
|
|
|
|
D0E000
|
unkown
|
page read and write
|
|
|
|
25B94EF1000
|
unkown
|
page read and write
|
|
|
|
7FF5D3027000
|
unkown image
|
page readonly
|
|
|
|
2DE0000
|
unkown image
|
page readonly
|
|
|
|
1410000
|
unkown image
|
page readonly
|
|
|
|
25B90700000
|
unkown image
|
page readonly
|
|
|
|
7FF5D2F33000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3273000
|
unkown image
|
page readonly
|
|
|
|
1607000
|
heap private
|
page read and write
|
|
|
|
7FF5B8D44000
|
unkown image
|
page readonly
|
|
|
|
7FEA0000
|
unkown image
|
page readonly
|
|
|
|
CBC000
|
unkown
|
page read and write
|
|
|
|
7FF5D3174000
|
unkown image
|
page readonly
|
|
|
|
25B8F580000
|
unkown image
|
page readonly
|
|
|
|
1600000
|
heap private
|
page read and write
|
|
|
|
A82B000
|
unkown
|
page read and write
|
|
|
|
3015000
|
heap private
|
page read and write
|
|
|
|
7F4A0000
|
unkown image
|
page readonly
|
|
|
|
7FF5D2F44000
|
unkown image
|
page readonly
|
|
|
|
FF0000
|
unkown image
|
page read and write
|
|
|
|
2DF0000
|
unkown
|
page read and write
|
|
|
|
1130000
|
unkown
|
page read and write
|
|
|
|
C60000
|
unkown image
|
page readonly
|
|
|
|
E2E000
|
unkown
|
page read and write
|
|
|
|
25B8F5B0000
|
unkown image
|
page readonly
|
|
|
|
1FF5BEE9000
|
heap default
|
page read and write
|
|
|
|
7DF5DD030000
|
unkown image
|
page readonly
|
|
|
|
7FF5D3247000
|
unkown image
|
page readonly
|
|
|
|
12D8000
|
unkown
|
page read and write
|
|
|
|
25B8FF00000
|
unkown
|
page read and write
|
|
|
|
7FF5D2F84000
|
unkown image
|
page readonly
|
|
|
|
A750000
|
unkown
|
page read and write
|
|
|
|
25B8F68D000
|
unkown
|
page read and write
|
|
|
|
793647D000
|
unkown
|
page read and write
|
|
|
|
7FF5D3234000
|
unkown image
|
page readonly
|
|
|
|
7F5A2000
|
unkown image
|
page readonly
|
|
|
|
15AAE000
|
unkown
|
page read and write
|
|
|
|
79357AE000
|
unkown
|
page read and write
|
|
|
|
64D000
|
unkown
|
page read and write
|
|
|
|
793572E000
|
unkown
|
page read and write
|
|
|
|
7FF59DC2B000
|
unkown image
|
page readonly
|
|
|
|
15A0000
|
unkown
|
page read and write
|
|
|
|
25B8F560000
|
unkown image
|
page read and write
|
|
|
|
25B8FF02000
|
unkown
|
page read and write
|
|
|
|
AC0000
|
unkown
|
page read and write
|
|
|
|
25B94EA1000
|
unkown
|
page read and write
|
|
|
|
7FF5B8BB1000
|
unkown image
|
page readonly
|
|
|
|
160B000
|
heap private
|
page read and write
|
|
|
|
16329000
|
unkown
|
page read and write
|
|
There are 515 hidden memdumps, click here to show them.