Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Sts Global Order.xlsx
|
CDFV2 Encrypted
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\sunday[1].exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Temp\tmp98E5.tmp
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\CXFxEHIAOoJFws.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\EA860E7A-A87F-4A88-92EF-38F744458171\run.dat
|
Non-ISO extended-ASCII text, with no line terminators
|
dropped
|
|
|
|
C:\Users\Public\vbc.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3DB8310A.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5E16820E.jpeg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650,
frames 3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\74AB189.png
|
PNG image data, 543 x 105, 8-bit colormap, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\77E899F6.jpeg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, Exif Standard: [TIFF image data, big-endian,
direntries=2], baseline, precision 8, 407x282, frames 3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\87CB7174.jpeg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650,
frames 3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8DCFAE5.png
|
PNG image data, 550 x 360, 8-bit colormap, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B93D533B.png
|
PNG image data, 543 x 105, 8-bit colormap, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CD2DD57F.png
|
PNG image data, 1295 x 471, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D5668C01.png
|
PNG image data, 1295 x 471, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F809BC00.jpeg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, Exif Standard: [TIFF image data, big-endian,
direntries=2], baseline, precision 8, 407x282, frames 3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FF8CFBA2.png
|
PNG image data, 838 x 469, 8-bit colormap, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\EA860E7A-A87F-4A88-92EF-38F744458171\catalog.dat
|
data
|
dropped
|
|
|
|
C:\Users\user\Desktop\~$Sts Global Order.xlsx
|
data
|
dropped
|
|
There are 9 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
|
|
|
|
C:\Users\Public\vbc.exe
|
'C:\Users\Public\vbc.exe'
|
|
|
|
C:\Windows\SysWOW64\schtasks.exe
|
'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CXFxEHIAOoJFws' /XML 'C:\Users\user\AppData\Local\Temp\tmp98E5.tmp'
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://itisalllove.servepics.com/georgia/city/sunday.exe
|
31.3.244.76
|
|
|
|
newme1122.3utilities.com
|
|
||
|
newme122.3utilities.com
|
|
||
|
http://www.%s.comPA
|
unknown
|
|
|
|
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
|
unknown
|
|
|
|
http://google.com
|
unknown
|
|
|
|
http://www.collada.org/2005/11/COLLADASchema9Done
|
unknown
|
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
newme122.3utilities.com
|
23.105.131.228
|
|
|
|
itisalllove.servepics.com
|
31.3.244.76
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
23.105.131.228
|
newme122.3utilities.com
|
United States
|
|
|
|
31.3.244.76
|
itisalllove.servepics.com
|
United Kingdom
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
{}*
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
|
MTTT
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
|
ReviewToken
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\2E994
|
2E994
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
VBAFiles
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
9#+
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\33237
|
33237
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\34AD5
|
34AD5
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Item 1
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 21
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
EXCELFiles
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\33237
|
33237
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
|
EquationEditorFilesIntl_1033
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
|
FontCachePath
|
|
There are 31 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
34E1000
|
unkown
|
page read and write
|
|
|
|
24E1000
|
unkown
|
page read and write
|
|
|
|
38BF000
|
unkown
|
page read and write
|
|
|
|
402000
|
unkown
|
page execute and read and write
|
|
|
|
D10000
|
unkown image
|
page read and write
|
|
|
|
3673000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
1090000
|
unkown
|
page read and write
|
|
|
|
33B000
|
unkown
|
page read and write
|
|
|
|
4900000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
560000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
812E000
|
stack
|
page read and write
|
|
|
|
A9C000
|
stack
|
page read and write
|
|
|
|
600F000
|
unkown
|
page read and write
|
|
|
|
1BA000
|
unkown
|
page read and write
|
|
|
|
68A1000
|
unkown
|
page read and write
|
|
|
|
12B0000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
5E66000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
544000
|
unkown
|
page read and write
|
|
|
|
586E000
|
stack
|
page read and write
|
|
|
|
530000
|
unkown
|
page execute and read and write
|
|
|
|
566E000
|
stack
|
page read and write
|
|
|
|
5FA5000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
6E0000
|
unkown
|
page read and write
|
|
|
|
6EE6000
|
unkown
|
page read and write
|
|
|
|
4A63000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page read and write
|
|
|
|
572D000
|
stack
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
1090000
|
unkown
|
page execute and read and write
|
|
|
|
653000
|
unkown
|
page read and write
|
|
|
|
5E05000
|
unkown
|
page read and write
|
|
|
|
5FCC000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
4ADD000
|
unkown
|
page read and write
|
|
|
|
34D000
|
unkown
|
page read and write
|
|
|
|
387F000
|
unkown
|
page read and write
|
|
|
|
5F5B000
|
unkown
|
page read and write
|
|
|
|
2D7000
|
unkown
|
page execute and read and write
|
|
|
|
4A64000
|
unkown
|
page read and write
|
|
|
|
46D0000
|
unkown
|
page read and write
|
|
|
|
7EF50000
|
unkown
|
page execute and read and write
|
|
|
|
643D000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
2D2000
|
unkown
|
page read and write
|
|
|
|
450000
|
unkown
|
page read and write
|
|
|
|
54AE000
|
stack
|
page read and write
|
|
|
|
6147000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
4C80000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
4A47000
|
unkown
|
page read and write
|
|
|
|
61CC000
|
unkown
|
page read and write
|
|
|
|
546000
|
unkown
|
page read and write
|
|
|
|
270000
|
unkown image
|
page read and write
|
|
|
|
60A000
|
unkown
|
page read and write
|
|
|
|
651000
|
unkown
|
page read and write
|
|
|
|
B30000
|
unkown
|
page read and write
|
|
|
|
2C2000
|
unkown
|
page execute and read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
2CA000
|
unkown
|
page execute and read and write
|
|
|
|
17A000
|
unkown
|
page execute and read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
63F8000
|
unkown
|
page read and write
|
|
|
|
5EB9000
|
unkown
|
page read and write
|
|
|
|
6019000
|
unkown
|
page read and write
|
|
|
|
B1C000
|
stack
|
page read and write
|
|
|
|
658000
|
unkown
|
page read and write
|
|
|
|
6F07000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
CD0000
|
unkown image
|
page read and write
|
|
|
|
50AE000
|
stack
|
page read and write
|
|
|
|
5DD0000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
5D9F000
|
unkown
|
page read and write
|
|
|
|
48E2000
|
heap private
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
CEE000
|
unkown
|
page read and write
|
|
|
|
4F20000
|
unkown image
|
page readonly
|
|
|
|
658000
|
unkown
|
page read and write
|
|
|
|
481E000
|
stack
|
page read and write
|
|
|
|
41A4000
|
unkown
|
page read and write
|
|
|
|
3B0000
|
unkown image
|
page readonly
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
46E0000
|
unkown
|
page read and write
|
|
|
|
46D0000
|
unkown
|
page read and write
|
|
|
|
4204000
|
unkown
|
page read and write
|
|
|
|
120000
|
unkown
|
page read and write
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
255B000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
1048000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
176000
|
unkown
|
page read and write | page guard
|
|
|
|
63C0000
|
unkown
|
page read and write
|
|
|
|
6CFA000
|
unkown
|
page read and write
|
|
|
|
48B0000
|
unkown
|
page read and write
|
|
|
|
CE0000
|
unkown
|
page execute and read and write
|
|
|
|
5D45000
|
unkown
|
page read and write
|
|
|
|
D00000
|
unkown image
|
page readonly
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
587000
|
heap default
|
page read and write
|
|
|
|
CF0000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
51DD000
|
stack
|
page read and write
|
|
|
|
172000
|
unkown
|
page execute and read and write
|
|
|
|
1C7000
|
unkown
|
page execute and read and write
|
|
|
|
550000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
65A000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
790000
|
heap private
|
page read and write
|
|
|
|
6458000
|
unkown
|
page read and write
|
|
|
|
959000
|
heap private
|
page read and write
|
|
|
|
500000
|
unkown image
|
page readonly
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
D35000
|
heap private
|
page execute and read and write
|
|
|
|
690000
|
heap default
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
47F4000
|
heap private
|
page read and write
|
|
|
|
570000
|
unkown image
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
555000
|
unkown
|
page read and write
|
|
|
|
560000
|
unkown
|
page read and write
|
|
|
|
594E000
|
stack
|
page read and write | page guard
|
|
|
|
152000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
5D41000
|
unkown
|
page read and write
|
|
|
|
2DB000
|
unkown
|
page execute and read and write
|
|
|
|
5F9E000
|
unkown
|
page read and write
|
|
|
|
498000
|
unkown
|
page read and write
|
|
|
|
528E000
|
stack
|
page read and write
|
|
|
|
63C8000
|
unkown
|
page read and write
|
|
|
|
5D3C000
|
unkown
|
page read and write
|
|
|
|
B41000
|
unkown
|
page read and write
|
|
|
|
4CFE000
|
stack
|
page read and write | page guard
|
|
|
|
61B8000
|
unkown
|
page read and write
|
|
|
|
5FE7000
|
unkown
|
page read and write
|
|
|
|
3E0000
|
unkown image
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
4244000
|
unkown
|
page read and write
|
|
|
|
5BA0000
|
unkown
|
page read and write
|
|
|
|
6417000
|
unkown
|
page read and write
|
|
|
|
5ABF000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
5F86000
|
unkown
|
page read and write
|
|
|
|
487E000
|
stack
|
page read and write
|
|
|
|
663000
|
unkown
|
page read and write
|
|
|
|
4A00000
|
heap private
|
page execute and read and write
|
|
|
|
540000
|
unkown
|
page execute and read and write
|
|
|
|
2C0000
|
unkown
|
page read and write
|
|
|
|
255D000
|
unkown
|
page read and write
|
|
|
|
5D74000
|
unkown
|
page read and write
|
|
|
|
64A000
|
unkown
|
page read and write
|
|
|
|
5E54000
|
unkown
|
page read and write
|
|
|
|
12A0000
|
unkown image
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
9F0000
|
heap private
|
page read and write
|
|
|
|
683A000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
750000
|
unkown
|
page read and write
|
|
|
|
643000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page read and write
|
|
|
|
5F59000
|
unkown
|
page read and write
|
|
|
|
34D000
|
unkown
|
page read and write
|
|
|
|
296A000
|
unkown
|
page read and write
|
|
|
|
652C000
|
unkown
|
page read and write
|
|
|
|
2F0000
|
unkown image
|
page readonly
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
5C50000
|
unkown
|
page read and write
|
|
|
|
2BA000
|
unkown
|
page execute and read and write
|
|
|
|
5D6A000
|
unkown
|
page read and write
|
|
|
|
5B50000
|
heap private
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
65BE000
|
stack
|
page read and write
|
|
|
|
373F000
|
unkown
|
page read and write
|
|
|
|
3A44000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
11AE000
|
stack
|
page read and write
|
|
|
|
5BAD000
|
unkown
|
page read and write
|
|
|
|
D02000
|
unkown image
|
page execute read
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
4750000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
3B0000
|
unkown
|
page read and write
|
|
|
|
26D1000
|
unkown
|
page read and write
|
|
|
|
7A0000
|
unkown image
|
page read and write
|
|
|
|
643A000
|
unkown
|
page read and write
|
|
|
|
599E000
|
stack
|
page read and write
|
|
|
|
4C6E000
|
stack
|
page read and write
|
|
|
|
10000
|
unkown image
|
page read and write
|
|
|
|
320000
|
unkown
|
page execute and read and write
|
|
|
|
10A0000
|
unkown
|
page read and write
|
|
|
|
56CD000
|
stack
|
page read and write
|
|
|
|
6259000
|
unkown
|
page read and write
|
|
|
|
63B5000
|
unkown
|
page read and write
|
|
|
|
662000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
7EFE0000
|
unkown image
|
page readonly
|
|
|
|
6850000
|
unkown
|
page read and write
|
|
|
|
A50000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
45C0000
|
unkown
|
page read and write
|
|
|
|
5DDA000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
41C4000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
736000
|
heap default
|
page read and write
|
|
|
|
5B0E000
|
unkown
|
page read and write
|
|
|
|
37DF000
|
unkown
|
page read and write
|
|
|
|
5FE0000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
65B5000
|
unkown
|
page read and write
|
|
|
|
3A33000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
CC0000
|
unkown
|
page read and write
|
|
|
|
7D3F000
|
stack
|
page read and write
|
|
|
|
6017000
|
unkown
|
page read and write
|
|
|
|
1047000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
546000
|
unkown
|
page read and write
|
|
|
|
57FE000
|
stack
|
page read and write
|
|
|
|
3B0000
|
unkown
|
page read and write
|
|
|
|
5B4E000
|
stack
|
page read and write
|
|
|
|
5DA3000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
1FA000
|
unkown
|
page read and write
|
|
|
|
13A000
|
unkown
|
page execute and read and write
|
|
|
|
940000
|
unkown image
|
page read and write
|
|
|
|
5FEC000
|
unkown
|
page read and write
|
|
|
|
342000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
5C8000
|
heap default
|
page read and write
|
|
|
|
310000
|
unkown
|
page read and write
|
|
|
|
D30000
|
heap private
|
page execute and read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
6EEB000
|
unkown
|
page read and write
|
|
|
|
4A2C000
|
unkown
|
page read and write
|
|
|
|
42C4000
|
unkown
|
page read and write
|
|
|
|
60000
|
unkown image
|
page readonly
|
|
|
|
5E5F000
|
unkown
|
page read and write
|
|
|
|
6E0000
|
unkown image
|
page readonly
|
|
|
|
B70000
|
unkown image
|
page read and write
|
|
|
|
5CA6000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
6032000
|
unkown
|
page read and write
|
|
|
|
4164000
|
unkown
|
page read and write
|
|
|
|
4B12000
|
unkown
|
page read and write
|
|
|
|
60CE000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
5ED5000
|
stack
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
661000
|
unkown
|
page read and write
|
|
|
|
602F000
|
unkown
|
page read and write
|
|
|
|
7820000
|
unkown image
|
page readonly
|
|
|
|
5D3A000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
49C0000
|
unkown
|
page read and write
|
|
|
|
CB0000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
5D15000
|
unkown
|
page read and write
|
|
|
|
6392000
|
unkown
|
page read and write
|
|
|
|
33E000
|
unkown
|
page read and write
|
|
|
|
170000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
6089000
|
unkown
|
page read and write
|
|
|
|
33C000
|
heap default
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
3923000
|
unkown
|
page read and write
|
|
|
|
7EFDF000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
64A000
|
unkown
|
page read and write
|
|
|
|
480000
|
heap default
|
page read and write
|
|
|
|
390000
|
unkown image
|
page readonly
|
|
|
|
5CF9000
|
unkown
|
page read and write
|
|
|
|
776000
|
heap private
|
page read and write
|
|
|
|
5F3F000
|
unkown
|
page read and write
|
|
|
|
AA0000
|
heap private
|
page execute and read and write
|
|
|
|
650000
|
unkown
|
page read and write
|
|
|
|
60D000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
6175000
|
unkown
|
page read and write
|
|
|
|
65A000
|
unkown
|
page read and write
|
|
|
|
1290000
|
unkown
|
page read and write
|
|
|
|
63D000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
6766000
|
unkown
|
page read and write
|
|
|
|
5AA7000
|
unkown
|
page read and write
|
|
|
|
5C5B000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
12D0000
|
unkown image
|
page readonly
|
|
|
|
50000
|
unkown image
|
page readonly
|
|
|
|
1048000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
5CA9000
|
unkown
|
page read and write
|
|
|
|
5EC2000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
4144000
|
unkown
|
page read and write
|
|
|
|
546000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
9FC000
|
heap private
|
page read and write
|
|
|
|
4A86000
|
unkown
|
page read and write
|
|
|
|
610B000
|
unkown
|
page read and write
|
|
|
|
53F0000
|
unkown
|
page read and write
|
|
|
|
640B000
|
unkown
|
page read and write
|
|
|
|
4184000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
4A07000
|
heap private
|
page execute and read and write
|
|
|
|
596F000
|
stack
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
50000
|
unkown image
|
page readonly
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
3827000
|
unkown
|
page read and write
|
|
|
|
350000
|
heap private
|
page read and write
|
|
|
|
64C000
|
unkown
|
page read and write
|
|
|
|
2B0000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
5CAA000
|
unkown
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
4AB6000
|
unkown
|
page read and write
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
1290000
|
unkown
|
page execute and read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
7EFDF000
|
unkown
|
page read and write
|
|
|
|
CD0000
|
unkown image
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
1B0000
|
heap private
|
page read and write
|
|
|
|
545000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
5F57000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
32D000
|
heap default
|
page read and write
|
|
|
|
498C000
|
stack
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
CF0000
|
unkown
|
page read and write
|
|
|
|
4A86000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
5CA9000
|
unkown
|
page read and write
|
|
|
|
567000
|
unkown
|
page read and write
|
|
|
|
6A2F000
|
unkown
|
page read and write
|
|
|
|
2E6000
|
unkown
|
page read and write | page guard
|
|
|
|
6890000
|
unkown
|
page read and write
|
|
|
|
E0C000
|
unkown image
|
page readonly
|
|
|
|
5C9D000
|
unkown
|
page read and write
|
|
|
|
5FDE000
|
unkown
|
page read and write
|
|
|
|
2F6000
|
heap default
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
5BB2000
|
unkown
|
page read and write
|
|
|
|
3953000
|
unkown
|
page read and write
|
|
|
|
4A47000
|
unkown
|
page read and write
|
|
|
|
546000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
6579000
|
unkown
|
page read and write
|
|
|
|
5FE5000
|
unkown
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
3973000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
3B1000
|
unkown
|
page read and write
|
|
|
|
4F40000
|
unkown image
|
page read and write
|
|
|
|
4BAE000
|
stack
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
550000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
2A2000
|
unkown
|
page execute and read and write
|
|
|
|
80E000
|
stack
|
page read and write
|
|
|
|
6394000
|
unkown
|
page read and write
|
|
|
|
5CBE000
|
unkown
|
page read and write
|
|
|
|
648000
|
unkown
|
page read and write
|
|
|
|
4AC0000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown
|
page execute and read and write
|
|
|
|
3983000
|
unkown
|
page read and write
|
|
|
|
545000
|
unkown
|
page read and write
|
|
|
|
5F5E000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
A3E000
|
stack
|
page read and write
|
|
|
|
33A000
|
unkown
|
page read and write
|
|
|
|
7A0000
|
unkown
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
3D0000
|
unkown image
|
page readonly
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
555000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
37BF000
|
unkown
|
page read and write
|
|
|
|
74E000
|
stack
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
920000
|
unkown
|
page read and write
|
|
|
|
3B0000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
546000
|
unkown
|
page read and write
|
|
|
|
648B000
|
unkown
|
page read and write
|
|
|
|
558000
|
unkown
|
page read and write
|
|
|
|
470000
|
unkown
|
page execute and read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
6F03000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
5D1A000
|
unkown
|
page read and write
|
|
|
|
810000
|
heap private
|
page execute and read and write
|
|
|
|
B70000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
6483000
|
unkown
|
page read and write
|
|
|
|
D00000
|
unkown image
|
page readonly
|
|
|
|
700000
|
unkown
|
page read and write
|
|
|
|
5F43000
|
unkown
|
page read and write
|
|
|
|
2995000
|
unkown
|
page read and write
|
|
|
|
546000
|
unkown
|
page read and write
|
|
|
|
27DC000
|
unkown
|
page read and write
|
|
|
|
5AD3000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
60000
|
unkown image
|
page readonly
|
|
|
|
602B000
|
unkown
|
page read and write
|
|
|
|
604E000
|
stack
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
177000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
64E000
|
unkown
|
page read and write
|
|
|
|
7C0000
|
unkown image
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
608000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown image
|
page readonly
|
|
|
|
5E0E000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
A50000
|
unkown image
|
page readonly
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
4820000
|
unkown
|
page read and write
|
|
|
|
314000
|
unkown
|
page read and write
|
|
|
|
64A000
|
unkown
|
page read and write
|
|
|
|
9E0000
|
unkown image
|
page readonly
|
|
|
|
5D77000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
6385000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
450000
|
unkown
|
page read and write
|
|
|
|
6C2E000
|
unkown
|
page read and write
|
|
|
|
29A000
|
unkown
|
page execute and read and write
|
|
|
|
5DDD000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page read and write
|
|
|
|
788000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
CE0000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
4A72000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
E0C000
|
unkown image
|
page readonly
|
|
|
|
42A4000
|
unkown
|
page read and write
|
|
|
|
5CA6000
|
unkown
|
page read and write
|
|
|
|
4E50000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
34D000
|
unkown
|
page read and write
|
|
|
|
389F000
|
unkown
|
page read and write
|
|
|
|
6400000
|
unkown
|
page read and write
|
|
|
|
3A24000
|
unkown
|
page read and write
|
|
|
|
53F0000
|
unkown
|
page read and write
|
|
|
|
33E000
|
unkown
|
page read and write
|
|
|
|
661A000
|
unkown
|
page read and write
|
|
|
|
2E8000
|
unkown
|
page read and write
|
|
|
|
5F51000
|
unkown
|
page read and write
|
|
|
|
770000
|
heap private
|
page read and write
|
|
|
|
637B000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
B20000
|
unkown
|
page read and write
|
|
|
|
797000
|
heap private
|
page read and write
|
|
|
|
323000
|
unkown
|
page read and write
|
|
|
|
142000
|
unkown
|
page execute and read and write
|
|
|
|
1046000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
5FC6000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
7B0000
|
unkown image
|
page read and write
|
|
|
|
64F000
|
unkown
|
page read and write
|
|
|
|
5C6F000
|
unkown
|
page read and write
|
|
|
|
5CA6000
|
unkown
|
page read and write
|
|
|
|
780000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
6012000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
C7F000
|
stack
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
65F5000
|
unkown
|
page read and write
|
|
|
|
A50000
|
unkown
|
page read and write
|
|
|
|
46DD000
|
stack
|
page read and write
|
|
|
|
3B5000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown image
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
546000
|
unkown
|
page read and write
|
|
|
|
5E00000
|
unkown
|
page read and write
|
|
|
|
5EA8000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
B43000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
647B000
|
unkown
|
page read and write
|
|
|
|
1CB000
|
unkown
|
page execute and read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
2543000
|
unkown
|
page read and write
|
|
|
|
F0000
|
unkown image
|
page readonly
|
|
|
|
370000
|
unkown
|
page read and write
|
|
|
|
3A0000
|
unkown
|
page read and write
|
|
|
|
65A000
|
unkown
|
page read and write
|
|
|
|
D02000
|
unkown image
|
page execute read
|
|
|
|
381F000
|
unkown
|
page read and write
|
|
|
|
5EAC000
|
unkown
|
page read and write
|
|
|
|
4A5D000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
4DFE000
|
unkown
|
page read and write
|
|
|
|
560000
|
unkown
|
page read and write
|
|
|
|
CC0000
|
unkown image
|
page readonly
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
39D3000
|
unkown
|
page read and write
|
|
|
|
1A0000
|
unkown image
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
5ACE000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
5CA9000
|
unkown
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
6857000
|
unkown
|
page read and write
|
|
|
|
707000
|
unkown
|
page read and write
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
4A40000
|
unkown
|
page read and write
|
|
|
|
47F0000
|
heap private
|
page read and write
|
|
|
|
6865000
|
unkown
|
page read and write
|
|
|
|
5F8A000
|
unkown
|
page read and write
|
|
|
|
10A0000
|
unkown image
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
190000
|
unkown image
|
page readonly
|
|
|
|
686C000
|
stack
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
6496000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
4264000
|
unkown
|
page read and write
|
|
|
|
3C0000
|
unkown
|
page execute and read and write
|
|
|
|
4A04000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
750000
|
unkown image
|
page read and write
|
|
|
|
547000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
6403000
|
unkown
|
page read and write
|
|
|
|
850000
|
unkown image
|
page readonly
|
|
|
|
6188000
|
unkown
|
page read and write
|
|
|
|
4D5C000
|
stack
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
4AA2000
|
unkown
|
page read and write
|
|
|
|
5CA6000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
5FC8000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
690F000
|
unkown
|
page read and write
|
|
|
|
15A000
|
unkown
|
page execute and read and write
|
|
|
|
49EC000
|
stack
|
page read and write
|
|
|
|
383F000
|
unkown
|
page read and write
|
|
|
|
498E000
|
stack
|
page read and write
|
|
|
|
663000
|
unkown
|
page read and write
|
|
|
|
46D0000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
4990000
|
unkown image
|
page read and write
|
|
|
|
6D9000
|
heap default
|
page read and write
|
|
|
|
48C4000
|
heap private
|
page read and write
|
|
|
|
47EE000
|
stack
|
page read and write
|
|
|
|
6442000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
385F000
|
unkown
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
A40000
|
unkown
|
page execute and read and write
|
|
|
|
605000
|
heap default
|
page read and write
|
|
|
|
5DA5000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
379F000
|
unkown
|
page read and write
|
|
|
|
4720000
|
unkown image
|
page read and write
|
|
|
|
5A4000
|
heap default
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
29C9000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
6EF1000
|
unkown
|
page read and write
|
|
|
|
388F000
|
unkown
|
page read and write
|
|
|
|
565000
|
unkown
|
page read and write
|
|
|
|
44E0000
|
unkown image
|
page readonly
|
|
|
|
4F1D000
|
stack
|
page read and write
|
|
|
|
5A6B000
|
unkown
|
page read and write
|
|
|
|
CBF000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
3A24000
|
unkown
|
page read and write
|
|
|
|
5BF0000
|
unkown
|
page read and write
|
|
|
|
73D000
|
heap default
|
page read and write
|
|
|
|
547000
|
unkown
|
page read and write
|
|
|
|
37FF000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
4CFF000
|
stack
|
page read and write
|
|
|
|
544D000
|
stack
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
7E4F000
|
stack
|
page read and write
|
|
|
|
6138000
|
unkown
|
page read and write
|
|
|
|
14C000
|
unkown
|
page execute and read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
6212000
|
unkown
|
page read and write
|
|
|
|
61FE000
|
unkown
|
page read and write
|
|
|
|
550000
|
unkown
|
page read and write
|
|
|
|
2A0000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown
|
page read and write
|
|
|
|
46D0000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page read and write
|
|
|
|
D52000
|
heap private
|
page execute and read and write
|
|
|
|
5F46000
|
unkown
|
page read and write
|
|
|
|
647000
|
unkown
|
page read and write
|
|
|
|
4A72000
|
unkown
|
page read and write
|
|
|
|
46D5000
|
unkown
|
page read and write
|
|
|
|
5EF2000
|
stack
|
page read and write
|
|
|
|
4284000
|
unkown
|
page read and write
|
|
|
|
160000
|
heap private
|
page read and write
|
|
|
|
A50000
|
unkown
|
page read and write
|
|
|
|
5FD1000
|
unkown
|
page read and write
|
|
|
|
4A28000
|
unkown
|
page read and write
|
|
|
|
648000
|
unkown
|
page read and write
|
|
|
|
4750000
|
unkown
|
page read and write
|
|
|
|
54AE000
|
stack
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
6E5C000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
6025000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
778000
|
heap private
|
page read and write
|
|
|
|
4A24000
|
heap private
|
page execute and read and write
|
|
|
|
3993000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
53F0000
|
unkown
|
page read and write
|
|
|
|
3A24000
|
unkown
|
page read and write
|
|
|
|
3933000
|
unkown
|
page read and write
|
|
|
|
4A72000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
2CC000
|
unkown
|
page execute and read and write
|
|
|
|
649000
|
unkown
|
page read and write
|
|
|
|
5D70000
|
unkown
|
page read and write
|
|
|
|
4A63000
|
unkown
|
page read and write
|
|
|
|
34D000
|
unkown
|
page read and write
|
|
|
|
63D4000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page read and write
|
|
|
|
46D0000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
4A2C000
|
unkown
|
page read and write
|
|
|
|
6B4000
|
heap default
|
page read and write
|
|
|
|
422000
|
unkown
|
page execute and read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
375F000
|
unkown
|
page read and write
|
|
|
|
479E000
|
stack
|
page read and write
|
|
|
|
5CA6000
|
unkown
|
page read and write
|
|
|
|
950000
|
heap private
|
page read and write
|
|
|
|
6344000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
6050000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
3716000
|
unkown
|
page read and write
|
|
|
|
6479000
|
unkown
|
page read and write
|
|
|
|
55BB000
|
stack
|
page read and write
|
|
|
|
663000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
132000
|
unkown
|
page execute and read and write
|
|
|
|
6373000
|
unkown
|
page read and write
|
|
|
|
5FA0000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
49DD000
|
unkown
|
page read and write
|
|
|
|
4AA2000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
6291000
|
unkown
|
page read and write
|
|
|
|
780000
|
unkown image
|
page read and write
|
|
|
|
5FCE000
|
unkown
|
page read and write
|
|
|
|
697000
|
heap default
|
page read and write
|
|
|
|
C4F000
|
stack
|
page read and write
|
|
|
|
2958000
|
unkown
|
page read and write
|
|
|
|
C7E000
|
stack
|
page read and write | page guard
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
61BC000
|
stack
|
page read and write
|
|
|
|
46D0000
|
unkown
|
page read and write
|
|
|
|
5B9E000
|
unkown
|
page read and write
|
|
|
|
41E4000
|
unkown
|
page read and write
|
|
|
|
4D60000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page read and write
|
|
|
|
4224000
|
unkown
|
page read and write
|
|
|
|
60FC000
|
unkown
|
page read and write
|
|
|
|
34D000
|
heap default
|
page read and write
|
|
|
|
63BE000
|
unkown
|
page read and write
|
|
|
|
45D0000
|
unkown
|
page read and write
|
|
|
|
4AB6000
|
unkown
|
page read and write
|
|
|
|
5DD6000
|
unkown
|
page read and write
|
|
|
|
6F0000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
CD0000
|
unkown
|
page read and write
|
|
|
|
300000
|
unkown
|
page read and write
|
|
|
|
537E000
|
unkown
|
page read and write
|
|
|
|
5A51000
|
unkown
|
page read and write
|
|
|
|
46D0000
|
unkown
|
page read and write
|
|
|
|
C4E000
|
stack
|
page read and write | page guard
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
2531000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
637E000
|
unkown
|
page read and write
|
|
|
|
668000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
607A000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
556000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
5F8D000
|
unkown
|
page read and write
|
|
|
|
5F81000
|
unkown
|
page read and write
|
|
|
|
658000
|
unkown
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
140000
|
unkown
|
page read and write
|
|
|
|
4AB6000
|
unkown
|
page read and write
|
|
|
|
4A2D000
|
unkown
|
page read and write
|
|
|
|
780000
|
unkown
|
page read and write
|
|
|
|
4A49000
|
unkown
|
page read and write
|
|
|
|
5A30000
|
heap private
|
page read and write
|
|
|
|
6445000
|
unkown
|
page read and write
|
|
|
|
2997000
|
unkown
|
page read and write
|
|
|
|
46D9000
|
unkown
|
page read and write
|
|
|
|
7EFE0000
|
unkown image
|
page readonly
|
|
|
|
62EB000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
5C32000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
4A28000
|
unkown
|
page read and write
|
|
|
|
3D0000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
3A24000
|
unkown
|
page read and write
|
|
|
|
A50000
|
unkown
|
page read and write
|
|
|
|
550000
|
unkown
|
page read and write
|
|
|
|
D00000
|
unkown image
|
page readonly
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
4750000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
5F97000
|
unkown
|
page read and write
|
|
|
|
4A86000
|
unkown
|
page read and write
|
|
|
|
46D8000
|
unkown
|
page read and write
|
|
|
|
6814000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page read and write
|
|
|
|
675D000
|
stack
|
page read and write
|
|
|
|
5A50000
|
unkown
|
page read and write
|
|
|
|
5AA0000
|
heap private
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
5EAE000
|
unkown
|
page read and write
|
|
|
|
594F000
|
stack
|
page read and write
|
|
|
|
5E8F000
|
unkown
|
page read and write
|
|
|
|
5B21000
|
unkown
|
page read and write
|
|
|
|
3963000
|
unkown
|
page read and write
|
|
|
|
5B3E000
|
unkown
|
page read and write
|
|
|
|
663000
|
unkown
|
page read and write
|
|
|
|
3B0000
|
unkown
|
page read and write
|
|
|
|
4812000
|
heap private
|
page read and write
|
|
|
|
377F000
|
unkown
|
page read and write
|
|
|
|
2F0000
|
heap default
|
page read and write
|
|
|
|
108E000
|
stack
|
page read and write
|
|
|
|
5CB0000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
6A30000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown image
|
page readonly
|
|
|
|
36F6000
|
unkown
|
page read and write
|
|
|
|
39C4000
|
unkown
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
645E000
|
stack
|
page read and write
|
|
|
|
5CA6000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
D00000
|
unkown image
|
page read and write
|
|
|
|
65A000
|
unkown
|
page read and write
|
|
|
|
10000
|
unkown image
|
page read and write
|
|
|
|
346000
|
unkown
|
page read and write
|
|
|
|
39C3000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
550000
|
unkown
|
page read and write
|
|
|
|
5C02000
|
unkown
|
page read and write
|
|
|
|
54C000
|
unkown
|
page read and write
|
|
|
|
5D9D000
|
unkown
|
page read and write
|
|
|
|
5CA6000
|
unkown
|
page read and write
|
|
|
|
6437000
|
unkown
|
page read and write
|
|
|
|
5CA9000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page read and write
|
|
|
|
410000
|
heap private
|
page execute and read and write
|
|
|
|
646000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
790000
|
unkown image
|
page readonly
|
|
|
|
5F3A000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
3A24000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
4AA2000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
292000
|
unkown
|
page execute and read and write
|
|
|
|
2B6000
|
unkown
|
page execute and read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
39A4000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
1040000
|
unkown
|
page read and write
|
|
|
|
11B0000
|
unkown image
|
page readonly
|
|
|
|
5D48000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
494E000
|
stack
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
5FD4000
|
unkown
|
page read and write
|
|
|
|
36D1000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
708000
|
unkown
|
page read and write
|
|
|
|
39E4000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
560000
|
unkown
|
page read and write
|
|
|
|
60C0000
|
unkown
|
page read and write
|
|
|
|
1045000
|
unkown
|
page read and write
|
|
|
|
6481000
|
unkown
|
page read and write
|
|
|
|
5EC0000
|
unkown
|
page read and write
|
|
|
|
5C90000
|
unkown
|
page read and write
|
|
|
|
46F0000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
2B2000
|
unkown
|
page read and write
|
|
|
|
3A04000
|
unkown
|
page read and write
|
|
|
|
5ED0000
|
stack
|
page read and write
|
|
|
|
5BEE000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
3924000
|
unkown
|
page read and write
|
|
|
|
64B000
|
unkown
|
page read and write
|
|
|
|
280000
|
unkown
|
page read and write
|
|
|
|
580000
|
heap default
|
page read and write
|
|
|
|
5CA1000
|
unkown
|
page read and write
|
|
|
|
570000
|
unkown
|
page read and write
|
|
|
|
3964000
|
unkown
|
page read and write
|
|
|
|
644D000
|
unkown
|
page read and write
|
|
|
|
65B000
|
unkown
|
page read and write
|
|
|
|
48C0000
|
heap private
|
page read and write
|
|
|
|
5C91000
|
unkown
|
page read and write
|
|
|
|
471C000
|
stack
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
157000
|
unkown
|
page execute and read and write
|
|
|
|
34D000
|
unkown
|
page read and write
|
|
|
|
3943000
|
unkown
|
page read and write
|
|
|
|
53EF000
|
stack
|
page read and write
|
|
|
|
550000
|
unkown
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
63D6000
|
unkown
|
page read and write
|
|
|
|
33E000
|
unkown
|
page read and write
|
|
|
|
3B0000
|
unkown
|
page read and write
|
|
|
|
33E000
|
unkown
|
page read and write
|
|
|
|
5E6C000
|
unkown
|
page read and write
|
|
|
|
A50000
|
unkown
|
page read and write
|
|
|
|
3A24000
|
unkown
|
page read and write
|
|
|
|
9D0000
|
unkown image
|
page readonly
|
|
|
|
3A23000
|
unkown
|
page read and write
|
|
|
|
5B90000
|
unkown
|
page read and write
|
|
|
|
540000
|
unkown
|
page read and write
|
|
|
|
5CB0000
|
unkown
|
page read and write
|
|
|
|
3984000
|
unkown
|
page read and write
|
|
|
|
32E000
|
unkown
|
page read and write
|
|
|
|
5EC7000
|
unkown
|
page read and write
|
|
|
|
5D51000
|
unkown
|
page read and write
|
|
|
|
12A0000
|
unkown
|
page read and write
|
|
|
|
28F8000
|
unkown
|
page read and write
|
|
There are 936 hidden memdumps, click here to show them.