Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
DDT_2021_0000811.xls
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Create Time/Date: Mon Oct
11 09:03:47 2021, Last Saved Time/Date: Mon Oct 11 09:03:49 2021, Security: 0, Author: b r t
|
initial sample
|
||
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FE11EBF1-42FF-48A8-B83E-55D63325209D
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://api.diagnosticssdf.office.com
|
unknown
|
||
https://login.microsoftonline.com/
|
unknown
|
||
https://shell.suite.office.com:1443
|
unknown
|
||
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
|
unknown
|
||
https://autodiscover-s.outlook.com/
|
unknown
|
||
https://roaming.edog.
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
|
unknown
|
||
https://cdn.entity.
|
unknown
|
||
https://api.addins.omex.office.net/appinfo/query
|
unknown
|
||
https://clients.config.office.net/user/v1.0/tenantassociationkey
|
unknown
|
||
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
|
unknown
|
||
https://powerlift.acompli.net
|
unknown
|
||
https://rpsticket.partnerservices.getmicrosoftkey.com
|
unknown
|
||
https://lookup.onenote.com/lookup/geolocation/v1
|
unknown
|
||
https://cortana.ai
|
unknown
|
||
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://cloudfiles.onenote.com/upload.aspx
|
unknown
|
||
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://entitlement.diagnosticssdf.office.com
|
unknown
|
||
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
|
unknown
|
||
https://api.aadrm.com/
|
unknown
|
||
https://ofcrecsvcapi-int.azurewebsites.net/
|
unknown
|
||
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
|
unknown
|
||
https://api.microsoftstream.com/api/
|
unknown
|
||
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
|
unknown
|
||
https://cr.office.com
|
unknown
|
||
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
|
unknown
|
||
https://portal.office.com/account/?ref=ClientMeControl
|
unknown
|
||
https://graph.ppe.windows.net
|
unknown
|
||
https://res.getmicrosoftkey.com/api/redemptionevents
|
unknown
|
||
https://powerlift-frontdesk.acompli.net
|
unknown
|
||
https://tasks.office.com
|
unknown
|
||
https://officeci.azurewebsites.net/api/
|
unknown
|
||
https://sr.outlook.office.net/ws/speech/recognize/assistant/work
|
unknown
|
||
https://store.office.cn/addinstemplate
|
unknown
|
||
https://api.aadrm.com
|
unknown
|
||
https://outlook.office.com/autosuggest/api/v1/init?cvid=
|
unknown
|
||
https://globaldisco.crm.dynamics.com
|
unknown
|
||
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://store.officeppe.com/addinstemplate
|
unknown
|
||
https://dev0-api.acompli.net/autodetect
|
unknown
|
||
https://www.odwebp.svc.ms
|
unknown
|
||
https://api.powerbi.com/v1.0/myorg/groups
|
unknown
|
||
https://web.microsoftstream.com/video/
|
unknown
|
||
https://graph.windows.net
|
unknown
|
||
https://dataservice.o365filtering.com/
|
unknown
|
||
https://officesetup.getmicrosoftkey.com
|
unknown
|
||
https://analysis.windows.net/powerbi/api
|
unknown
|
||
https://prod-global-autodetect.acompli.net/autodetect
|
unknown
|
||
https://outlook.office365.com/autodiscover/autodiscover.json
|
unknown
|
||
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
|
unknown
|
||
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
|
unknown
|
||
https://ncus.contentsync.
|
unknown
|
||
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
|
unknown
|
||
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
|
unknown
|
||
http://weather.service.msn.com/data.aspx
|
unknown
|
||
https://apis.live.net/v5.0/
|
unknown
|
||
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
|
unknown
|
||
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
|
unknown
|
||
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
|
unknown
|
||
https://management.azure.com
|
unknown
|
||
https://outlook.office365.com
|
unknown
|
||
https://wus2.contentsync.
|
unknown
|
||
https://incidents.diagnostics.office.com
|
unknown
|
||
https://clients.config.office.net/user/v1.0/ios
|
unknown
|
||
https://insertmedia.bing.office.net/odc/insertmedia
|
unknown
|
||
https://o365auditrealtimeingestion.manage.office.com
|
unknown
|
||
https://outlook.office365.com/api/v1.0/me/Activities
|
unknown
|
||
https://api.office.net
|
unknown
|
||
https://incidents.diagnosticssdf.office.com
|
unknown
|
||
https://asgsmsproxyapi.azurewebsites.net/
|
unknown
|
||
https://clients.config.office.net/user/v1.0/android/policies
|
unknown
|
||
https://entitlement.diagnostics.office.com
|
unknown
|
||
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
|
unknown
|
||
https://substrate.office.com/search/api/v2/init
|
unknown
|
||
https://outlook.office.com/
|
unknown
|
||
https://storage.live.com/clientlogs/uploadlocation
|
unknown
|
||
https://outlook.office365.com/
|
unknown
|
||
https://webshell.suite.office.com
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
|
unknown
|
||
https://substrate.office.com/search/api/v1/SearchHistory
|
unknown
|
||
https://management.azure.com/
|
unknown
|
||
https://login.windows.net/common/oauth2/authorize
|
unknown
|
||
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://graph.windows.net/
|
unknown
|
||
https://api.powerbi.com/beta/myorg/imports
|
unknown
|
||
https://devnull.onenote.com
|
unknown
|
||
https://ncus.pagecontentsync.
|
unknown
|
||
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
|
unknown
|
||
https://messaging.office.com/
|
unknown
|
||
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://augloop.office.com/v2
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
|
unknown
|
||
https://skyapi.live.net/Activity/
|
unknown
|
||
https://clients.config.office.net/user/v1.0/mac
|
unknown
|
||
https://dataservice.o365filtering.com
|
unknown
|
||
https://api.cortana.ai
|
unknown
|
||
https://onedrive.live.com
|
unknown
|
||
https://ovisualuiapp.azurewebsites.net/pbiagave/
|
unknown
|
There are 90 hidden URLs, click here to show them.
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
|
.0
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
|
/0
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache
|
RemoteClearDate
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3
|
Last
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
FilePath
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
StartDate
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
EndDate
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
Properties
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
Url
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache
|
LastClean
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableWinHttpCertAuth
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableIsOwnerRegex
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableSessionAwareHttpClose
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableADALForExtendedApps
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableADALSetSilentAuth
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
msoridDisableGuestCredProvider
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
msoridDisableOstringReplace
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\IOAV
|
LastBootTime
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
VBAFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ExdCache\Excel8.0
|
MSForms
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ExdCache\Excel8.0
|
MSComctlLib
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ReviewCycle
|
ReviewToken
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\4D251
|
4D251
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
|
z=
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-US
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-US
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
EXCELFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
|
RoamingConfigurableSettings
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
|
RoamingLastSyncTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
|
RoamingLastWriteTime
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\IOAV
|
LastBootTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
~s%
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
|
MTTT
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
VBAFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
|
ReviewToken
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\2D29A
|
2D29A
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
wv%
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\3311E
|
3311E
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\331BA
|
331BA
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
EXCELFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
There are 82 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
7DF523A62000
|
unkown image
|
page readonly
|
||
7FF58A8A4000
|
unkown image
|
page readonly
|
||
1A87D4A8000
|
unkown
|
page read and write
|
||
1A87DD77000
|
unkown
|
page read and write
|
||
344BF7B000
|
unkown
|
page read and write
|
||
1A87DDD5000
|
unkown
|
page read and write
|
||
1F3AF7D0000
|
unkown image
|
page readonly
|
||
7DF5DE472000
|
unkown image
|
page readonly
|
||
7FF58A79D000
|
unkown image
|
page readonly
|
||
1D869A02000
|
unkown
|
page read and write
|
||
7FF58A5C7000
|
unkown image
|
page readonly
|
||
7DF5DE470000
|
unkown image
|
page readonly
|
||
1A87D455000
|
unkown
|
page read and write
|
||
7FF58A711000
|
unkown image
|
page readonly
|
||
7DF523A60000
|
unkown image
|
page readonly
|
||
7FF50E8DE000
|
unkown image
|
page readonly
|
||
7FF58A753000
|
unkown image
|
page readonly
|
||
27B1FF02000
|
unkown
|
page read and write
|
||
1F3AF690000
|
unkown image
|
page readonly
|
||
27B1FD20000
|
unkown image
|
page readonly
|
||
1A87D508000
|
unkown
|
page read and write
|
||
1A87DD00000
|
unkown
|
page read and write
|
||
1A87DD76000
|
unkown
|
page read and write
|
||
1A87D44C000
|
unkown
|
page read and write
|
||
7FF58A824000
|
unkown image
|
page readonly
|
||
1A87D429000
|
unkown
|
page read and write
|
||
7DF59F9D2000
|
unkown image
|
page readonly
|
||
7FF58A758000
|
unkown image
|
page readonly
|
||
7FF58A467000
|
unkown image
|
page readonly
|
||
1D869300000
|
unkown
|
page read and write
|
||
1A87DC02000
|
unkown
|
page read and write
|
||
4D6807F000
|
unkown
|
page read and write
|
||
27B1FD20000
|
unkown image
|
page readonly
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
1A87DDB1000
|
unkown
|
page read and write
|
||
1A87DD6E000
|
unkown
|
page read and write
|
||
1A87DD5A000
|
unkown
|
page read and write
|
||
1A87DDA4000
|
unkown
|
page read and write
|
||
1A87D45D000
|
unkown
|
page read and write
|
||
1A87DDB5000
|
unkown
|
page read and write
|
||
7FF5C92FB000
|
unkown image
|
page readonly
|
||
1A87DD7F000
|
unkown
|
page read and write
|
||
7FF5B145F000
|
unkown image
|
page readonly
|
||
7FF50E8EB000
|
unkown image
|
page readonly
|
||
7FF58A74E000
|
unkown image
|
page readonly
|
||
1A87D300000
|
heap private
|
page read and write
|
||
1A87DD74000
|
unkown
|
page read and write
|
||
7DF5DE470000
|
unkown image
|
page readonly
|
||
1A87D44D000
|
unkown
|
page read and write
|
||
27B1FE00000
|
unkown
|
page read and write
|
||
1A87D457000
|
unkown
|
page read and write
|
||
4D6817E000
|
unkown
|
page read and write
|
||
1A87DDD6000
|
unkown
|
page read and write
|
||
27B20602000
|
unkown
|
page read and write
|
||
1A87DD76000
|
unkown
|
page read and write
|
||
1A87DD7E000
|
unkown
|
page read and write
|
||
1A87D4C5000
|
unkown
|
page read and write
|
||
1A87D458000
|
unkown
|
page read and write
|
||
7FF50E956000
|
unkown image
|
page readonly
|
||
7DF5C65B2000
|
unkown image
|
page readonly
|
||
7DF49D890000
|
unkown image
|
page readonly
|
||
1A87DDA5000
|
unkown
|
page read and write
|
||
7FF5B145C000
|
unkown image
|
page readonly
|
||
1A87DD98000
|
unkown
|
page read and write
|
||
1A87D4A7000
|
unkown
|
page read and write
|
||
27B1FDA0000
|
unkown
|
page read and write
|
||
7FF5B1005000
|
unkown image
|
page readonly
|
||
7FF5C931C000
|
unkown image
|
page readonly
|
||
7FF5C9344000
|
unkown image
|
page readonly
|
||
344B67E000
|
unkown
|
page read and write
|
||
1A87DD9A000
|
unkown
|
page read and write
|
||
7FF50E948000
|
unkown image
|
page readonly
|
||
7FF58A855000
|
unkown image
|
page readonly
|
||
7DF5C65A2000
|
unkown image
|
page readonly
|
||
7FF58A7A3000
|
unkown image
|
page readonly
|
||
7FF50E7A1000
|
unkown image
|
page readonly
|
||
27B1FF08000
|
unkown
|
page read and write
|
||
7FF50E783000
|
unkown image
|
page readonly
|
||
1D86923C000
|
unkown
|
page read and write
|
||
27B1FE29000
|
unkown
|
page read and write
|
||
D76E07F000
|
unkown
|
page read and write
|
||
7FF50E90C000
|
unkown image
|
page readonly
|
||
1A87D44A000
|
unkown
|
page read and write
|
||
1A87DDA4000
|
unkown
|
page read and write
|
||
1A87DD95000
|
unkown
|
page read and write
|
||
1A87D513000
|
unkown
|
page read and write
|
||
1A87DDA4000
|
unkown
|
page read and write
|
||
1D869308000
|
unkown
|
page read and write
|
||
1D8696D0000
|
unkown image
|
page readonly
|
||
7FF5B147A000
|
unkown image
|
page readonly
|
||
7FF58A6FA000
|
unkown image
|
page readonly
|
||
7FF58A691000
|
unkown image
|
page readonly
|
||
7DF523A52000
|
unkown image
|
page readonly
|
||
1A87E202000
|
unkown
|
page read and write
|
||
1A87DDAF000
|
unkown
|
page read and write
|
||
27B200D0000
|
unkown image
|
page readonly
|
||
7FF58A8C6000
|
unkown image
|
page readonly
|
||
4D67F77000
|
unkown
|
page read and write
|
||
1A87DDA6000
|
unkown
|
page read and write
|
||
1A87D470000
|
unkown
|
page read and write
|
||
7DF5C65B0000
|
unkown image
|
page readonly
|
||
7FF58A60B000
|
unkown image
|
page readonly
|
||
1A87D400000
|
unkown
|
page read and write
|
||
1A87DDA3000
|
unkown
|
page read and write
|
||
D76DBFB000
|
unkown
|
page read and write
|
||
7DF59F9C0000
|
unkown image
|
page readonly
|
||
1D8691D0000
|
unkown image
|
page readonly
|
||
7FF5B132B000
|
unkown image
|
page readonly
|
||
1A87DD7D000
|
unkown
|
page read and write
|
||
344C07F000
|
unkown
|
page read and write
|
||
7FF50E4B5000
|
unkown image
|
page readonly
|
||
7FF58A6A1000
|
unkown image
|
page readonly
|
||
1F3AFB20000
|
heap private
|
page read and write
|
||
7FF50E917000
|
unkown image
|
page readonly
|
||
7DF523A62000
|
unkown image
|
page readonly
|
||
1A87D310000
|
unkown image
|
page readonly
|
||
7FF5B142A000
|
unkown image
|
page readonly
|
||
27B1FD70000
|
heap default
|
page read and write
|
||
1A87DD78000
|
unkown
|
page read and write
|
||
1D8691C0000
|
unkown image
|
page readonly
|
||
7FF5B0FF0000
|
unkown image
|
page readonly
|
||
1A87E202000
|
unkown
|
page read and write
|
||
7FF58A8BE000
|
unkown image
|
page readonly
|
||
7DF59F9E0000
|
unkown image
|
page readonly
|
||
7DF5C65B2000
|
unkown image
|
page readonly
|
||
344B7FC000
|
unkown
|
page read and write
|
||
1A87DDA4000
|
unkown
|
page read and write
|
||
27B1FD50000
|
unkown image
|
page readonly
|
||
7FF58A7BC000
|
unkown image
|
page readonly
|
||
1A87DB80000
|
unkown
|
page read and write
|
||
1A87D370000
|
unkown image
|
page readonly
|
||
1A87E202000
|
unkown
|
page read and write
|
||
7FF5C9358000
|
unkown image
|
page readonly
|
||
7FF5C8C47000
|
unkown image
|
page readonly
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
1A87DD89000
|
unkown
|
page read and write
|
||
7DF5C65C0000
|
unkown image
|
page readonly
|
||
1D869302000
|
unkown
|
page read and write
|
||
1A87D449000
|
unkown
|
page read and write
|
||
7FF58A650000
|
unkown image
|
page readonly
|
||
344BBFE000
|
unkown
|
page read and write
|
||
27B1FE6F000
|
unkown
|
page read and write
|
||
1D869950000
|
unkown
|
page read and write
|
||
7DF59F9E0000
|
unkown image
|
page readonly
|
||
1D869200000
|
unkown
|
page read and write
|
||
7FF50E657000
|
unkown image
|
page readonly
|
||
1A87DDA4000
|
unkown
|
page read and write
|
||
7FF58A942000
|
unkown image
|
page readonly
|
||
1A87DD82000
|
unkown
|
page read and write
|
||
7FF50E8F7000
|
unkown image
|
page readonly
|
||
1A87E300000
|
unkown
|
page read and write
|
||
7FF5C8C43000
|
unkown image
|
page readonly
|
||
1F3AF7A0000
|
unkown
|
page read and write
|
||
7FF50E9D1000
|
unkown image
|
page readonly
|
||
7DF5DE460000
|
unkown image
|
page readonly
|
||
7FF5C933A000
|
unkown image
|
page readonly
|
||
27B1FE81000
|
unkown
|
page read and write
|
||
22939AA000
|
unkown
|
page read and write
|
||
344B8F7000
|
unkown
|
page read and write
|
||
1A87D45C000
|
unkown
|
page read and write
|
||
1A87DD89000
|
unkown
|
page read and write
|
||
7FF58A803000
|
unkown image
|
page readonly
|
||
27B1FE4A000
|
unkown
|
page read and write
|
||
1A87E39D000
|
unkown
|
page read and write
|
||
7FF50E7DE000
|
unkown image
|
page readonly
|
||
7FF58A616000
|
unkown image
|
page readonly
|
||
7FF50E9C4000
|
unkown image
|
page readonly
|
||
7FF58A686000
|
unkown image
|
page readonly
|
||
1A87DDC4000
|
unkown
|
page read and write
|
||
1A87D8D0000
|
unkown image
|
page readonly
|
||
1A87E202000
|
unkown
|
page read and write
|
||
1A87D44B000
|
unkown
|
page read and write
|
||
7FF5B0FF6000
|
unkown image
|
page readonly
|
||
1A87DD95000
|
unkown
|
page read and write
|
||
7FF50E8E5000
|
unkown image
|
page readonly
|
||
344BCF9000
|
unkown
|
page read and write
|
||
1F3AF8D5000
|
unkown
|
page read and write
|
||
7DF59F9C0000
|
unkown image
|
page readonly
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
1F3AF8CF000
|
unkown
|
page read and write
|
||
344B6FE000
|
unkown
|
page read and write
|
||
7FF50E93F000
|
unkown image
|
page readonly
|
||
1A87DDC5000
|
unkown
|
page read and write
|
||
1A87DD99000
|
unkown
|
page read and write
|
||
7FF58A83A000
|
unkown image
|
page readonly
|
||
1F3AFEB0000
|
unkown image
|
page readonly
|
||
1A87D4B1000
|
unkown
|
page read and write
|
||
1A87DD4C000
|
unkown
|
page read and write
|
||
1A87DD89000
|
unkown
|
page read and write
|
||
7FF5B1281000
|
unkown image
|
page readonly
|
||
7FF58A6F3000
|
unkown image
|
page readonly
|
||
1A87E302000
|
unkown
|
page read and write
|
||
344BD7F000
|
unkown
|
page read and write
|
||
7FF5C93E1000
|
unkown image
|
page readonly
|
||
7DF5DE480000
|
unkown image
|
page readonly
|
||
7FF58A850000
|
unkown image
|
page readonly
|
||
7FF50E924000
|
unkown image
|
page readonly
|
||
1F3AF8C6000
|
unkown
|
page read and write
|
||
1A87E202000
|
unkown
|
page read and write
|
||
7FF50E660000
|
unkown image
|
page readonly
|
||
1A87DD7F000
|
unkown
|
page read and write
|
||
7FF58A1A3000
|
unkown image
|
page readonly
|
||
7FF50E8E0000
|
unkown image
|
page readonly
|
||
1A87DDA0000
|
unkown
|
page read and write
|
||
1F3AF8CF000
|
unkown
|
page read and write
|
||
7FF5B0C64000
|
unkown image
|
page readonly
|
||
4D6795D000
|
unkown
|
page read and write
|
||
7FF5B151A000
|
unkown image
|
page readonly
|
||
7DF59F9C2000
|
unkown image
|
page readonly
|
||
7FF5B1521000
|
unkown image
|
page readonly
|
||
7FF5B1394000
|
unkown image
|
page readonly
|
||
1A87D340000
|
unkown image
|
page readonly
|
||
2293C7F000
|
unkown
|
page read and write
|
||
1D8696E0000
|
unkown image
|
page readonly
|
||
1A87DD5D000
|
unkown
|
page read and write
|
||
27B1FD80000
|
unkown image
|
page readonly
|
||
1A87D4E9000
|
unkown
|
page read and write
|
||
2293CFF000
|
unkown
|
page read and write
|
||
7FF58A416000
|
unkown image
|
page readonly
|
||
1A87DD5C000
|
unkown
|
page read and write
|
||
7FF58A87F000
|
unkown image
|
page readonly
|
||
7FF50E934000
|
unkown image
|
page readonly
|
||
7DF523A70000
|
unkown image
|
page readonly
|
||
4D678DB000
|
unkown
|
page read and write
|
||
7DF59F9C2000
|
unkown image
|
page readonly
|
||
1A87DD7D000
|
unkown
|
page read and write
|
||
7DF523A60000
|
unkown image
|
page readonly
|
||
2293E7E000
|
unkown
|
page read and write
|
||
7FF5B14AD000
|
unkown image
|
page readonly
|
||
1A87DD6E000
|
unkown
|
page read and write
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
1A87D4C5000
|
unkown
|
page read and write
|
||
1A87DD7C000
|
unkown
|
page read and write
|
||
1A87E33C000
|
unkown
|
page read and write
|
||
1A87D502000
|
unkown
|
page read and write
|
||
1D869255000
|
unkown
|
page read and write
|
||
1A87D44F000
|
unkown
|
page read and write
|
||
7DF523A50000
|
unkown image
|
page readonly
|
||
1A87E33C000
|
unkown
|
page read and write
|
||
1D869213000
|
unkown
|
page read and write
|
||
344BAF8000
|
unkown
|
page read and write
|
||
1A87DD13000
|
unkown
|
page read and write
|
||
1A87DD90000
|
unkown
|
page read and write
|
||
1A87DD9A000
|
unkown
|
page read and write
|
||
4D67DFB000
|
unkown
|
page read and write
|
||
7DF421920000
|
unkown image
|
page readonly
|
||
7FF58A887000
|
unkown image
|
page readonly
|
||
27B1FE4D000
|
unkown
|
page read and write
|
||
1F3AFB30000
|
unkown image
|
page readonly
|
||
1A87DD95000
|
unkown
|
page read and write
|
||
7FF5C931F000
|
unkown image
|
page readonly
|
||
7FF5B1498000
|
unkown image
|
page readonly
|
||
7FF5B1474000
|
unkown image
|
page readonly
|
||
27B1FE8B000
|
unkown
|
page read and write
|
||
27B1FD10000
|
heap private
|
page read and write
|
||
1A87E202000
|
unkown
|
page read and write
|
||
7FF5C935E000
|
unkown image
|
page readonly
|
||
7FF50E8CA000
|
unkown image
|
page readonly
|
||
1A87D2F0000
|
unkown image
|
page read and write
|
||
1F3AF670000
|
unkown image
|
page readonly
|
||
1A87D4BF000
|
unkown
|
page read and write
|
||
7FF5B1311000
|
unkown image
|
page readonly
|
||
1A87D4F7000
|
unkown
|
page read and write
|
||
1F3AFB25000
|
heap private
|
page read and write
|
||
1A87DA50000
|
unkown image
|
page readonly
|
||
1A87E39D000
|
unkown
|
page read and write
|
||
1F3AF8C7000
|
unkown
|
page read and write
|
||
7FF58A684000
|
unkown image
|
page readonly
|
||
1A87DD84000
|
unkown
|
page read and write
|
||
4D67E7F000
|
unkown
|
page read and write
|
||
1A87D516000
|
unkown
|
page read and write
|
||
1A87D390000
|
unkown
|
page read and write
|
||
1A87D3C0000
|
unkown image
|
page readonly
|
||
1A87DDB4000
|
unkown
|
page read and write
|
||
7FF5B1484000
|
unkown image
|
page readonly
|
||
7DF5C65A2000
|
unkown image
|
page readonly
|
||
1A87D4E6000
|
unkown
|
page read and write
|
||
1A87E302000
|
unkown
|
page read and write
|
||
7FF58A867000
|
unkown image
|
page readonly
|
||
1A87DD9A000
|
unkown
|
page read and write
|
||
1A87DDA0000
|
unkown
|
page read and write
|
||
7FF5C93E2000
|
unkown image
|
page readonly
|
||
7DF59F9D0000
|
unkown image
|
page readonly
|
||
7FF58A425000
|
unkown image
|
page readonly
|
||
7FF5B1514000
|
unkown image
|
page readonly
|
||
7FF58A84A000
|
unkown image
|
page readonly
|
||
4D679DE000
|
unkown
|
page read and write
|
||
7FF5B12F1000
|
unkown image
|
page readonly
|
||
1A87DD8F000
|
unkown
|
page read and write
|
||
1A87E202000
|
unkown
|
page read and write
|
||
1A87D4E8000
|
unkown
|
page read and write
|
||
1D869180000
|
unkown image
|
page read and write
|
||
1A87DD1D000
|
unkown
|
page read and write
|
||
7FF5B132E000
|
unkown image
|
page readonly
|
||
27B1FE49000
|
unkown
|
page read and write
|
||
1A87DD13000
|
unkown
|
page read and write
|
||
7FF50E4A0000
|
unkown image
|
page readonly
|
||
27B1FD00000
|
unkown image
|
page read and write
|
||
1A87E26A000
|
unkown
|
page read and write
|
||
1A87D4C7000
|
unkown
|
page read and write
|
||
D76DCFB000
|
unkown
|
page read and write
|
||
7FF5C9328000
|
unkown image
|
page readonly
|
||
7DF5C65C0000
|
unkown image
|
page readonly
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
D76DE77000
|
unkown
|
page read and write
|
||
1A87DD5B000
|
unkown
|
page read and write
|
||
7FF58A1A7000
|
unkown image
|
page readonly
|
||
7FF58A894000
|
unkown image
|
page readonly
|
||
27B1FE13000
|
unkown
|
page read and write
|
||
7FF58A82F000
|
unkown image
|
page readonly
|
||
7FF5B1467000
|
unkown image
|
page readonly
|
||
1A87DD59000
|
unkown
|
page read and write
|
||
7FF5B11B0000
|
unkown image
|
page readonly
|
||
1A87DDA4000
|
unkown
|
page read and write
|
||
7FF58A465000
|
unkown image
|
page readonly
|
||
D76DD7F000
|
unkown
|
page read and write
|
||
1A87E26A000
|
unkown
|
page read and write
|
||
7FF5C93D4000
|
unkown image
|
page readonly
|
||
1A87DD95000
|
unkown
|
page read and write
|
||
27B1FF00000
|
unkown
|
page read and write
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
7FF5C936D000
|
unkown image
|
page readonly
|
||
1D8691A0000
|
unkown image
|
page readonly
|
||
1A87D454000
|
unkown
|
page read and write
|
||
1A87DD5D000
|
unkown
|
page read and write
|
||
1A87DD9B000
|
unkown
|
page read and write
|
||
1A87DD5B000
|
unkown
|
page read and write
|
||
2293D7A000
|
unkown
|
page read and write
|
||
7DF59F9D0000
|
unkown image
|
page readonly
|
||
7DF523A52000
|
unkown image
|
page readonly
|
||
7FF58A5D0000
|
unkown image
|
page readonly
|
||
1A87D330000
|
unkown image
|
page readonly
|
||
7FF50E92A000
|
unkown image
|
page readonly
|
||
1F3AF780000
|
unkown
|
page read and write
|
||
7FF5B14A6000
|
unkown image
|
page readonly
|
||
7FF58A152000
|
unkown image
|
page readonly
|
||
D76DF7E000
|
unkown
|
page read and write
|
||
1A87E200000
|
unkown
|
page read and write
|
||
27B1FE4E000
|
unkown
|
page read and write
|
||
7DF5C65A0000
|
unkown image
|
page readonly
|
||
7FF5B149E000
|
unkown image
|
page readonly
|
||
1D869229000
|
unkown
|
page read and write
|
||
1A87D453000
|
unkown
|
page read and write
|
||
1F3AF8B1000
|
unkown
|
page read and write
|
||
27B202D0000
|
unkown image
|
page readonly
|
||
1A87DDD6000
|
unkown
|
page read and write
|
||
7FF5B141C000
|
unkown image
|
page readonly
|
||
1F3AF670000
|
unkown image
|
page readonly
|
||
1F3AF8D4000
|
unkown
|
page read and write
|
||
1D8691F0000
|
heap default
|
page read and write
|
||
1D869190000
|
heap private
|
page read and write
|
||
7FF50E959000
|
unkown image
|
page readonly
|
||
1A87DD79000
|
unkown
|
page read and write
|
||
1A87DD7A000
|
unkown
|
page read and write
|
||
7DF5DE460000
|
unkown image
|
page readonly
|
||
7FF58A32E000
|
unkown image
|
page readonly
|
||
7FF50E9D2000
|
unkown image
|
page readonly
|
||
7FF5B1447000
|
unkown image
|
page readonly
|
||
1A87DB80000
|
unkown
|
page read and write
|
||
7FF50E11A000
|
unkown image
|
page readonly
|
||
7FF5B1430000
|
unkown image
|
page readonly
|
||
7FF50E95D000
|
unkown image
|
page readonly
|
||
7FF58A7B4000
|
unkown image
|
page readonly
|
||
4D67CFB000
|
unkown
|
page read and write
|
||
7FF5C93DA000
|
unkown image
|
page readonly
|
||
1A87D413000
|
unkown
|
page read and write
|
||
7DF4DC330000
|
unkown image
|
page readonly
|
||
7FF50E90F000
|
unkown image
|
page readonly
|
||
1A87DDD5000
|
unkown
|
page read and write
|
||
1D869313000
|
unkown
|
page read and write
|
||
7FF50E8DA000
|
unkown image
|
page readonly
|
||
7FF58A93A000
|
unkown image
|
page readonly
|
||
7FF58A084000
|
unkown image
|
page readonly
|
||
7FF5C92F5000
|
unkown image
|
page readonly
|
||
7FF50E9CA000
|
unkown image
|
page readonly
|
||
7DF5DE462000
|
unkown image
|
page readonly
|
||
1A87DDA4000
|
unkown
|
page read and write
|
||
7FF58A7F0000
|
unkown image
|
page readonly
|
||
1A87DD09000
|
unkown
|
page read and write
|
||
1A87DD7B000
|
unkown
|
page read and write
|
||
7FF58A52A000
|
unkown image
|
page readonly
|
||
1A87DB80000
|
unkown
|
page read and write
|
||
7FF5B1522000
|
unkown image
|
page readonly
|
||
1A87DDA2000
|
unkown
|
page read and write
|
||
1A87D488000
|
unkown
|
page read and write
|
||
27B1FE3C000
|
unkown
|
page read and write
|
||
7FF5C92F0000
|
unkown image
|
page readonly
|
||
D76DA7D000
|
unkown
|
page read and write
|
||
7FF5B1435000
|
unkown image
|
page readonly
|
||
D76D7DB000
|
unkown
|
page read and write
|
||
7DF523A50000
|
unkown image
|
page readonly
|
||
27B1FD40000
|
unkown image
|
page readonly
|
||
1A87DD79000
|
unkown
|
page read and write
|
||
7FF58A934000
|
unkown image
|
page readonly
|
||
7FF50E7C1000
|
unkown image
|
page readonly
|
||
1A87DD82000
|
unkown
|
page read and write
|
||
7FF58A81B000
|
unkown image
|
page readonly
|
||
7FF58A08A000
|
unkown image
|
page readonly
|
||
7FF58A89A000
|
unkown image
|
page readonly
|
||
7FF58A7F2000
|
unkown image
|
page readonly
|
||
1F3AF7E0000
|
unkown image
|
page readonly
|
||
2293EFD000
|
unkown
|
page read and write
|
||
7FF58A83C000
|
unkown image
|
page readonly
|
||
7FF58A731000
|
unkown image
|
page readonly
|
||
7FF58A84E000
|
unkown image
|
page readonly
|
||
7FF50E94E000
|
unkown image
|
page readonly
|
||
1D869277000
|
unkown
|
page read and write
|
||
1A87DD7A000
|
unkown
|
page read and write
|
||
1A87E202000
|
unkown
|
page read and write
|
||
1A87E221000
|
unkown
|
page read and write
|
||
1A87DD87000
|
unkown
|
page read and write
|
||
7FF50E84C000
|
unkown image
|
page readonly
|
||
1F3AF8A0000
|
heap default
|
page read and write
|
||
7FF5B1383000
|
unkown image
|
page readonly
|
||
7DF5DE462000
|
unkown image
|
page readonly
|
||
7FF50E8CC000
|
unkown image
|
page readonly
|
||
7FF5B148F000
|
unkown image
|
page readonly
|
||
1A87D45A000
|
unkown
|
page read and write
|
||
7FF58A941000
|
unkown image
|
page readonly
|
||
7FF50E7DB000
|
unkown image
|
page readonly
|
||
7FF58A3C2000
|
unkown image
|
page readonly
|
||
7FF5B14A9000
|
unkown image
|
page readonly
|
||
1D869250000
|
unkown
|
page read and write
|
||
1A87E221000
|
unkown
|
page read and write
|
||
7FF50E82D000
|
unkown image
|
page readonly
|
||
344B3CC000
|
unkown
|
page read and write
|
||
344BE7D000
|
unkown
|
page read and write
|
||
1A87D43C000
|
unkown
|
page read and write
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
1D86924A000
|
unkown
|
page read and write
|
||
7FF58A81F000
|
unkown image
|
page readonly
|
||
1D869285000
|
unkown
|
page read and write
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
7FF5B12D3000
|
unkown image
|
page readonly
|
||
7DF523A70000
|
unkown image
|
page readonly
|
||
7FF5C934E000
|
unkown image
|
page readonly
|
||
1A87DD87000
|
unkown
|
page read and write
|
||
7FF58A87C000
|
unkown image
|
page readonly
|
||
27B1FE4B000
|
unkown
|
page read and write
|
||
7FF50E844000
|
unkown image
|
page readonly
|
||
7FF58A410000
|
unkown image
|
page readonly
|
||
1A87DD7C000
|
unkown
|
page read and write
|
||
7FF5B142E000
|
unkown image
|
page readonly
|
||
27B20450000
|
unkown image
|
page readonly
|
||
344B9F7000
|
unkown
|
page read and write
|
||
7FF5B137D000
|
unkown image
|
page readonly
|
||
7FF5B0C6A000
|
unkown image
|
page readonly
|
||
1D86924D000
|
unkown
|
page read and write
|
||
1F3AF650000
|
unkown image
|
page read and write
|
||
1A87DB90000
|
unkown image
|
page read and write
|
||
7FF5C8FCA000
|
unkown image
|
page readonly
|
||
1A87D4E1000
|
unkown
|
page read and write
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
1D86926C000
|
unkown
|
page read and write
|
||
1A87DDB4000
|
unkown
|
page read and write
|
||
7FF5B139C000
|
unkown image
|
page readonly
|
||
1A87DD76000
|
unkown
|
page read and write
|
||
1A87DD93000
|
unkown
|
page read and write
|
||
1A87D6D0000
|
unkown image
|
page readonly
|
||
1F3AF8B6000
|
unkown
|
page read and write
|
||
1A87DD76000
|
unkown
|
page read and write
|
||
1A87DDC4000
|
unkown
|
page read and write
|
||
1D8691A0000
|
unkown image
|
page readonly
|
||
D76DAFE000
|
unkown
|
page read and write
|
||
1F3AF8CF000
|
unkown
|
page read and write
|
||
2293DF9000
|
unkown
|
page read and write
|
||
1A87DD77000
|
unkown
|
page read and write
|
||
7FF58A8B8000
|
unkown image
|
page readonly
|
||
1A87DB30000
|
unkown image
|
page write copy
|
||
7DF4C4470000
|
unkown image
|
page readonly
|
||
7FF58A8AF000
|
unkown image
|
page readonly
|
||
7FF50E114000
|
unkown image
|
page readonly
|
||
7FF5B143B000
|
unkown image
|
page readonly
|
||
1A87DD80000
|
unkown
|
page read and write
|
||
1F3AF8AB000
|
heap default
|
page read and write
|
||
1A87D360000
|
heap default
|
page read and write
|
||
7FF5B11A7000
|
unkown image
|
page readonly
|
||
7FF58A8C9000
|
unkown image
|
page readonly
|
||
1A87D4A0000
|
unkown
|
page read and write
|
||
7DF59F9D2000
|
unkown image
|
page readonly
|
||
7FF5C9369000
|
unkown image
|
page readonly
|
||
7DF5C65B0000
|
unkown image
|
page readonly
|
||
7FF58A3BE000
|
unkown image
|
page readonly
|
||
1D869860000
|
unkown image
|
page readonly
|
||
7FF50E4A6000
|
unkown image
|
page readonly
|
||
1A87DDB9000
|
unkown
|
page read and write
|
||
7DF5DE472000
|
unkown image
|
page readonly
|
||
7FF58A74B000
|
unkown image
|
page readonly
|
||
1F3AF8B6000
|
heap default
|
page read and write
|
||
7DF5C65A0000
|
unkown image
|
page readonly
|
||
1A87DD82000
|
unkown
|
page read and write
|
||
7FF58A3B2000
|
unkown image
|
page readonly
|
||
27B1FF13000
|
unkown
|
page read and write
|
||
7FF5C9334000
|
unkown image
|
page readonly
|
||
7FF5B141A000
|
unkown image
|
page readonly
|
||
7FF58A85B000
|
unkown image
|
page readonly
|
||
1A87DDA4000
|
unkown
|
page read and write
|
||
1A87DD9A000
|
unkown
|
page read and write
|
||
1F3AFD30000
|
unkown image
|
page readonly
|
||
1A87D310000
|
unkown image
|
page readonly
|
||
7FF50E833000
|
unkown image
|
page readonly
|
||
7DF5DE480000
|
unkown image
|
page readonly
|
||
7FF50E731000
|
unkown image
|
page readonly
|
||
1D8694D0000
|
unkown image
|
page readonly
|
There are 494 hidden memdumps, click here to show them.