Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
doc-379851424.xls
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application:
Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Tue Oct 12 08:22:59 2021, Security: 0
|
initial sample
|
||
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F1C50F4E-1059-4074-A602-9B892B4EAC58
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
|
||
C:\Windows\SysWOW64\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test
|
||
C:\Windows\SysWOW64\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' C:\Datop\test1.test
|
||
C:\Windows\SysWOW64\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' C:\Datop\test2.test
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
||
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test
|
||
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' C:\Datop\test1.test
|
||
C:\Windows\System32\regsvr32.exe
|
'C:\Windows\System32\regsvr32.exe' C:\Datop\test2.test
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://api.diagnosticssdf.office.com
|
unknown
|
||
https://login.microsoftonline.com/
|
unknown
|
||
https://shell.suite.office.com:1443
|
unknown
|
||
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
|
unknown
|
||
https://autodiscover-s.outlook.com/
|
unknown
|
||
https://roaming.edog.
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
|
unknown
|
||
https://cdn.entity.
|
unknown
|
||
https://api.addins.omex.office.net/appinfo/query
|
unknown
|
||
https://clients.config.office.net/user/v1.0/tenantassociationkey
|
unknown
|
||
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
|
unknown
|
||
https://powerlift.acompli.net
|
unknown
|
||
https://rpsticket.partnerservices.getmicrosoftkey.com
|
unknown
|
||
https://lookup.onenote.com/lookup/geolocation/v1
|
unknown
|
||
https://cortana.ai
|
unknown
|
||
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://cloudfiles.onenote.com/upload.aspx
|
unknown
|
||
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://entitlement.diagnosticssdf.office.com
|
unknown
|
||
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
|
unknown
|
||
https://api.aadrm.com/
|
unknown
|
||
https://ofcrecsvcapi-int.azurewebsites.net/
|
unknown
|
||
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
|
unknown
|
||
https://api.microsoftstream.com/api/
|
unknown
|
||
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
|
unknown
|
||
https://cr.office.com
|
unknown
|
||
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
|
unknown
|
||
https://portal.office.com/account/?ref=ClientMeControl
|
unknown
|
||
https://graph.ppe.windows.net
|
unknown
|
||
https://res.getmicrosoftkey.com/api/redemptionevents
|
unknown
|
||
https://powerlift-frontdesk.acompli.net
|
unknown
|
||
https://tasks.office.com
|
unknown
|
||
https://officeci.azurewebsites.net/api/
|
unknown
|
||
https://sr.outlook.office.net/ws/speech/recognize/assistant/work
|
unknown
|
||
https://madieandme.com.au/xnkpOLnvlN6T/ocrafh.html
|
101.0.112.4
|
||
https://store.office.cn/addinstemplate
|
unknown
|
||
https://api.aadrm.com
|
unknown
|
||
https://outlook.office.com/autosuggest/api/v1/init?cvid=
|
unknown
|
||
https://globaldisco.crm.dynamics.com
|
unknown
|
||
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://store.officeppe.com/addinstemplate
|
unknown
|
||
https://dev0-api.acompli.net/autodetect
|
unknown
|
||
https://www.odwebp.svc.ms
|
unknown
|
||
https://api.powerbi.com/v1.0/myorg/groups
|
unknown
|
||
https://web.microsoftstream.com/video/
|
unknown
|
||
https://graph.windows.net
|
unknown
|
||
https://dataservice.o365filtering.com/
|
unknown
|
||
https://officesetup.getmicrosoftkey.com
|
unknown
|
||
https://analysis.windows.net/powerbi/api
|
unknown
|
||
https://prod-global-autodetect.acompli.net/autodetect
|
unknown
|
||
https://outlook.office365.com/autodiscover/autodiscover.json
|
unknown
|
||
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
|
unknown
|
||
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
|
unknown
|
||
https://ncus.contentsync.
|
unknown
|
||
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
|
unknown
|
||
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
|
unknown
|
||
http://weather.service.msn.com/data.aspx
|
unknown
|
||
https://apis.live.net/v5.0/
|
unknown
|
||
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
|
unknown
|
||
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
|
unknown
|
||
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
|
unknown
|
||
https://management.azure.com
|
unknown
|
||
https://outlook.office365.com
|
unknown
|
||
https://wus2.contentsync.
|
unknown
|
||
https://incidents.diagnostics.office.com
|
unknown
|
||
https://clients.config.office.net/user/v1.0/ios
|
unknown
|
||
https://insertmedia.bing.office.net/odc/insertmedia
|
unknown
|
||
https://o365auditrealtimeingestion.manage.office.com
|
unknown
|
||
https://outlook.office365.com/api/v1.0/me/Activities
|
unknown
|
||
https://api.office.net
|
unknown
|
||
https://incidents.diagnosticssdf.office.com
|
unknown
|
||
https://asgsmsproxyapi.azurewebsites.net/
|
unknown
|
||
https://clients.config.office.net/user/v1.0/android/policies
|
unknown
|
||
https://entitlement.diagnostics.office.com
|
unknown
|
||
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
|
unknown
|
||
https://substrate.office.com/search/api/v2/init
|
unknown
|
||
https://outlook.office.com/
|
unknown
|
||
https://storage.live.com/clientlogs/uploadlocation
|
unknown
|
||
https://amerident.com.do/xdOMlaB0XJ7/ocraf.html
|
108.179.242.179
|
||
https://outlook.office365.com/
|
unknown
|
||
https://webshell.suite.office.com
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
|
unknown
|
||
https://substrate.office.com/search/api/v1/SearchHistory
|
unknown
|
||
https://management.azure.com/
|
unknown
|
||
https://login.windows.net/common/oauth2/authorize
|
unknown
|
||
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://graph.windows.net/
|
unknown
|
||
https://api.powerbi.com/beta/myorg/imports
|
unknown
|
||
https://devnull.onenote.com
|
unknown
|
||
https://ncus.pagecontentsync.
|
unknown
|
||
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
|
unknown
|
||
https://messaging.office.com/
|
unknown
|
||
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://augloop.office.com/v2
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
|
unknown
|
||
https://skyapi.live.net/Activity/
|
unknown
|
||
https://clients.config.office.net/user/v1.0/mac
|
unknown
|
||
https://dataservice.o365filtering.com
|
unknown
|
||
https://ohemaa.org/HUVm9mDKLW9C/ocrafhh.html
|
172.93.99.178
|
||
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
|
unknown
|
||
http://www.windows.com/pctv.
|
unknown
|
||
http://investor.msn.com
|
unknown
|
||
http://www.msnbc.com/news/ticker.txt
|
unknown
|
||
http://www.icra.org/vocabulary/.
|
unknown
|
||
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
|
unknown
|
||
http://investor.msn.com/
|
unknown
|
||
http://www.%s.comPA
|
unknown
|
||
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
|
unknown
|
||
http://www.hotmail.com/oe
|
unknown
|
||
http://servername/isapibackend.dll
|
unknown
|
There are 101 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
ohemaa.org
|
172.93.99.178
|
||
amerident.com.do
|
108.179.242.179
|
||
madieandme.com.au
|
101.0.112.4
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
101.0.112.4
|
madieandme.com.au
|
Australia
|
||
108.179.242.179
|
amerident.com.do
|
United States
|
||
172.93.99.178
|
ohemaa.org
|
United States
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
|
.43
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
|
/43
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache
|
RemoteClearDate
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3
|
Last
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
FilePath
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
StartDate
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
EndDate
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
Properties
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
Url
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache
|
LastClean
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableWinHttpCertAuth
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableIsOwnerRegex
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableSessionAwareHttpClose
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableADALForExtendedApps
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableADALSetSilentAuth
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
msoridDisableGuestCredProvider
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
msoridDisableOstringReplace
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\IOAV
|
LastBootTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ReviewCycle
|
ReviewToken
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\220BE
|
220BE
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
VBAFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ExdCache\Excel8.0
|
MSForms
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ExdCache\Excel8.0
|
MSComctlLib
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
|
=?3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\31455
|
31455
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\316E5
|
316E5
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-US
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-US
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
EXCELFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
|
RoamingConfigurableSettings
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
|
RoamingLastSyncTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
|
RoamingLastWriteTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\IOAV
|
LastBootTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
v:*
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
|
MTTT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
|
ReviewToken
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\30973
|
30973
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
VBAFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
i>*
|
||
HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E
|
@%SystemRoot%\system32\qagentrt.dll,-10
|
||
HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E
|
@%SystemRoot%\System32\fveui.dll,-843
|
||
HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E
|
@%SystemRoot%\System32\fveui.dll,-844
|
||
HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E
|
@%SystemRoot%\System32\wuaueng.dll,-400
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\39C4F
|
39C4F
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\39E42
|
39E42
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
EXCELFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
|
Blob
|
There are 94 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
7FF5BEE60000
|
unkown image
|
page readonly
|
||
1FB47D72000
|
unkown
|
page read and write
|
||
2A05000
|
unkown image
|
page readonly
|
||
7FF55CA53000
|
unkown image
|
page readonly
|
||
1ECCF050000
|
unkown image
|
page readonly
|
||
1FB47629000
|
unkown
|
page read and write
|
||
7FF5C203A000
|
unkown image
|
page readonly
|
||
7FF507F87000
|
unkown image
|
page readonly
|
||
7FF5C1CD5000
|
unkown image
|
page readonly
|
||
24B98681000
|
unkown
|
page read and write
|
||
F570BFF000
|
unkown
|
page read and write
|
||
7FF5C1FA3000
|
unkown image
|
page readonly
|
||
185C6DA0000
|
unkown image
|
page readonly
|
||
1FB47DE7000
|
unkown
|
page read and write
|
||
F570E7D000
|
unkown
|
page read and write
|
||
731F000
|
unkown
|
page read and write
|
||
7FF536EB1000
|
unkown image
|
page readonly
|
||
7FF5C1B37000
|
unkown image
|
page readonly
|
||
F57067B000
|
unkown
|
page read and write
|
||
1FB47D82000
|
unkown
|
page read and write
|
||
3830000
|
unkown
|
page read and write
|
||
C7F000
|
unkown
|
page read and write
|
||
7FF508321000
|
unkown image
|
page readonly
|
||
1ECCF010000
|
unkown
|
page read and write
|
||
359C000
|
unkown
|
page read and write
|
||
13C99980000
|
unkown image
|
page readonly
|
||
185C72E0000
|
unkown image
|
page readonly
|
||
7FA10000
|
unkown image
|
page readonly
|
||
770000
|
unkown image
|
page read and write
|
||
1FB47D68000
|
unkown
|
page read and write
|
||
233C8049000
|
unkown
|
page read and write
|
||
7FA22000
|
unkown image
|
page readonly
|
||
7FF5C204A000
|
unkown image
|
page readonly
|
||
7FF5BED1D000
|
unkown image
|
page readonly
|
||
1ECCF020000
|
unkown image
|
page readonly
|
||
7FF50848A000
|
unkown image
|
page readonly
|
||
47AF000
|
unkown
|
page read and write
|
||
2C66000
|
unkown image
|
page readonly
|
||
3210000
|
unkown image
|
page readonly
|
||
2ABC000
|
unkown image
|
page readonly
|
||
725E000
|
unkown
|
page read and write
|
||
7FF5BEFBE000
|
unkown image
|
page readonly
|
||
1FB47D8C000
|
unkown
|
page read and write
|
||
13C99500000
|
unkown
|
page read and write
|
||
2F10000
|
unkown image
|
page readonly
|
||
7FF50026F000
|
unkown image
|
page readonly
|
||
CCE000
|
unkown
|
page read and write
|
||
7DF544B30000
|
unkown image
|
page readonly
|
||
7DF5CFCC0000
|
unkown image
|
page readonly
|
||
7DF50DFC2000
|
unkown image
|
page readonly
|
||
7FF507E07000
|
unkown image
|
page readonly
|
||
1FB476FA000
|
unkown
|
page read and write
|
||
7FF536E94000
|
unkown image
|
page readonly
|
||
29CF000
|
unkown image
|
page readonly
|
||
7FED0000
|
unkown image
|
page readonly
|
||
7DF544B22000
|
unkown image
|
page readonly
|
||
233C804E000
|
unkown
|
page read and write
|
||
185C6D90000
|
heap private
|
page read and write
|
||
7FF508009000
|
unkown image
|
page readonly
|
||
1FB47D86000
|
unkown
|
page read and write
|
||
C4BF7F000
|
unkown
|
page read and write
|
||
D72C97E000
|
unkown
|
page read and write
|
||
2A0B000
|
unkown image
|
page readonly
|
||
7DF50DFD2000
|
unkown image
|
page readonly
|
||
7DF56A7A0000
|
unkown image
|
page readonly
|
||
2C5D000
|
unkown image
|
page readonly
|
||
7FF500339000
|
unkown image
|
page readonly
|
||
1FB47D7B000
|
unkown
|
page read and write
|
||
7FF5083F3000
|
unkown image
|
page readonly
|
||
7FF5C1DD6000
|
unkown image
|
page readonly
|
||
24B98940000
|
unkown image
|
page readonly
|
||
28F5000
|
unkown image
|
page readonly
|
||
7DF516120000
|
unkown image
|
page readonly
|
||
7FF508259000
|
unkown image
|
page readonly
|
||
7FF55C7CD000
|
unkown image
|
page readonly
|
||
7FF5C18A2000
|
unkown image
|
page readonly
|
||
2AC8000
|
unkown image
|
page readonly
|
||
7DF4CABC0000
|
unkown image
|
page readonly
|
||
7FF5BF081000
|
unkown image
|
page readonly
|
||
7FF5082B2000
|
unkown image
|
page readonly
|
||
7FF536AAC000
|
unkown image
|
page readonly
|
||
7FA12000
|
unkown image
|
page readonly
|
||
2BFE000
|
unkown image
|
page readonly
|
||
780000
|
unkown image
|
page readonly
|
||
3595000
|
unkown
|
page read and write
|
||
7FED2000
|
unkown image
|
page readonly
|
||
7FF5083D7000
|
unkown image
|
page readonly
|
||
1FB476AC000
|
unkown
|
page read and write
|
||
1FB47654000
|
unkown
|
page read and write
|
||
1FB48202000
|
unkown
|
page read and write
|
||
7FF5C1F9B000
|
unkown image
|
page readonly
|
||
1FB47D97000
|
unkown
|
page read and write
|
||
2C6B000
|
unkown image
|
page readonly
|
||
7FF5001BB000
|
unkown image
|
page readonly
|
||
24B98605000
|
heap private
|
page read and write
|
||
1ECCF26C000
|
unkown
|
page read and write
|
||
7FF5C1EBC000
|
unkown image
|
page readonly
|
||
C4BA7D000
|
unkown
|
page read and write
|
||
1FB47D19000
|
unkown
|
page read and write
|
||
2AB6000
|
unkown image
|
page readonly
|
||
13C99230000
|
unkown image
|
page readonly
|
||
1FB47D9D000
|
unkown
|
page read and write
|
||
7DF56A7B0000
|
unkown image
|
page readonly
|
||
A80000
|
unkown image
|
page readonly
|
||
7FF536EA1000
|
unkown image
|
page readonly
|
||
24B98600000
|
heap private
|
page read and write
|
||
7FF55CB41000
|
unkown image
|
page readonly
|
||
1FB47D83000
|
unkown
|
page read and write
|
||
2E1A000
|
heap default
|
page read and write
|
||
7DF50DFC2000
|
unkown image
|
page readonly
|
||
1FB47681000
|
unkown
|
page read and write
|
||
233C8580000
|
unkown image
|
page readonly
|
||
1ECCF4D5000
|
heap private
|
page read and write
|
||
7DF56A7B0000
|
unkown image
|
page readonly
|
||
7FF5C1E20000
|
unkown image
|
page readonly
|
||
7FA22000
|
unkown image
|
page readonly
|
||
185C7460000
|
unkown image
|
page readonly
|
||
1FB48302000
|
unkown
|
page read and write
|
||
1ECCF140000
|
unkown
|
page read and write
|
||
1FB47DA4000
|
unkown
|
page read and write
|
||
7FF55CB35000
|
unkown image
|
page readonly
|
||
1FB47D72000
|
unkown
|
page read and write
|
||
7DF56A7B2000
|
unkown image
|
page readonly
|
||
7FF55CB31000
|
unkown image
|
page readonly
|
||
1FB48219000
|
unkown
|
page read and write
|
||
1FB47DD7000
|
unkown
|
page read and write
|
||
185C6E4B000
|
unkown
|
page read and write
|
||
1FB476A4000
|
unkown
|
page read and write
|
||
1FB47BE0000
|
unkown
|
page read and write
|
||
13C99250000
|
unkown image
|
page readonly
|
||
185C6E49000
|
unkown
|
page read and write
|
||
7FF508077000
|
unkown image
|
page readonly
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
7FF5BEEEB000
|
unkown image
|
page readonly
|
||
1FB47C02000
|
unkown
|
page read and write
|
||
2C26000
|
unkown image
|
page readonly
|
||
1ECCF320000
|
unkown image
|
page readonly
|
||
F570879000
|
unkown
|
page read and write
|
||
1FB47D71000
|
unkown
|
page read and write
|
||
1FB47D83000
|
unkown
|
page read and write
|
||
2AE7000
|
unkown image
|
page readonly
|
||
7FF5C18A8000
|
unkown image
|
page readonly
|
||
7DF5CFCD0000
|
unkown image
|
page readonly
|
||
C4BD77000
|
unkown
|
page read and write
|
||
185C70D0000
|
unkown image
|
page readonly
|
||
1FB48302000
|
unkown
|
page read and write
|
||
1FB48202000
|
unkown
|
page read and write
|
||
7DF56A7A2000
|
unkown image
|
page readonly
|
||
1FB47D56000
|
unkown
|
page read and write
|
||
D72C9F9000
|
unkown
|
page read and write
|
||
2B35000
|
unkown image
|
page readonly
|
||
7FC50000
|
unkown image
|
page readonly
|
||
D72C8F9000
|
unkown
|
page read and write
|
||
185C6E00000
|
unkown
|
page read and write
|
||
1FB47DA2000
|
unkown
|
page read and write
|
||
6DE000
|
unkown
|
page read and write
|
||
7FF500361000
|
unkown image
|
page readonly
|
||
33A0000
|
unkown image
|
page readonly
|
||
2AAB000
|
unkown image
|
page readonly
|
||
1FB47688000
|
unkown
|
page read and write
|
||
7FF4FFBB8000
|
unkown image
|
page readonly
|
||
7DF50DFD0000
|
unkown image
|
page readonly
|
||
AD0000
|
heap private
|
page read and write
|
||
7DF5CFCC0000
|
unkown image
|
page readonly
|
||
7FC60000
|
unkown image
|
page readonly
|
||
7FF55C375000
|
unkown image
|
page readonly
|
||
13C9945D000
|
unkown
|
page read and write
|
||
7FA10000
|
unkown image
|
page readonly
|
||
7FF5002B3000
|
unkown image
|
page readonly
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
7FF5BEE41000
|
unkown image
|
page readonly
|
||
3AA000
|
unkown
|
page read and write
|
||
1FB47D71000
|
unkown
|
page read and write
|
||
7FF5083B3000
|
unkown image
|
page readonly
|
||
139DDFC000
|
unkown
|
page read and write
|
||
7FF5083C7000
|
unkown image
|
page readonly
|
||
1FB473F0000
|
unkown image
|
page readonly
|
||
7FF536A5A000
|
unkown image
|
page readonly
|
||
13C99481000
|
unkown
|
page read and write
|
||
233C7FE0000
|
unkown
|
page read and write
|
||
7DF56A7A0000
|
unkown image
|
page readonly
|
||
13C99600000
|
unkown image
|
page readonly
|
||
7DF516100000
|
unkown image
|
page readonly
|
||
7FF5BF069000
|
unkown image
|
page readonly
|
||
7FF536739000
|
unkown image
|
page readonly
|
||
7FF5081FF000
|
unkown image
|
page readonly
|
||
1FB476E2000
|
unkown
|
page read and write
|
||
2E35000
|
unkown
|
page read and write
|
||
7FF55CA4F000
|
unkown image
|
page readonly
|
||
A3B000
|
unkown
|
page read and write
|
||
7FF5BEFB7000
|
unkown image
|
page readonly
|
||
13C99230000
|
unkown image
|
page readonly
|
||
7FB40000
|
unkown image
|
page readonly
|
||
7FF50841A000
|
unkown image
|
page readonly
|
||
1FB47B80000
|
unkown image
|
page readonly
|
||
7FF500283000
|
unkown image
|
page readonly
|
||
7FF55CA67000
|
unkown image
|
page readonly
|
||
7DF516110000
|
unkown image
|
page readonly
|
||
410000
|
unkown image
|
page readonly
|
||
1FB47D83000
|
unkown
|
page read and write
|
||
7DF50DFD0000
|
unkown image
|
page readonly
|
||
7DF5CFCD0000
|
unkown image
|
page readonly
|
||
7FF55CB12000
|
unkown image
|
page readonly
|
||
7FF5BEE16000
|
unkown image
|
page readonly
|
||
1FB473C0000
|
unkown image
|
page readonly
|
||
C081BFC000
|
unkown
|
page read and write
|
||
7FF50834F000
|
unkown image
|
page readonly
|
||
B7FCCFA000
|
unkown
|
page read and write
|
||
7E0000
|
unkown image
|
page readonly
|
||
29E6000
|
unkown image
|
page readonly
|
||
7DF56A7C0000
|
unkown image
|
page readonly
|
||
593000
|
heap default
|
page read and write
|
||
7FF50830C000
|
unkown image
|
page readonly
|
||
F57047C000
|
unkown
|
page read and write
|
||
7FF5C1F5F000
|
unkown image
|
page readonly
|
||
1FB47D83000
|
unkown
|
page read and write
|
||
7FF55CB2A000
|
unkown image
|
page readonly
|
||
7FF5BEEFC000
|
unkown image
|
page readonly
|
||
1FB47D96000
|
unkown
|
page read and write
|
||
7FF5082B7000
|
unkown image
|
page readonly
|
||
BC0000
|
unkown
|
page read and write
|
||
ED7000
|
unkown image
|
page readonly
|
||
570000
|
heap default
|
page read and write
|
||
7FF5BEF99000
|
unkown image
|
page readonly
|
||
7FF5C1F63000
|
unkown image
|
page readonly
|
||
7FF55CB19000
|
unkown image
|
page readonly
|
||
7DF5CCD00000
|
unkown image
|
page readonly
|
||
7FF536DC3000
|
unkown image
|
page readonly
|
||
7FF4FFE41000
|
unkown image
|
page readonly
|
||
36C0000
|
unkown
|
page read and write
|
||
2CCB000
|
unkown image
|
page readonly
|
||
29E6000
|
unkown image
|
page readonly
|
||
233C8070000
|
unkown
|
page read and write
|
||
C081CFB000
|
unkown
|
page read and write
|
||
7FF5084A0000
|
unkown image
|
page readonly
|
||
7FF5BEFC7000
|
unkown image
|
page readonly
|
||
1FB4821E000
|
unkown
|
page read and write
|
||
35B5000
|
unkown
|
page read and write
|
||
382E000
|
unkown
|
page read and write
|
||
700000
|
unkown image
|
page readonly
|
||
1ECCF26C000
|
unkown
|
page read and write
|
||
13C9945F000
|
unkown
|
page read and write
|
||
7DF516110000
|
unkown image
|
page readonly
|
||
1FB47BA0000
|
unkown image
|
page readonly
|
||
7FF5BEFB3000
|
unkown image
|
page readonly
|
||
1FB47D84000
|
unkown
|
page read and write
|
||
2E41000
|
unkown
|
page read and write
|
||
7FA20000
|
unkown image
|
page readonly
|
||
2E52000
|
unkown
|
page read and write
|
||
7F0000
|
unkown image
|
page readonly
|
||
7FF508362000
|
unkown image
|
page readonly
|
||
29CF000
|
unkown image
|
page readonly
|
||
1FB47DED000
|
unkown
|
page read and write
|
||
1FB48202000
|
unkown
|
page read and write
|
||
7FF5081E6000
|
unkown image
|
page readonly
|
||
7DF544B30000
|
unkown image
|
page readonly
|
||
1FB4763C000
|
unkown
|
page read and write
|
||
1FB4821E000
|
unkown
|
page read and write
|
||
7FF5002BE000
|
unkown image
|
page readonly
|
||
2A1D000
|
unkown image
|
page readonly
|
||
7FED2000
|
unkown image
|
page readonly
|
||
1FB47D9B000
|
unkown
|
page read and write
|
||
185C7602000
|
unkown
|
page read and write
|
||
2CE1000
|
unkown image
|
page readonly
|
||
3330000
|
unkown
|
page read and write
|
||
7FF500280000
|
unkown image
|
page readonly
|
||
C4B70B000
|
unkown
|
page read and write
|
||
1FB47647000
|
unkown
|
page read and write
|
||
1ECCF6F0000
|
unkown image
|
page readonly
|
||
1FB47DA4000
|
unkown
|
page read and write
|
||
1ECCF040000
|
unkown image
|
page readonly
|
||
1FB47D97000
|
unkown
|
page read and write
|
||
2AF3000
|
unkown image
|
page readonly
|
||
1ECCF265000
|
unkown
|
page read and write
|
||
2A9B000
|
unkown image
|
page readonly
|
||
C4BC7B000
|
unkown
|
page read and write
|
||
AA0000
|
unkown image
|
page readonly
|
||
7FF5084A1000
|
unkown image
|
page readonly
|
||
1FB48202000
|
unkown
|
page read and write
|
||
1FB47DA3000
|
unkown
|
page read and write
|
||
13C99280000
|
heap default
|
page read and write
|
||
1FB47D8A000
|
unkown
|
page read and write
|
||
7FF507E1C000
|
unkown image
|
page readonly
|
||
7DF50DFD2000
|
unkown image
|
page readonly
|
||
24B985A0000
|
unkown
|
page read and write
|
||
1FB48202000
|
unkown
|
page read and write
|
||
13C99465000
|
unkown
|
page read and write
|
||
7FF500130000
|
unkown image
|
page readonly
|
||
7FF508007000
|
unkown image
|
page readonly
|
||
7FF50849A000
|
unkown image
|
page readonly
|
||
6F0000
|
heap private
|
page read and write
|
||
1FB47D7B000
|
unkown
|
page read and write
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
1FB47D79000
|
unkown
|
page read and write
|
||
13C99220000
|
heap private
|
page read and write
|
||
2C80000
|
unkown image
|
page readonly
|
||
1FB47D7F000
|
unkown
|
page read and write
|
||
1FB47656000
|
unkown
|
page read and write
|
||
29F9000
|
unkown image
|
page readonly
|
||
7FF536DFB000
|
unkown image
|
page readonly
|
||
D72C87B000
|
unkown
|
page read and write
|
||
7FF55CA56000
|
unkown image
|
page readonly
|
||
1FB48221000
|
unkown
|
page read and write
|
||
1ECCF1F0000
|
unkown
|
page read and write
|
||
7FF536DD0000
|
unkown image
|
page readonly
|
||
1FB47613000
|
unkown
|
page read and write
|
||
7FF5C2051000
|
unkown image
|
page readonly
|
||
2C4B000
|
unkown image
|
page readonly
|
||
2A8B000
|
unkown image
|
page readonly
|
||
7FF5C1E5F000
|
unkown image
|
page readonly
|
||
2E30000
|
unkown
|
page read and write
|
||
1FB47DAC000
|
unkown
|
page read and write
|
||
1FB47800000
|
unkown image
|
page readonly
|
||
F570779000
|
unkown
|
page read and write
|
||
A80000
|
unkown
|
page read and write
|
||
7FF5BF00A000
|
unkown image
|
page readonly
|
||
7FF536A55000
|
unkown image
|
page readonly
|
||
3598000
|
unkown
|
page read and write
|
||
7FF5BEF9D000
|
unkown image
|
page readonly
|
||
1FB47DA2000
|
unkown
|
page read and write
|
||
13C99458000
|
unkown
|
page read and write
|
||
C081D7E000
|
unkown
|
page read and write
|
||
AF0000
|
unkown image
|
page readonly
|
||
ADA000
|
heap private
|
page read and write
|
||
C4C07A000
|
unkown
|
page read and write
|
||
185C6E55000
|
unkown
|
page read and write
|
||
400000
|
unkown image
|
page readonly
|
||
1FB48140000
|
unkown image
|
page write copy
|
||
185C72D0000
|
unkown image
|
page readonly
|
||
BBE000
|
unkown
|
page read and write
|
||
7FF50838E000
|
unkown image
|
page readonly
|
||
1FB47D83000
|
unkown
|
page read and write
|
||
3A6000
|
unkown
|
page read and write
|
||
1FB476EC000
|
unkown
|
page read and write
|
||
7FF508383000
|
unkown image
|
page readonly
|
||
2AA1000
|
unkown image
|
page readonly
|
||
1FB47D80000
|
unkown
|
page read and write
|
||
7FF5BEF87000
|
unkown image
|
page readonly
|
||
7FF5001B5000
|
unkown image
|
page readonly
|
||
7FF536AA7000
|
unkown image
|
page readonly
|
||
7DF50DFE0000
|
unkown image
|
page readonly
|
||
1FB476B1000
|
unkown
|
page read and write
|
||
BD4000
|
heap private
|
page read and write
|
||
233C7FC0000
|
unkown image
|
page readonly
|
||
2FFB000
|
unkown
|
page read and write
|
||
7A00000
|
unkown
|
page read and write
|
||
1FB47702000
|
unkown
|
page read and write
|
||
D72C7FE000
|
unkown
|
page read and write
|
||
24B98668000
|
unkown
|
page read and write
|
||
7DF5CFCC2000
|
unkown image
|
page readonly
|
||
24B98490000
|
unkown image
|
page readonly
|
||
7FF55CA93000
|
unkown image
|
page readonly
|
||
1ECCF160000
|
unkown
|
page read and write
|
||
7FF50014B000
|
unkown image
|
page readonly
|
||
28FE000
|
unkown image
|
page readonly
|
||
7FF500269000
|
unkown image
|
page readonly
|
||
7FF5081AB000
|
unkown image
|
page readonly
|
||
B7FD0F9000
|
unkown
|
page read and write
|
||
233C7E70000
|
unkown image
|
page read and write
|
||
7FF5C1CDD000
|
unkown image
|
page readonly
|
||
7FF5C1EAB000
|
unkown image
|
page readonly
|
||
13C9946A000
|
unkown
|
page read and write
|
||
1FB47651000
|
unkown
|
page read and write
|
||
7FEE0000
|
unkown image
|
page readonly
|
||
24B985F0000
|
unkown image
|
page readonly
|
||
1FB47D94000
|
unkown
|
page read and write
|
||
1FB47D8C000
|
unkown
|
page read and write
|
||
24B98670000
|
unkown
|
page read and write
|
||
7FF5000E6000
|
unkown image
|
page readonly
|
||
7FF5001E1000
|
unkown image
|
page readonly
|
||
7FF50837E000
|
unkown image
|
page readonly
|
||
233C7E90000
|
unkown image
|
page readonly
|
||
7FC40000
|
unkown image
|
page readonly
|
||
357A000
|
heap default
|
page read and write
|
||
7FF4FFFEE000
|
unkown image
|
page readonly
|
||
6E0000
|
unkown image
|
page readonly
|
||
7DF5CCD10000
|
unkown image
|
page readonly
|
||
7DF4429E0000
|
unkown image
|
page readonly
|
||
29EA000
|
unkown image
|
page readonly
|
||
6F7000
|
heap private
|
page read and write
|
||
28CB000
|
unkown image
|
page readonly
|
||
233C7EB0000
|
unkown image
|
page readonly
|
||
2A2B000
|
unkown image
|
page readonly
|
||
2E52000
|
unkown
|
page read and write
|
||
1FB47D80000
|
unkown
|
page read and write
|
||
C08207E000
|
unkown
|
page read and write
|
||
7FF5083CE000
|
unkown image
|
page readonly
|
||
2F50000
|
unkown image
|
page read and write
|
||
7FC40000
|
unkown image
|
page readonly
|
||
1FB47DA4000
|
unkown
|
page read and write
|
||
1FB47D72000
|
unkown
|
page read and write
|
||
80FE000
|
unkown
|
page read and write
|
||
1FB48300000
|
unkown
|
page read and write
|
||
1ECCF4D9000
|
heap private
|
page read and write
|
||
1FB47D4E000
|
unkown
|
page read and write
|
||
4874000
|
heap private
|
page read and write
|
||
7DF50DFE0000
|
unkown image
|
page readonly
|
||
139E077000
|
unkown
|
page read and write
|
||
29EA000
|
unkown image
|
page readonly
|
||
1FB47DC3000
|
unkown
|
page read and write
|
||
1FB47D64000
|
unkown
|
page read and write
|
||
7FF536CC2000
|
unkown image
|
page readonly
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
7FF536E89000
|
unkown image
|
page readonly
|
||
7FF508172000
|
unkown image
|
page readonly
|
||
7FF5082FB000
|
unkown image
|
page readonly
|
||
13C99800000
|
unkown image
|
page readonly
|
||
1FB47D77000
|
unkown
|
page read and write
|
||
7FF55CB3A000
|
unkown image
|
page readonly
|
||
7FEE2000
|
unkown image
|
page readonly
|
||
1FB47600000
|
unkown
|
page read and write
|
||
2AAB000
|
unkown image
|
page readonly
|
||
1ECCF4D0000
|
heap private
|
page read and write
|
||
C3D000
|
unkown
|
page read and write
|
||
7DF544B10000
|
unkown image
|
page readonly
|
||
24B98670000
|
unkown
|
page read and write
|
||
7FF5BEFE3000
|
unkown image
|
page readonly
|
||
2AC3000
|
unkown image
|
page readonly
|
||
185C6DD0000
|
unkown image
|
page readonly
|
||
1FB47648000
|
unkown
|
page read and write
|
||
3850000
|
unkown image
|
page readonly
|
||
1FB47D77000
|
unkown
|
page read and write
|
||
7FF536E2D000
|
unkown image
|
page readonly
|
||
1ECCFF70000
|
unkown
|
page read and write
|
||
2AC3000
|
unkown image
|
page readonly
|
||
1FB4764B000
|
unkown
|
page read and write
|
||
7FF5BF091000
|
unkown image
|
page readonly
|
||
1FB48363000
|
unkown
|
page read and write
|
||
7FF5C1F59000
|
unkown image
|
page readonly
|
||
185C6E13000
|
unkown
|
page read and write
|
||
C081AFE000
|
unkown
|
page read and write
|
||
1FB476D5000
|
unkown
|
page read and write
|
||
7FF500361000
|
unkown image
|
page readonly
|
||
7FF55CB24000
|
unkown image
|
page readonly
|
||
1FB47D72000
|
unkown
|
page read and write
|
||
233C7EC0000
|
unkown image
|
page readonly
|
||
7FF536DD3000
|
unkown image
|
page readonly
|
||
1FB47653000
|
unkown
|
page read and write
|
||
7FF4FFFE5000
|
unkown image
|
page readonly
|
||
1ECCF4E0000
|
unkown
|
page read and write
|
||
1FB48200000
|
unkown
|
page read and write
|
||
139E27D000
|
unkown
|
page read and write
|
||
7FF5002DD000
|
unkown image
|
page readonly
|
||
185C6E4D000
|
unkown
|
page read and write
|
||
7FF5BF08A000
|
unkown image
|
page readonly
|
||
7FF5083C3000
|
unkown image
|
page readonly
|
||
900000
|
unkown image
|
page readonly
|
||
7FF5C1E1D000
|
unkown image
|
page readonly
|
||
1FB47670000
|
unkown
|
page read and write
|
||
7FF500332000
|
unkown image
|
page readonly
|
||
7FF53670C000
|
unkown image
|
page readonly
|
||
2A8B000
|
unkown image
|
page readonly
|
||
1FB47D7B000
|
unkown
|
page read and write
|
||
7FF5BF062000
|
unkown image
|
page readonly
|
||
233C8100000
|
unkown
|
page read and write
|
||
C0817BB000
|
unkown
|
page read and write
|
||
2A0F000
|
unkown image
|
page readonly
|
||
1FB47D8F000
|
unkown
|
page read and write
|
||
7FF508167000
|
unkown image
|
page readonly
|
||
1FB47D79000
|
unkown
|
page read and write
|
||
65B0000
|
unkown image
|
page readonly
|
||
1FB47D8C000
|
unkown
|
page read and write
|
||
3350000
|
unkown image
|
page readonly
|
||
13C99513000
|
unkown
|
page read and write
|
||
29F9000
|
unkown image
|
page readonly
|
||
7FC52000
|
unkown image
|
page readonly
|
||
7DF50DFC0000
|
unkown image
|
page readonly
|
||
1FB47D56000
|
unkown
|
page read and write
|
||
2731000
|
unkown image
|
page readonly
|
||
28B3000
|
unkown image
|
page readonly
|
||
150000
|
unkown image
|
page read and write
|
||
B7FD07E000
|
unkown
|
page read and write
|
||
2D08000
|
unkown image
|
page readonly
|
||
7FF5C1E3B000
|
unkown image
|
page readonly
|
||
26BE000
|
unkown image
|
page readonly
|
||
7FF5BEE9F000
|
unkown image
|
page readonly
|
||
B7FCD7F000
|
unkown
|
page read and write
|
||
3370000
|
unkown
|
page read and write
|
||
7FF55CB41000
|
unkown image
|
page readonly
|
||
7FF55CABA000
|
unkown image
|
page readonly
|
||
1FB473E0000
|
unkown image
|
page readonly
|
||
1FB47DFA000
|
unkown
|
page read and write
|
||
595000
|
unkown
|
page read and write
|
||
B20000
|
heap default
|
page read and write
|
||
26BE000
|
unkown image
|
page readonly
|
||
780000
|
unkown image
|
page readonly
|
||
1ECCFF60000
|
unkown
|
page readonly
|
||
7DF544B10000
|
unkown image
|
page readonly
|
||
7FF5081F1000
|
unkown image
|
page readonly
|
||
29E1000
|
unkown image
|
page readonly
|
||
2AC8000
|
unkown image
|
page readonly
|
||
13C99429000
|
unkown
|
page read and write
|
||
7FF55CA60000
|
unkown image
|
page readonly
|
||
B7FCDFF000
|
unkown
|
page read and write
|
||
4870000
|
heap private
|
page read and write
|
||
1FB47D73000
|
unkown
|
page read and write
|
||
7FF536C4A000
|
unkown image
|
page readonly
|
||
1FB473A0000
|
unkown image
|
page read and write
|
||
1FB47D71000
|
unkown
|
page read and write
|
||
7FF5BEFA3000
|
unkown image
|
page readonly
|
||
233C8000000
|
unkown
|
page read and write
|
||
7FF536EB1000
|
unkown image
|
page readonly
|
||
7FF4FFE47000
|
unkown image
|
page readonly
|
||
7FF536DB6000
|
unkown image
|
page readonly
|
||
1FB47D86000
|
unkown
|
page read and write
|
||
59C000
|
unkown
|
page read and write
|
||
7FA12000
|
unkown image
|
page readonly
|
||
2A40000
|
unkown image
|
page readonly
|
||
3200000
|
unkown image
|
page readonly
|
||
1FB473B0000
|
heap private
|
page read and write
|
||
1ECCF220000
|
heap default
|
page read and write
|
||
2E33000
|
heap default
|
page read and write
|
||
7FF536E2A000
|
unkown image
|
page readonly
|
||
2C4F000
|
unkown image
|
page readonly
|
||
1FB47D78000
|
unkown
|
page read and write
|
||
7FF500273000
|
unkown image
|
page readonly
|
||
7FF5C1ED5000
|
unkown image
|
page readonly
|
||
139DC7E000
|
unkown
|
page read and write
|
||
24B98656000
|
heap default
|
page read and write
|
||
28A7000
|
unkown image
|
page readonly
|
||
2CDB000
|
unkown image
|
page readonly
|
||
185C6F13000
|
unkown
|
page read and write
|
||
35A1000
|
unkown
|
page read and write
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
7DF5CFCB2000
|
unkown image
|
page readonly
|
||
1FB47BE0000
|
unkown
|
page read and write
|
||
29BE000
|
unkown image
|
page readonly
|
||
36AE000
|
unkown
|
page read and write
|
||
1FB47DB7000
|
unkown
|
page read and write
|
||
1FB47D03000
|
unkown
|
page read and write
|
||
2A2B000
|
unkown image
|
page readonly
|
||
7FF5C1F5D000
|
unkown image
|
page readonly
|
||
7DF56A7C0000
|
unkown image
|
page readonly
|
||
24B985C0000
|
unkown
|
page read and write
|
||
139D99B000
|
unkown
|
page read and write
|
||
7DF544B22000
|
unkown image
|
page readonly
|
||
7FF50826D000
|
unkown image
|
page readonly
|
||
13C9945B000
|
unkown
|
page read and write
|
||
2A94000
|
unkown image
|
page readonly
|
||
7FF5081E4000
|
unkown image
|
page readonly
|
||
680000
|
unkown
|
page read and write
|
||
29F6000
|
unkown image
|
page readonly
|
||
57A000
|
heap default
|
page read and write
|
||
1FB47D6D000
|
unkown
|
page read and write
|
||
7FF522DC1000
|
unkown image
|
page readonly
|
||
1FB47D8C000
|
unkown
|
page read and write
|
||
233C8002000
|
unkown
|
page read and write
|
||
2A26000
|
unkown image
|
page readonly
|
||
7FF5C1F70000
|
unkown image
|
page readonly
|
||
46B0000
|
unkown image
|
page readonly
|
||
7FF5BF007000
|
unkown image
|
page readonly
|
||
2A9B000
|
unkown image
|
page readonly
|
||
29E1000
|
unkown image
|
page readonly
|
||
24B98740000
|
unkown image
|
page readonly
|
||
CD0000
|
unkown
|
page read and write
|
||
1FB47D7E000
|
unkown
|
page read and write
|
||
13C99460000
|
unkown
|
page read and write
|
||
1FB47D8A000
|
unkown
|
page read and write
|
||
7FEE0000
|
unkown image
|
page readonly
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
7DF5CFCB0000
|
unkown image
|
page readonly
|
||
29F6000
|
unkown image
|
page readonly
|
||
13C99469000
|
unkown
|
page read and write
|
||
7FA30000
|
unkown image
|
page readonly
|
||
7FF500344000
|
unkown image
|
page readonly
|
||
1FB47DB7000
|
unkown
|
page read and write
|
||
2D03000
|
unkown image
|
page readonly
|
||
7FF508417000
|
unkown image
|
page readonly
|
||
7320000
|
unkown
|
page read and write
|
||
7FF508125000
|
unkown image
|
page readonly
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
28F5000
|
unkown image
|
page readonly
|
||
1FB4826A000
|
unkown
|
page read and write
|
||
1FB47D88000
|
unkown
|
page read and write
|
||
1FB476C0000
|
unkown
|
page read and write
|
||
1FB47D7E000
|
unkown
|
page read and write
|
||
7F910000
|
unkown image
|
page readonly
|
||
185C6DC0000
|
unkown image
|
page readonly
|
||
1FB4764D000
|
unkown
|
page read and write
|
||
2C0F000
|
unkown image
|
page readonly
|
||
1ECCF210000
|
unkown
|
page read and write
|
||
1FB47DB7000
|
unkown
|
page read and write
|
||
233C8108000
|
unkown
|
page read and write
|
||
7FF5BE8E2000
|
unkown image
|
page readonly
|
||
7FF5001E5000
|
unkown image
|
page readonly
|
||
7FF5C1F73000
|
unkown image
|
page readonly
|
||
185C6F08000
|
unkown
|
page read and write
|
||
233C804C000
|
unkown
|
page read and write
|
||
2C21000
|
unkown image
|
page readonly
|
||
7FF5C1F77000
|
unkown image
|
page readonly
|
||
1FB473C0000
|
unkown image
|
page readonly
|
||
185C6E76000
|
unkown
|
page read and write
|
||
590000
|
unkown
|
page read and write
|
||
7FF53673E000
|
unkown image
|
page readonly
|
||
7FF5002D7000
|
unkown image
|
page readonly
|
||
3570000
|
heap default
|
page read and write
|
||
1FB47D00000
|
unkown
|
page read and write
|
||
7DF516112000
|
unkown image
|
page readonly
|
||
7FF5C1FCD000
|
unkown image
|
page readonly
|
||
3593000
|
heap default
|
page read and write
|
||
7FF500297000
|
unkown image
|
page readonly
|
||
B7FD1FD000
|
unkown
|
page read and write
|
||
1FB47D77000
|
unkown
|
page read and write
|
||
1ECCF1D0000
|
unkown
|
page read and write
|
||
2A8F000
|
unkown image
|
page readonly
|
||
3598000
|
unkown
|
page read and write
|
||
185C6F02000
|
unkown
|
page read and write
|
||
7DF5CCD02000
|
unkown image
|
page readonly
|
||
7FF5C1B31000
|
unkown image
|
page readonly
|
||
2ABC000
|
unkown image
|
page readonly
|
||
460000
|
heap default
|
page read and write
|
||
7FF5BED15000
|
unkown image
|
page readonly
|
||
729F000
|
unkown
|
page read and write
|
||
7400000
|
unkown
|
page read and write
|
||
185C6E50000
|
unkown
|
page read and write
|
||
7FF500287000
|
unkown image
|
page readonly
|
||
2A05000
|
unkown image
|
page readonly
|
||
1FB47D73000
|
unkown
|
page read and write
|
||
7FF5C1FC7000
|
unkown image
|
page readonly
|
||
C4BE7D000
|
unkown
|
page read and write
|
||
7FF5BEFEE000
|
unkown image
|
page readonly
|
||
3847000
|
heap private
|
page read and write
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
EBD000
|
unkown image
|
page readonly
|
||
1FB48221000
|
unkown
|
page read and write
|
||
1ECCF8F0000
|
unkown image
|
page readonly
|
||
1FB47D79000
|
unkown
|
page read and write
|
||
1FB47D80000
|
unkown
|
page read and write
|
||
1FB47D82000
|
unkown
|
page read and write
|
||
7FF5083AD000
|
unkown image
|
page readonly
|
||
2C45000
|
unkown image
|
page readonly
|
||
72DE000
|
unkown
|
page read and write
|
||
7FF5C1F87000
|
unkown image
|
page readonly
|
||
C081E77000
|
unkown
|
page read and write
|
||
807F000
|
unkown
|
page read and write
|
||
7FF508351000
|
unkown image
|
page readonly
|
||
1FB47D7B000
|
unkown
|
page read and write
|
||
1FB47D8A000
|
unkown
|
page read and write
|
||
233C8802000
|
unkown
|
page read and write
|
||
1FB47D19000
|
unkown
|
page read and write
|
||
6FA000
|
heap private
|
page read and write
|
||
7FF50828B000
|
unkown image
|
page readonly
|
||
1FB48202000
|
unkown
|
page read and write
|
||
7FF500257000
|
unkown image
|
page readonly
|
||
2A0B000
|
unkown image
|
page readonly
|
||
7FF508472000
|
unkown image
|
page readonly
|
||
2F60000
|
unkown image
|
page readonly
|
||
7FF5C2029000
|
unkown image
|
page readonly
|
||
185C6E29000
|
unkown
|
page read and write
|
||
7FF536E9A000
|
unkown image
|
page readonly
|
||
7FF508479000
|
unkown image
|
page readonly
|
||
7FF5001CC000
|
unkown image
|
page readonly
|
||
2E54000
|
unkown
|
page read and write
|
||
7DF413FD0000
|
unkown image
|
page readonly
|
||
7FF55CABD000
|
unkown image
|
page readonly
|
||
7FF5082F5000
|
unkown image
|
page readonly
|
||
7DF544B20000
|
unkown image
|
page readonly
|
||
2C36000
|
unkown image
|
page readonly
|
||
F570B77000
|
unkown
|
page read and write
|
||
1FB47D23000
|
unkown
|
page read and write
|
||
7FEF0000
|
unkown image
|
page readonly
|
||
1FB47DA2000
|
unkown
|
page read and write
|
||
2AB6000
|
unkown image
|
page readonly
|
||
1ECCF26C000
|
unkown
|
page read and write
|
||
1FB47A00000
|
unkown image
|
page readonly
|
||
7FF536DC6000
|
unkown image
|
page readonly
|
||
13C99260000
|
unkown image
|
page readonly
|
||
7FF5C2051000
|
unkown image
|
page readonly
|
||
7DF544B20000
|
unkown image
|
page readonly
|
||
7DF5CCD00000
|
unkown image
|
page readonly
|
||
BE0000
|
unkown image
|
page readonly
|
||
1FB47D23000
|
unkown
|
page read and write
|
||
1FB47D7D000
|
unkown
|
page read and write
|
||
3390000
|
heap default
|
page read and write
|
||
540000
|
unkown
|
page read and write
|
||
1BA000
|
unkown
|
page read and write
|
||
29BE000
|
unkown image
|
page readonly
|
||
2A94000
|
unkown image
|
page readonly
|
||
7FF5C1EA5000
|
unkown image
|
page readonly
|
||
2AC8000
|
unkown image
|
page readonly
|
||
7FF508491000
|
unkown image
|
page readonly
|
||
7FF5083A9000
|
unkown image
|
page readonly
|
||
7FF536A53000
|
unkown image
|
page readonly
|
||
233C8013000
|
unkown
|
page read and write
|
||
7FA20000
|
unkown image
|
page readonly
|
||
24B98669000
|
unkown
|
page read and write
|
||
1FB48219000
|
unkown
|
page read and write
|
||
307E000
|
unkown
|
page read and write
|
||
233C8051000
|
unkown
|
page read and write
|
||
47B0000
|
unkown
|
page read and write
|
||
5B5000
|
unkown
|
page read and write
|
||
1ECCF292000
|
heap default
|
page read and write
|
||
1FB47DA2000
|
unkown
|
page read and write
|
||
7FF5BF074000
|
unkown image
|
page readonly
|
||
13C99467000
|
unkown
|
page read and write
|
||
7FF5C2041000
|
unkown image
|
page readonly
|
||
7FF536E82000
|
unkown image
|
page readonly
|
||
5A1000
|
unkown
|
page read and write
|
||
C081F7F000
|
unkown
|
page read and write
|
||
1FB48363000
|
unkown
|
page read and write
|
||
7FF5C1F7E000
|
unkown image
|
page readonly
|
||
7FF55CA63000
|
unkown image
|
page readonly
|
||
13C99380000
|
unkown
|
page read and write
|
||
7FF5002AB000
|
unkown image
|
page readonly
|
||
7FF55CA4D000
|
unkown image
|
page readonly
|
||
1FB47708000
|
unkown
|
page read and write
|
||
13C99508000
|
unkown
|
page read and write
|
||
7DF544B12000
|
unkown image
|
page readonly
|
||
7FF50016F000
|
unkown image
|
page readonly
|
||
C4BB7B000
|
unkown
|
page read and write
|
||
7FF50012D000
|
unkown image
|
page readonly
|
||
13C99C02000
|
unkown
|
page read and write
|
||
24B98651000
|
unkown
|
page read and write
|
||
7FF5083C0000
|
unkown image
|
page readonly
|
||
24B98640000
|
heap default
|
page read and write
|
||
C081A7E000
|
unkown
|
page read and write
|
||
1FB47D7E000
|
unkown
|
page read and write
|
||
3840000
|
heap private
|
page read and write
|
||
1FB47DA5000
|
unkown
|
page read and write
|
||
1FB476C7000
|
unkown
|
page read and write
|
||
13C99413000
|
unkown
|
page read and write
|
||
2E38000
|
unkown
|
page read and write
|
||
7FF522DC1000
|
unkown image
|
page readonly
|
||
1ECCF227000
|
heap default
|
page read and write
|
||
1FB47DAD000
|
unkown
|
page read and write
|
||
233C7E80000
|
heap private
|
page read and write
|
||
7FF536DBF000
|
unkown image
|
page readonly
|
||
7FF5BEFDB000
|
unkown image
|
page readonly
|
||
7FF507CF8000
|
unkown image
|
page readonly
|
||
7FF5BF00D000
|
unkown image
|
page readonly
|
||
160000
|
unkown image
|
page readonly
|
||
7FF508270000
|
unkown image
|
page readonly
|
||
1FB47D6D000
|
unkown
|
page read and write
|
||
7DF5CCD10000
|
unkown image
|
page readonly
|
||
983000
|
unkown
|
page read and write
|
||
2C39000
|
unkown image
|
page readonly
|
||
1FB47DC2000
|
unkown
|
page read and write
|
||
CC0000
|
unkown
|
page read and write
|
||
2CFC000
|
unkown image
|
page readonly
|
||
7FF5C2022000
|
unkown image
|
page readonly
|
||
7DF5CFCB2000
|
unkown image
|
page readonly
|
||
7DF5CCCF0000
|
unkown image
|
page readonly
|
||
7FF5002DA000
|
unkown image
|
page readonly
|
||
3520000
|
unkown image
|
page readonly
|
||
3290000
|
unkown image
|
page readonly
|
||
7FF5BEEE5000
|
unkown image
|
page readonly
|
||
2731000
|
unkown image
|
page readonly
|
||
7DF4CDB80000
|
unkown image
|
page readonly
|
||
560000
|
unkown image
|
page readonly
|
||
BD0000
|
heap private
|
page read and write
|
||
1FB47D6D000
|
unkown
|
page read and write
|
||
24B98AC0000
|
unkown image
|
page readonly
|
||
36E0000
|
heap private
|
page read and write
|
||
F57057E000
|
unkown
|
page read and write
|
||
24B98470000
|
unkown image
|
page read and write
|
||
7FF5BEF11000
|
unkown image
|
page readonly
|
||
233C808A000
|
unkown
|
page read and write
|
||
1ECCF000000
|
unkown image
|
page read and write
|
||
1FB476B5000
|
unkown
|
page read and write
|
||
C4B78E000
|
unkown
|
page read and write
|
||
2A40000
|
unkown image
|
page readonly
|
||
7DF544B12000
|
unkown image
|
page readonly
|
||
7FED0000
|
unkown image
|
page readonly
|
||
2A8F000
|
unkown image
|
page readonly
|
||
28CB000
|
unkown image
|
page readonly
|
||
7DF516120000
|
unkown image
|
page readonly
|
||
185C6E6C000
|
unkown
|
page read and write
|
||
7FF508205000
|
unkown image
|
page readonly
|
||
7FF5082AF000
|
unkown image
|
page readonly
|
||
1ECCFD50000
|
unkown
|
page read and write
|
||
7FF5BEB71000
|
unkown image
|
page readonly
|
||
13C99360000
|
unkown image
|
page readonly
|
||
233C8102000
|
unkown
|
page read and write
|
||
1FB47DB3000
|
unkown
|
page read and write
|
||
185C6F00000
|
unkown
|
page read and write
|
||
13C99210000
|
unkown image
|
page read and write
|
||
7DF56A7A2000
|
unkown image
|
page readonly
|
||
7FF536DBD000
|
unkown image
|
page readonly
|
||
D72C77D000
|
unkown
|
page read and write
|
||
7DF5CCCF2000
|
unkown image
|
page readonly
|
||
185C6E81000
|
unkown
|
page read and write
|
||
1ECCFFD0000
|
unkown
|
page read and write
|
||
2E52000
|
unkown
|
page read and write
|
||
F570977000
|
unkown
|
page read and write
|
||
7FF507CD5000
|
unkown image
|
page readonly
|
||
AD7000
|
heap private
|
page read and write
|
||
1FB47D7E000
|
unkown
|
page read and write
|
||
7FF50812D000
|
unkown image
|
page readonly
|
||
8100000
|
unkown
|
page read and write
|
||
13C99462000
|
unkown
|
page read and write
|
||
F570A7F000
|
unkown
|
page read and write
|
||
1FB47D8A000
|
unkown
|
page read and write
|
||
7FF50026D000
|
unkown image
|
page readonly
|
||
7FC52000
|
unkown image
|
page readonly
|
||
1FB47DA9000
|
unkown
|
page read and write
|
||
1FB474F0000
|
unkown image
|
page readonly
|
||
F570D7A000
|
unkown
|
page read and write
|
||
7FF500111000
|
unkown image
|
page readonly
|
||
384A000
|
heap private
|
page read and write
|
||
7FF508397000
|
unkown image
|
page readonly
|
||
7DF50DFC0000
|
unkown image
|
page readonly
|
||
3110000
|
unkown image
|
page readonly
|
||
2D08000
|
unkown image
|
page readonly
|
||
2CEB000
|
unkown image
|
page readonly
|
||
80BE000
|
unkown
|
page read and write
|
||
7DF516112000
|
unkown image
|
page readonly
|
||
1FB4764A000
|
unkown
|
page read and write
|
||
7FA30000
|
unkown image
|
page readonly
|
||
7FF50034A000
|
unkown image
|
page readonly
|
||
7FF536EAA000
|
unkown image
|
page readonly
|
||
7FF508255000
|
unkown image
|
page readonly
|
||
7FF5BF091000
|
unkown image
|
page readonly
|
||
7FF5C1E01000
|
unkown image
|
page readonly
|
||
28A7000
|
unkown image
|
page readonly
|
||
7FF5BEE7B000
|
unkown image
|
page readonly
|
||
1FB47BE0000
|
unkown
|
page read and write
|
||
36B0000
|
unkown image
|
page readonly
|
||
2E10000
|
heap default
|
page read and write
|
||
7DF5CFCC2000
|
unkown image
|
page readonly
|
||
1FB47D8E000
|
unkown
|
page read and write
|
||
233C8400000
|
unkown image
|
page readonly
|
||
2C2A000
|
unkown image
|
page readonly
|
||
13C99400000
|
unkown
|
page read and write
|
||
1FB47D96000
|
unkown
|
page read and write
|
||
1ECCF1E0000
|
unkown
|
page read and write
|
||
1FB47410000
|
heap default
|
page read and write
|
||
2971000
|
unkown image
|
page readonly
|
||
7DF516102000
|
unkown image
|
page readonly
|
||
7FC50000
|
unkown image
|
page readonly
|
||
1FB47713000
|
unkown
|
page read and write
|
||
7FF536E0E000
|
unkown image
|
page readonly
|
||
2F60000
|
unkown image
|
page readonly
|
||
1FB47D99000
|
unkown
|
page read and write
|
||
7FF5BEF9F000
|
unkown image
|
page readonly
|
||
1ECCF180000
|
unkown image
|
page readonly
|
||
2FBA000
|
unkown
|
page read and write
|
||
7FF5083AF000
|
unkown image
|
page readonly
|
||
7FF5BEF15000
|
unkown image
|
page readonly
|
||
1FB47D8C000
|
unkown
|
page read and write
|
||
24B98490000
|
unkown image
|
page readonly
|
||
7DF5CFCB0000
|
unkown image
|
page readonly
|
||
7FF55CA9E000
|
unkown image
|
page readonly
|
||
7FF508484000
|
unkown image
|
page readonly
|
||
7FF50837A000
|
unkown image
|
page readonly
|
||
3590000
|
unkown
|
page read and write
|
||
185C7550000
|
unkown
|
page read and write
|
||
1FB47D96000
|
unkown
|
page read and write
|
||
7FF55CA8B000
|
unkown image
|
page readonly
|
||
7DF5CCD02000
|
unkown image
|
page readonly
|
||
2A1D000
|
unkown image
|
page readonly
|
||
1FB47D83000
|
unkown
|
page read and write
|
||
2A0F000
|
unkown image
|
page readonly
|
||
7FF5BEFB0000
|
unkown image
|
page readonly
|
||
1FB47DC2000
|
unkown
|
page read and write
|
||
7FF500351000
|
unkown image
|
page readonly
|
||
1FB48202000
|
unkown
|
page read and write
|
||
1FB47DE9000
|
unkown
|
page read and write
|
||
7FDD0000
|
unkown image
|
page readonly
|
||
233C8113000
|
unkown
|
page read and write
|
||
2B0B000
|
unkown image
|
page readonly
|
||
36E4000
|
heap private
|
page read and write
|
||
2CD4000
|
unkown image
|
page readonly
|
||
7FF536E02000
|
unkown image
|
page readonly
|
||
7FF507CD9000
|
unkown image
|
page readonly
|
||
2A26000
|
unkown image
|
page readonly
|
||
1ECCF4A0000
|
unkown image
|
page readonly
|
||
185C6D80000
|
unkown image
|
page read and write
|
||
1ECCF020000
|
unkown image
|
page readonly
|
||
7FF5C1ED1000
|
unkown image
|
page readonly
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
1FB47D97000
|
unkown
|
page read and write
|
||
7FF508226000
|
unkown image
|
page readonly
|
||
1FB48302000
|
unkown
|
page read and write
|
||
7FF5C2034000
|
unkown image
|
page readonly
|
||
7FF55CA6E000
|
unkown image
|
page readonly
|
||
1FB47D8A000
|
unkown
|
page read and write
|
||
7FF5BEB77000
|
unkown image
|
page readonly
|
||
7FF5BF07A000
|
unkown image
|
page readonly
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
B00000
|
unkown
|
page read and write
|
||
139DEFB000
|
unkown
|
page read and write
|
||
1FB47D78000
|
unkown
|
page read and write
|
||
13C99454000
|
unkown
|
page read and write
|
||
356E000
|
unkown
|
page read and write
|
||
7FF507E0B000
|
unkown image
|
page readonly
|
||
7FF50035A000
|
unkown image
|
page readonly
|
||
1FB47716000
|
unkown
|
page read and write
|
||
24B98670000
|
unkown
|
page read and write
|
||
7FF507CF2000
|
unkown image
|
page readonly
|
||
185C6DF0000
|
heap default
|
page read and write
|
||
AC0000
|
unkown
|
page read and write
|
||
13C99502000
|
unkown
|
page read and write
|
||
7DF468670000
|
unkown image
|
page readonly
|
||
1FB47650000
|
unkown
|
page read and write
|
||
7FF508251000
|
unkown image
|
page readonly
|
||
1FB47649000
|
unkown
|
page read and write
|
||
233C804A000
|
unkown
|
page read and write
|
||
233C803C000
|
unkown
|
page read and write
|
||
2AA1000
|
unkown image
|
page readonly
|
||
7DF40BE90000
|
unkown image
|
page readonly
|
||
28B3000
|
unkown image
|
page readonly
|
||
7FF55C379000
|
unkown image
|
page readonly
|
||
233C7EE0000
|
heap default
|
page read and write
|
||
233C807C000
|
unkown
|
page read and write
|
||
185C6DA0000
|
unkown image
|
page readonly
|
||
7FF5083FE000
|
unkown image
|
page readonly
|
||
1FB476AB000
|
unkown
|
page read and write
|
||
2AC8000
|
unkown image
|
page readonly
|
||
7FEF0000
|
unkown image
|
page readonly
|
||
598000
|
unkown
|
page read and write
|
||
1FB47DB3000
|
unkown
|
page read and write
|
||
598000
|
unkown
|
page read and write
|
||
2E38000
|
unkown
|
page read and write
|
||
7FF508325000
|
unkown image
|
page readonly
|
||
B7FD17F000
|
unkown
|
page read and write
|
||
7DF5CCCF0000
|
unkown image
|
page readonly
|
||
233C8200000
|
unkown image
|
page readonly
|
||
1FB47D8F000
|
unkown
|
page read and write
|
||
1ECCF26E000
|
unkown
|
page read and write
|
||
185C6E3C000
|
unkown
|
page read and write
|
||
7FF536713000
|
unkown image
|
page readonly
|
||
1FB47D79000
|
unkown
|
page read and write
|
||
7FF5C1FAE000
|
unkown image
|
page readonly
|
||
7FC42000
|
unkown image
|
page readonly
|
||
24B98610000
|
unkown image
|
page readonly
|
||
2CF6000
|
unkown image
|
page readonly
|
||
233C7E90000
|
unkown image
|
page readonly
|
||
81F0000
|
unkown
|
page read and write
|
||
7FF507F81000
|
unkown image
|
page readonly
|
||
7FF5BE8E8000
|
unkown image
|
page readonly
|
||
7FF536EA5000
|
unkown image
|
page readonly
|
||
233C802A000
|
unkown
|
page read and write
|
||
7FC60000
|
unkown image
|
page readonly
|
||
D72C67B000
|
unkown
|
page read and write
|
||
7FF50028E000
|
unkown image
|
page readonly
|
||
233C808D000
|
unkown
|
page read and write
|
||
1FB47D80000
|
unkown
|
page read and write
|
||
7DA000
|
unkown
|
page read and write
|
||
7FF508074000
|
unkown image
|
page readonly
|
||
7FC42000
|
unkown image
|
page readonly
|
||
24B98680000
|
unkown
|
page read and write
|
||
139DF7E000
|
unkown
|
page read and write
|
||
7DF5CCCF2000
|
unkown image
|
page readonly
|
||
7FEE2000
|
unkown image
|
page readonly
|
||
7DF516100000
|
unkown image
|
page readonly
|
||
1FB47DE5000
|
unkown
|
page read and write
|
||
160000
|
unkown image
|
page readonly
|
||
7FF5C1FCA000
|
unkown image
|
page readonly
|
||
1FB47D72000
|
unkown
|
page read and write
|
||
139DCFE000
|
unkown
|
page read and write
|
||
1FB4826A000
|
unkown
|
page read and write
|
||
1FB47D7A000
|
unkown
|
page read and write
|
||
1ECCFF80000
|
unkown
|
page read and write
|
||
13C9943C000
|
unkown
|
page read and write
|
||
7DF56A7B2000
|
unkown image
|
page readonly
|
||
13C9945A000
|
unkown
|
page read and write
|
||
2E3C000
|
unkown
|
page read and write
|
||
D72C6FE000
|
unkown
|
page read and write
|
||
F5704FF000
|
unkown
|
page read and write
|
||
1FB47BF0000
|
unkown image
|
page read and write
|
||
233C8056000
|
unkown
|
page read and write
|
||
1FB47D83000
|
unkown
|
page read and write
|
||
1FB47D77000
|
unkown
|
page read and write
|
||
7FF536CC7000
|
unkown image
|
page readonly
|
||
1FB476D2000
|
unkown
|
page read and write
|
||
7FF50841D000
|
unkown image
|
page readonly
|
||
F570C7F000
|
unkown
|
page read and write
|
||
7FF536D1C000
|
unkown image
|
page readonly
|
||
1FB4764E000
|
unkown
|
page read and write
|
||
1FB48202000
|
unkown
|
page read and write
|
||
7FF5C1F47000
|
unkown image
|
page readonly
|
||
1FB47DAE000
|
unkown
|
page read and write
|
||
139E17F000
|
unkown
|
page read and write
|
||
97F000
|
unkown
|
page read and write
|
||
7DF516102000
|
unkown image
|
page readonly
|
||
7FF5BEE5D000
|
unkown image
|
page readonly
|
||
307A000
|
unkown
|
page read and write
|
||
1FB475E0000
|
unkown
|
page read and write
|
||
7FF5083EB000
|
unkown image
|
page readonly
|
||
1FB47DA8000
|
unkown
|
page read and write
|
||
2CCF000
|
unkown image
|
page readonly
|
||
24B984B0000
|
unkown image
|
page readonly
|
||
1FB000
|
unkown
|
page read and write
|
There are 973 hidden memdumps, click here to show them.