Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Confirming - Aviso de pago.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\~DF90AE401F15B67D78.TMP
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
 |
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Confirming - Aviso de pago.exe
|
"C:\Users\user\Desktop\Confirming - Aviso de pago.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\ministerstormens\Confabulatory
|
Finansierings
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2220000
|
unkown
|
page execute and read and write
|
|
|
|
7FF56A1D0000
|
unkown image
|
page readonly
|
|
|
|
21D9C89E000
|
unkown
|
page read and write
|
|
|
|
1FE0AA70000
|
unkown
|
page read and write
|
|
|
|
EA857FF000
|
stack
|
page read and write
|
|
|
|
7FF525BDA000
|
unkown image
|
page readonly
|
|
|
|
1F49E270000
|
unkown image
|
page readonly
|
|
|
|
21D9C750000
|
unkown image
|
page read and write
|
|
|
|
202B3A51000
|
unkown
|
page read and write
|
|
|
|
F281CF000
|
stack
|
page read and write
|
|
|
|
7FF56A24D000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD89000
|
unkown
|
page read and write
|
|
|
|
EA84FCF000
|
stack
|
page read and write
|
|
|
|
7FF500386000
|
unkown image
|
page readonly
|
|
|
|
F285FB000
|
stack
|
page read and write
|
|
|
|
1FE0AD63000
|
unkown
|
page read and write
|
|
|
|
7B083FB000
|
stack
|
page read and write
|
|
|
|
7FF500836000
|
unkown image
|
page readonly
|
|
|
|
1FE0A513000
|
unkown
|
page read and write
|
|
|
|
7DF5F7920000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD9B000
|
unkown
|
page read and write
|
|
|
|
3040000
|
unkown image
|
page readonly
|
|
|
|
7FF57BC14000
|
unkown image
|
page readonly
|
|
|
|
401000
|
unkown image
|
page execute read
|
|
|
|
1FE0A46E000
|
unkown
|
page read and write
|
|
|
|
1F49E3C0000
|
unkown
|
page read and write
|
|
|
|
1FE0AD6A000
|
unkown
|
page read and write
|
|
|
|
7FF50080A000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD86000
|
unkown
|
page read and write
|
|
|
|
9C250FF000
|
stack
|
page read and write
|
|
|
|
7FF57B7A5000
|
unkown image
|
page readonly
|
|
|
|
202B38E0000
|
unkown image
|
page read and write
|
|
|
|
1F0000
|
unkown
|
page read and write
|
|
|
|
7FF569D90000
|
unkown image
|
page readonly
|
|
|
|
7FF525B44000
|
unkown image
|
page readonly
|
|
|
|
7FF525533000
|
unkown image
|
page readonly
|
|
|
|
21D9C810000
|
unkown image
|
page readonly
|
|
|
|
7DF57F350000
|
unkown image
|
page readonly
|
|
|
|
1F49EC02000
|
unkown
|
page read and write
|
|
|
|
698AD78000
|
stack
|
page read and write
|
|
|
|
7FF57BCC1000
|
unkown image
|
page readonly
|
|
|
|
7FF525C56000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD86000
|
unkown
|
page read and write
|
|
|
|
1FE0AD69000
|
unkown
|
page read and write
|
|
|
|
1FE0A230000
|
unkown image
|
page readonly
|
|
|
|
7FF525AA1000
|
unkown image
|
page readonly
|
|
|
|
7DF590D50000
|
unkown image
|
page readonly
|
|
|
|
202B3A3C000
|
unkown
|
page read and write
|
|
|
|
7FF57BB3C000
|
unkown image
|
page readonly
|
|
|
|
7FF56A0CB000
|
unkown image
|
page readonly
|
|
|
|
7DF515930000
|
unkown image
|
page readonly
|
|
|
|
7FF57BCB4000
|
unkown image
|
page readonly
|
|
|
|
7DF57F342000
|
unkown image
|
page readonly
|
|
|
|
202B4202000
|
unkown
|
page read and write
|
|
|
|
1FE0AD6B000
|
unkown
|
page read and write
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
202B3B08000
|
unkown
|
page read and write
|
|
|
|
7DF515942000
|
unkown image
|
page readonly
|
|
|
|
7FF56A2B4000
|
unkown image
|
page readonly
|
|
|
|
1FE0A44C000
|
unkown
|
page read and write
|
|
|
|
7DF590D60000
|
unkown image
|
page readonly
|
|
|
|
7FF56A0B1000
|
unkown image
|
page readonly
|
|
|
|
7FF57BCC2000
|
unkown image
|
page readonly
|
|
|
|
7FF500380000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
7FF5257F5000
|
unkown image
|
page readonly
|
|
|
|
3A7F000
|
stack
|
page read and write
|
|
|
|
1B956E29000
|
unkown
|
page read and write
|
|
|
|
202B3900000
|
unkown image
|
page readonly
|
|
|
|
40000
|
unkown image
|
page readonly
|
|
|
|
7FF525CC4000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD4D000
|
unkown
|
page read and write
|
|
|
|
1B956E00000
|
unkown
|
page read and write
|
|
|
|
1FE0B202000
|
unkown
|
page read and write
|
|
|
|
7DF53AD50000
|
unkown image
|
page readonly
|
|
|
|
400000
|
unkown image
|
page readonly
|
|
|
|
7FF525BDE000
|
unkown image
|
page readonly
|
|
|
|
1B956E4B000
|
unkown
|
page read and write
|
|
|
|
7B084F7000
|
stack
|
page read and write
|
|
|
|
662000
|
heap default
|
page read and write
|
|
|
|
202B3A4E000
|
unkown
|
page read and write
|
|
|
|
7FF525BAF000
|
unkown image
|
page readonly
|
|
|
|
1F49E43C000
|
unkown
|
page read and write
|
|
|
|
7FF500828000
|
unkown image
|
page readonly
|
|
|
|
7FF57BAB1000
|
unkown image
|
page readonly
|
|
|
|
7FF500804000
|
unkown image
|
page readonly
|
|
|
|
1FE0ADB8000
|
unkown
|
page read and write
|
|
|
|
7FF56A134000
|
unkown image
|
page readonly
|
|
|
|
7DF47D210000
|
unkown image
|
page readonly
|
|
|
|
202B3B13000
|
unkown
|
page read and write
|
|
|
|
202B3A73000
|
unkown
|
page read and write
|
|
|
|
7FF500611000
|
unkown image
|
page readonly
|
|
|
|
21D9C890000
|
unkown
|
page read and write
|
|
|
|
7FF525CD2000
|
unkown image
|
page readonly
|
|
|
|
F280CC000
|
unkown
|
page read and write
|
|
|
|
1FE0AD8B000
|
unkown
|
page read and write
|
|
|
|
7FF525BAB000
|
unkown image
|
page readonly
|
|
|
|
7FF500663000
|
unkown image
|
page readonly
|
|
|
|
7DF590D52000
|
unkown image
|
page readonly
|
|
|
|
1B956E59000
|
unkown
|
page read and write
|
|
|
|
7FF57BA91000
|
unkown image
|
page readonly
|
|
|
|
9C25279000
|
stack
|
page read and write
|
|
|
|
7FF50081F000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD11000
|
unkown
|
page read and write
|
|
|
|
7FF5E27CF000
|
unkown image
|
page readonly
|
|
|
|
1B956E52000
|
unkown
|
page read and write
|
|
|
|
698B078000
|
stack
|
page read and write
|
|
|
|
1F49E45A000
|
unkown
|
page read and write
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
7DF57F352000
|
unkown image
|
page readonly
|
|
|
|
1FE0A4EC000
|
unkown
|
page read and write
|
|
|
|
7DF57F350000
|
unkown image
|
page readonly
|
|
|
|
21D9C7B0000
|
unkown
|
page read and write
|
|
|
|
7FF525CCA000
|
unkown image
|
page readonly
|
|
|
|
7DF5F7930000
|
unkown image
|
page readonly
|
|
|
|
7FF57BBDB000
|
unkown image
|
page readonly
|
|
|
|
1FE0A44E000
|
unkown
|
page read and write
|
|
|
|
21D9C89F000
|
unkown
|
page read and write
|
|
|
|
2BC0000
|
unkown image
|
page read and write
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
202B3A86000
|
unkown
|
page read and write
|
|
|
|
1FE0A44B000
|
unkown
|
page read and write
|
|
|
|
7FF500022000
|
unkown image
|
page readonly
|
|
|
|
7FF500814000
|
unkown image
|
page readonly
|
|
|
|
1B956E4C000
|
unkown
|
page read and write
|
|
|
|
698B2F8000
|
stack
|
page read and write
|
|
|
|
EA855FE000
|
stack
|
page read and write
|
|
|
|
1FE0AD8E000
|
unkown
|
page read and write
|
|
|
|
7FF5007CB000
|
unkown image
|
page readonly
|
|
|
|
7FF5259E0000
|
unkown image
|
page readonly
|
|
|
|
7FF56A0CE000
|
unkown image
|
page readonly
|
|
|
|
7DF53AD70000
|
unkown image
|
page readonly
|
|
|
|
1B956E7E000
|
unkown
|
page read and write
|
|
|
|
21F0000
|
unkown image
|
page readonly
|
|
|
|
2375000
|
heap private
|
page read and write
|
|
|
|
1F49E800000
|
unkown image
|
page readonly
|
|
|
|
7FF57BC38000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD67000
|
unkown
|
page read and write
|
|
|
|
7FF57B790000
|
unkown image
|
page readonly
|
|
|
|
202B3900000
|
unkown image
|
page readonly
|
|
|
|
1FE0A457000
|
unkown
|
page read and write
|
|
|
|
1FE0A458000
|
unkown
|
page read and write
|
|
|
|
7FF5E2554000
|
unkown image
|
page readonly
|
|
|
|
1FE0ADA8000
|
unkown
|
page read and write
|
|
|
|
7FF57BC49000
|
unkown image
|
page readonly
|
|
|
|
7FF525BBF000
|
unkown image
|
page readonly
|
|
|
|
202B3A4A000
|
unkown
|
page read and write
|
|
|
|
7FF52574E000
|
unkown image
|
page readonly
|
|
|
|
202B3950000
|
heap default
|
page read and write
|
|
|
|
1FE0A200000
|
unkown image
|
page readonly
|
|
|
|
7FF50083D000
|
unkown image
|
page readonly
|
|
|
|
7FF525A16000
|
unkown image
|
page readonly
|
|
|
|
7FF5257A0000
|
unkown image
|
page readonly
|
|
|
|
7FF569A32000
|
unkown image
|
page readonly
|
|
|
|
9C251FA000
|
stack
|
page read and write
|
|
|
|
698AA7B000
|
unkown
|
page read and write
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
7DF515940000
|
unkown image
|
page readonly
|
|
|
|
7FF57BB1D000
|
unkown image
|
page readonly
|
|
|
|
7FF57BB34000
|
unkown image
|
page readonly
|
|
|
|
21D9C887000
|
unkown
|
page read and write
|
|
|
|
1FE0AD64000
|
unkown
|
page read and write
|
|
|
|
7FF5E27F4000
|
unkown image
|
page readonly
|
|
|
|
7DF57F352000
|
unkown image
|
page readonly
|
|
|
|
7FF57BC3E000
|
unkown image
|
page readonly
|
|
|
|
1B956E48000
|
unkown
|
page read and write
|
|
|
|
1FE0A980000
|
unkown image
|
page readonly
|
|
|
|
202B3960000
|
unkown image
|
page readonly
|
|
|
|
EA84F4E000
|
stack
|
page read and write
|
|
|
|
21D9C876000
|
heap default
|
page read and write
|
|
|
|
7FF5E27D8000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
1FE0A48A000
|
unkown
|
page read and write
|
|
|
|
7FF57BC2F000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD89000
|
unkown
|
page read and write
|
|
|
|
7FFD0000
|
unkown image
|
page readonly
|
|
|
|
1B956E3C000
|
unkown
|
page read and write
|
|
|
|
1FE0ADD9000
|
unkown
|
page read and write
|
|
|
|
1F49E48A000
|
unkown
|
page read and write
|
|
|
|
21D9CC30000
|
unkown image
|
page readonly
|
|
|
|
7B07FEF000
|
stack
|
page read and write
|
|
|
|
698AB7F000
|
stack
|
page read and write
|
|
|
|
7FF5008B1000
|
unkown image
|
page readonly
|
|
|
|
7DF515932000
|
unkown image
|
page readonly
|
|
|
|
1B956E4F000
|
unkown
|
page read and write
|
|
|
|
7FF525C3F000
|
unkown image
|
page readonly
|
|
|
|
64A000
|
heap default
|
page read and write
|
|
|
|
7FF5008AA000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
EA854F7000
|
stack
|
page read and write
|
|
|
|
1FE0A454000
|
unkown
|
page read and write
|
|
|
|
202B3A55000
|
unkown
|
page read and write
|
|
|
|
F287FF000
|
stack
|
page read and write
|
|
|
|
7DF515942000
|
unkown image
|
page readonly
|
|
|
|
1FE0A1F0000
|
heap private
|
page read and write
|
|
|
|
7FF56A207000
|
unkown image
|
page readonly
|
|
|
|
1FE0B202000
|
unkown
|
page read and write
|
|
|
|
2370000
|
heap private
|
page read and write
|
|
|
|
202B3A29000
|
unkown
|
page read and write
|
|
|
|
7FF500839000
|
unkown image
|
page readonly
|
|
|
|
7DF590D50000
|
unkown image
|
page readonly
|
|
|
|
1FE0A4F9000
|
unkown
|
page read and write
|
|
|
|
470000
|
heap default
|
page read and write
|
|
|
|
1FE0ADAB000
|
unkown
|
page read and write
|
|
|
|
7FF525C17000
|
unkown image
|
page readonly
|
|
|
|
7FF57B796000
|
unkown image
|
page readonly
|
|
|
|
202B3A70000
|
unkown
|
page read and write
|
|
|
|
7FF5007AA000
|
unkown image
|
page readonly
|
|
|
|
7FF525448000
|
unkown image
|
page readonly
|
|
|
|
7FF525994000
|
unkown image
|
page readonly
|
|
|
|
7FFB0000
|
unkown image
|
page readonly
|
|
|
|
7FF56A11D000
|
unkown image
|
page readonly
|
|
|
|
1FE0A455000
|
unkown
|
page read and write
|
|
|
|
21D9C890000
|
unkown
|
page read and write
|
|
|
|
7FF525C2A000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD6C000
|
unkown
|
page read and write
|
|
|
|
1F49E513000
|
unkown
|
page read and write
|
|
|
|
1B956DB0000
|
unkown image
|
page readonly
|
|
|
|
1B956E55000
|
unkown
|
page read and write
|
|
|
|
7FF56A123000
|
unkown image
|
page readonly
|
|
|
|
7FF56A246000
|
unkown image
|
page readonly
|
|
|
|
7FF525A8A000
|
unkown image
|
page readonly
|
|
|
|
7FF525BCA000
|
unkown image
|
page readonly
|
|
|
|
7DF590D40000
|
unkown image
|
page readonly
|
|
|
|
1FE0A44A000
|
unkown
|
page read and write
|
|
|
|
7FF57BBCE000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD14000
|
unkown
|
page read and write
|
|
|
|
7FF525A21000
|
unkown image
|
page readonly
|
|
|
|
7FF57BBCA000
|
unkown image
|
page readonly
|
|
|
|
1FE0A508000
|
unkown
|
page read and write
|
|
|
|
202B3A53000
|
unkown
|
page read and write
|
|
|
|
1B956E6F000
|
unkown
|
page read and write
|
|
|
|
7FF57BBFF000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
7FF525A31000
|
unkown image
|
page readonly
|
|
|
|
1F49E3A0000
|
unkown image
|
page readonly
|
|
|
|
7FF52599B000
|
unkown image
|
page readonly
|
|
|
|
395000
|
unkown
|
page read and write
|
|
|
|
1FE0AA80000
|
unkown image
|
page read and write
|
|
|
|
EA853FB000
|
stack
|
page read and write
|
|
|
|
7DF5F7922000
|
unkown image
|
page readonly
|
|
|
|
7FF5E288A000
|
unkown image
|
page readonly
|
|
|
|
7DF5F7912000
|
unkown image
|
page readonly
|
|
|
|
202B3ED0000
|
unkown image
|
page readonly
|
|
|
|
7FF56A1FC000
|
unkown image
|
page readonly
|
|
|
|
7FF56A23E000
|
unkown image
|
page readonly
|
|
|
|
7FF56A091000
|
unkown image
|
page readonly
|
|
|
|
7FF5007C0000
|
unkown image
|
page readonly
|
|
|
|
7FF57BC1A000
|
unkown image
|
page readonly
|
|
|
|
7FF569F84000
|
unkown image
|
page readonly
|
|
|
|
5E0000
|
unkown
|
page read and write
|
|
|
|
1FE0ADA8000
|
unkown
|
page read and write
|
|
|
|
7FF525C0F000
|
unkown image
|
page readonly
|
|
|
|
202B3A50000
|
unkown
|
page read and write
|
|
|
|
21D9C7D0000
|
unkown
|
page read and write
|
|
|
|
7FF5007EC000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
7DF53AD70000
|
unkown image
|
page readonly
|
|
|
|
202B3A54000
|
unkown
|
page read and write
|
|
|
|
401000
|
unkown image
|
page execute read
|
|
|
|
1FE0AD89000
|
unkown
|
page read and write
|
|
|
|
7DF57F342000
|
unkown image
|
page readonly
|
|
|
|
7FF525C34000
|
unkown image
|
page readonly
|
|
|
|
7FF57BA73000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD8E000
|
unkown
|
page read and write
|
|
|
|
EA84ECC000
|
unkown
|
page read and write
|
|
|
|
7FF525C24000
|
unkown image
|
page readonly
|
|
|
|
202B3A7B000
|
unkown
|
page read and write
|
|
|
|
7FFB2000
|
unkown image
|
page readonly
|
|
|
|
21D9C8A0000
|
unkown
|
page read and write
|
|
|
|
1FE0AD5E000
|
unkown
|
page read and write
|
|
|
|
1F49E400000
|
unkown
|
page read and write
|
|
|
|
7FF57BACE000
|
unkown image
|
page readonly
|
|
|
|
7DF515950000
|
unkown image
|
page readonly
|
|
|
|
7FF5007AC000
|
unkown image
|
page readonly
|
|
|
|
7FF57BCBA000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD98000
|
unkown
|
page read and write
|
|
|
|
1FE0ADAF000
|
unkown
|
page read and write
|
|
|
|
7DF57F340000
|
unkown image
|
page readonly
|
|
|
|
7B07EEB000
|
unkown
|
page read and write
|
|
|
|
7DF438C20000
|
unkown image
|
page readonly
|
|
|
|
1F49E45D000
|
unkown
|
page read and write
|
|
|
|
1B957530000
|
unkown
|
page read and write
|
|
|
|
A40000
|
unkown image
|
page readonly
|
|
|
|
1F49E980000
|
unkown image
|
page readonly
|
|
|
|
7FF500395000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
7DF53AD62000
|
unkown image
|
page readonly
|
|
|
|
7FF57B947000
|
unkown image
|
page readonly
|
|
|
|
21D9C770000
|
unkown image
|
page readonly
|
|
|
|
7DF590D52000
|
unkown image
|
page readonly
|
|
|
|
7DF515930000
|
unkown image
|
page readonly
|
|
|
|
610000
|
unkown
|
page execute read
|
|
|
|
202B3A13000
|
unkown
|
page read and write
|
|
|
|
21D9C881000
|
unkown
|
page read and write
|
|
|
|
7FF5E27CC000
|
unkown image
|
page readonly
|
|
|
|
1F49E508000
|
unkown
|
page read and write
|
|
|
|
1FE0AA70000
|
unkown
|
page read and write
|
|
|
|
1F49E413000
|
unkown
|
page read and write
|
|
|
|
7FF5006BE000
|
unkown image
|
page readonly
|
|
|
|
1FE0A413000
|
unkown
|
page read and write
|
|
|
|
1FE0ADAF000
|
unkown
|
page read and write
|
|
|
|
1FE0AD5B000
|
unkown
|
page read and write
|
|
|
|
7FF525A14000
|
unkown image
|
page readonly
|
|
|
|
1B9570D0000
|
unkown image
|
page readonly
|
|
|
|
1FE0AC02000
|
unkown
|
page read and write
|
|
|
|
1FE0A800000
|
unkown image
|
page readonly
|
|
|
|
7FFC2000
|
unkown image
|
page readonly
|
|
|
|
1F49E270000
|
unkown image
|
page readonly
|
|
|
|
7FF5007F7000
|
unkown image
|
page readonly
|
|
|
|
7FF56A22F000
|
unkown image
|
page readonly
|
|
|
|
7FF525B82000
|
unkown image
|
page readonly
|
|
|
|
7FF5E27FE000
|
unkown image
|
page readonly
|
|
|
|
1FE0A350000
|
unkown
|
page read and write
|
|
|
|
202B3B02000
|
unkown
|
page read and write
|
|
|
|
93F000
|
stack
|
page read and write
|
|
|
|
9B000
|
unkown
|
page read and write
|
|
|
|
7FF5E27E4000
|
unkown image
|
page readonly
|
|
|
|
1B956F08000
|
unkown
|
page read and write
|
|
|
|
21D9C760000
|
heap private
|
page read and write
|
|
|
|
1B956F00000
|
unkown
|
page read and write
|
|
|
|
1F49E500000
|
unkown
|
page read and write
|
|
|
|
21D9C881000
|
unkown
|
page read and write
|
|
|
|
21D9C881000
|
unkown
|
page read and write
|
|
|
|
7FF56A1BC000
|
unkown image
|
page readonly
|
|
|
|
7FF525BB4000
|
unkown image
|
page readonly
|
|
|
|
DD0000
|
unkown image
|
page readonly
|
|
|
|
7FFC2000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD63000
|
unkown
|
page read and write
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
7DF53AD52000
|
unkown image
|
page readonly
|
|
|
|
640000
|
heap default
|
page read and write
|
|
|
|
7FF500713000
|
unkown image
|
page readonly
|
|
|
|
7FF57BBFC000
|
unkown image
|
page readonly
|
|
|
|
698AF7F000
|
stack
|
page read and write
|
|
|
|
1B956E57000
|
unkown
|
page read and write
|
|
|
|
7FF5E20F7000
|
unkown image
|
page readonly
|
|
|
|
7DF590D42000
|
unkown image
|
page readonly
|
|
|
|
21D9CDB0000
|
unkown image
|
page readonly
|
|
|
|
1B956E50000
|
unkown
|
page read and write
|
|
|
|
1FE0A516000
|
unkown
|
page read and write
|
|
|
|
1FE0A400000
|
unkown
|
page read and write
|
|
|
|
7DF53AD52000
|
unkown image
|
page readonly
|
|
|
|
1FE0A4C7000
|
unkown
|
page read and write
|
|
|
|
202B3A47000
|
unkown
|
page read and write
|
|
|
|
21D9C770000
|
unkown image
|
page readonly
|
|
|
|
7FF50082E000
|
unkown image
|
page readonly
|
|
|
|
1FE0A4A7000
|
unkown
|
page read and write
|
|
|
|
1FE0AD90000
|
unkown
|
page read and write
|
|
|
|
1FE0B202000
|
unkown
|
page read and write
|
|
|
|
7DF5F7922000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD98000
|
unkown
|
page read and write
|
|
|
|
1FE0B26A000
|
unkown
|
page read and write
|
|
|
|
7DF53AD62000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD8B000
|
unkown
|
page read and write
|
|
|
|
1FE0AD98000
|
unkown
|
page read and write
|
|
|
|
1FE0A4B1000
|
unkown
|
page read and write
|
|
|
|
7FF525ADE000
|
unkown image
|
page readonly
|
|
|
|
1FE0A370000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD00000
|
unkown
|
page read and write
|
|
|
|
7FF500574000
|
unkown image
|
page readonly
|
|
|
|
7FF57BBBC000
|
unkown image
|
page readonly
|
|
|
|
2380000
|
unkown
|
page read and write
|
|
|
|
698B1FF000
|
stack
|
page read and write
|
|
|
|
7FF56A13C000
|
unkown image
|
page readonly
|
|
|
|
231E000
|
stack
|
page read and write
|
|
|
|
7FF56A249000
|
unkown image
|
page readonly
|
|
|
|
1F49E290000
|
unkown image
|
page readonly
|
|
|
|
7FF525C0C000
|
unkown image
|
page readonly
|
|
|
|
7FF525B2D000
|
unkown image
|
page readonly
|
|
|
|
7FF57BC46000
|
unkown image
|
page readonly
|
|
|
|
7DF515950000
|
unkown image
|
page readonly
|
|
|
|
202B3980000
|
unkown
|
page read and write
|
|
|
|
40000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD8C000
|
unkown
|
page read and write
|
|
|
|
1B9572D0000
|
unkown image
|
page readonly
|
|
|
|
7FF5007BA000
|
unkown image
|
page readonly
|
|
|
|
1F49E260000
|
heap private
|
page read and write
|
|
|
|
202B3920000
|
unkown image
|
page readonly
|
|
|
|
1FE0A250000
|
heap default
|
page read and write
|
|
|
|
21D9C790000
|
unkown image
|
page readonly
|
|
|
|
21D9C876000
|
unkown
|
page read and write
|
|
|
|
7B086FF000
|
stack
|
page read and write
|
|
|
|
7FF5E2819000
|
unkown image
|
page readonly
|
|
|
|
7FF56A2C1000
|
unkown image
|
page readonly
|
|
|
|
7DF57F360000
|
unkown image
|
page readonly
|
|
|
|
7FF5257A6000
|
unkown image
|
page readonly
|
|
|
|
3100000
|
unkown
|
page read and write
|
|
|
|
202B3A8E000
|
unkown
|
page read and write
|
|
|
|
1FE0AD63000
|
unkown
|
page read and write
|
|
|
|
202B3A4D000
|
unkown
|
page read and write
|
|
|
|
1B956D80000
|
unkown image
|
page readonly
|
|
|
|
1B956E13000
|
unkown
|
page read and write
|
|
|
|
424000
|
unkown image
|
page readonly
|
|
|
|
7DF5F7930000
|
unkown image
|
page readonly
|
|
|
|
7FF525ADB000
|
unkown image
|
page readonly
|
|
|
|
7FF5E2808000
|
unkown image
|
page readonly
|
|
|
|
7FF56A021000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
1FE0A4EF000
|
unkown
|
page read and write
|
|
|
|
7FF525C48000
|
unkown image
|
page readonly
|
|
|
|
1F49E250000
|
unkown image
|
page read and write
|
|
|
|
202B3CD0000
|
unkown image
|
page readonly
|
|
|
|
7FF56A2C2000
|
unkown image
|
page readonly
|
|
|
|
1FE0ADB1000
|
unkown
|
page read and write
|
|
|
|
1FE0ADD1000
|
unkown
|
page read and write
|
|
|
|
7FF56A1E7000
|
unkown image
|
page readonly
|
|
|
|
7FF569A38000
|
unkown image
|
page readonly
|
|
|
|
1FE0A43C000
|
unkown
|
page read and write
|
|
|
|
21D9C860000
|
heap default
|
page read and write
|
|
|
|
7FF5008A4000
|
unkown image
|
page readonly
|
|
|
|
7FF525BE5000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD9C000
|
unkown
|
page read and write
|
|
|
|
1FE0AD89000
|
unkown
|
page read and write
|
|
|
|
1B956F13000
|
unkown
|
page read and write
|
|
|
|
1FE0A220000
|
unkown image
|
page readonly
|
|
|
|
1FE0A484000
|
unkown
|
page read and write
|
|
|
|
7FF57BC07000
|
unkown image
|
page readonly
|
|
|
|
7FF56A1DB000
|
unkown image
|
page readonly
|
|
|
|
7DF590D40000
|
unkown image
|
page readonly
|
|
|
|
1B956E49000
|
unkown
|
page read and write
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
2AC0000
|
unkown
|
page read and write
|
|
|
|
202B3A4B000
|
unkown
|
page read and write
|
|
|
|
21E0000
|
unkown
|
page read and write
|
|
|
|
7FF525BEB000
|
unkown image
|
page readonly
|
|
|
|
7DF53AD50000
|
unkown image
|
page readonly
|
|
|
|
7DF5F7910000
|
unkown image
|
page readonly
|
|
|
|
7FF57B447000
|
unkown image
|
page readonly
|
|
|
|
600000
|
heap private
|
page read and write
|
|
|
|
7B085FE000
|
stack
|
page read and write
|
|
|
|
7FF5E20F3000
|
unkown image
|
page readonly
|
|
|
|
7FF56A1FF000
|
unkown image
|
page readonly
|
|
|
|
1F49E2C0000
|
heap default
|
page read and write
|
|
|
|
7FF569D96000
|
unkown image
|
page readonly
|
|
|
|
7FF56A1BA000
|
unkown image
|
page readonly
|
|
|
|
202B3A56000
|
unkown
|
page read and write
|
|
|
|
7FF525B93000
|
unkown image
|
page readonly
|
|
|
|
21D9C890000
|
unkown
|
page read and write
|
|
|
|
7FF525A83000
|
unkown image
|
page readonly
|
|
|
|
7FF5259A6000
|
unkown image
|
page readonly
|
|
|
|
7DF53AD60000
|
unkown image
|
page readonly
|
|
|
|
7FF525B33000
|
unkown image
|
page readonly
|
|
|
|
7FF56A224000
|
unkown image
|
page readonly
|
|
|
|
7DF590D60000
|
unkown image
|
page readonly
|
|
|
|
1FE0ADB9000
|
unkown
|
page read and write
|
|
|
|
7FF5008B2000
|
unkown image
|
page readonly
|
|
|
|
7FF525CD1000
|
unkown image
|
page readonly
|
|
|
|
7FEB0000
|
unkown image
|
page readonly
|
|
|
|
21D9C820000
|
unkown image
|
page readonly
|
|
|
|
1B956E88000
|
unkown
|
page read and write
|
|
|
|
F288FE000
|
stack
|
page read and write
|
|
|
|
30000
|
unkown image
|
page read and write
|
|
|
|
2FC0000
|
unkown
|
page read and write
|
|
|
|
1B956DA0000
|
unkown image
|
page readonly
|
|
|
|
7DF413800000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD9C000
|
unkown
|
page read and write
|
|
|
|
21D9C880000
|
unkown
|
page read and write
|
|
|
|
7FF5256BE000
|
unkown image
|
page readonly
|
|
|
|
202B3930000
|
unkown image
|
page readonly
|
|
|
|
7FF56A238000
|
unkown image
|
page readonly
|
|
|
|
7FF500724000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD7F000
|
unkown
|
page read and write
|
|
|
|
7FF5E281D000
|
unkown image
|
page readonly
|
|
|
|
7FF57BB23000
|
unkown image
|
page readonly
|
|
|
|
9C252FE000
|
stack
|
page read and write
|
|
|
|
F286F7000
|
stack
|
page read and write
|
|
|
|
1FE0A44F000
|
unkown
|
page read and write
|
|
|
|
1FE0ADD9000
|
unkown
|
page read and write
|
|
|
|
7FF525AE8000
|
unkown image
|
page readonly
|
|
|
|
1FE0A4EF000
|
unkown
|
page read and write
|
|
|
|
202B3A49000
|
unkown
|
page read and write
|
|
|
|
7FF525537000
|
unkown image
|
page readonly
|
|
|
|
1B956DD0000
|
heap default
|
page read and write
|
|
|
|
EA856FD000
|
stack
|
page read and write
|
|
|
|
1B956E7F000
|
unkown
|
page read and write
|
|
|
|
7FF50072C000
|
unkown image
|
page readonly
|
|
|
|
698AE77000
|
stack
|
page read and write
|
|
|
|
1FE0A4A7000
|
unkown
|
page read and write
|
|
|
|
7FF57B984000
|
unkown image
|
page readonly
|
|
|
|
2260000
|
unkown image
|
page read and write
|
|
|
|
2210000
|
unkown
|
page read and write
|
|
|
|
1B956D60000
|
unkown image
|
page read and write
|
|
|
|
1FE0AD98000
|
unkown
|
page read and write
|
|
|
|
1F49E2A0000
|
unkown image
|
page readonly
|
|
|
|
698AAFE000
|
stack
|
page read and write
|
|
|
|
7FF57BBD5000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
7FF5E2891000
|
unkown image
|
page readonly
|
|
|
|
7FF5E280E000
|
unkown image
|
page readonly
|
|
|
|
21D9C871000
|
unkown
|
page read and write
|
|
|
|
1F49E45F000
|
unkown
|
page read and write
|
|
|
|
1B956E54000
|
unkown
|
page read and write
|
|
|
|
7FF500537000
|
unkown image
|
page readonly
|
|
|
|
7FFC0000
|
unkown image
|
page readonly
|
|
|
|
7FF56A1CA000
|
unkown image
|
page readonly
|
|
|
|
7FF525742000
|
unkown image
|
page readonly
|
|
|
|
202B3A00000
|
unkown
|
page read and write
|
|
|
|
7FF56A21A000
|
unkown image
|
page readonly
|
|
|
|
7FF569DA5000
|
unkown image
|
page readonly
|
|
|
|
7FF525B4C000
|
unkown image
|
page readonly
|
|
|
|
7FF525C4E000
|
unkown image
|
page readonly
|
|
|
|
9C2507A000
|
unkown
|
page read and write
|
|
|
|
7DF57F340000
|
unkown image
|
page readonly
|
|
|
|
7FF5E2884000
|
unkown image
|
page readonly
|
|
|
|
7FF57BBE7000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD65000
|
unkown
|
page read and write
|
|
|
|
1F49E45C000
|
unkown
|
page read and write
|
|
|
|
1F49E457000
|
unkown
|
page read and write
|
|
|
|
391000
|
unkown
|
page read and write
|
|
|
|
1B956DE0000
|
unkown image
|
page readonly
|
|
|
|
7FF57BBD0000
|
unkown image
|
page readonly
|
|
|
|
21D9C888000
|
unkown
|
page read and write
|
|
|
|
7FF57BC24000
|
unkown image
|
page readonly
|
|
|
|
1A0000
|
unkown image
|
page readonly
|
|
|
|
424000
|
unkown image
|
page readonly
|
|
|
|
7FF525AE3000
|
unkown image
|
page readonly
|
|
|
|
9C2537E000
|
stack
|
page read and write
|
|
|
|
7FF500028000
|
unkown image
|
page readonly
|
|
|
|
7FF56A2BA000
|
unkown image
|
page readonly
|
|
|
|
202B3B00000
|
unkown
|
page read and write
|
|
|
|
7DF515932000
|
unkown image
|
page readonly
|
|
|
|
7FF5007C5000
|
unkown image
|
page readonly
|
|
|
|
1F49E462000
|
unkown
|
page read and write
|
|
|
|
1FE0AD98000
|
unkown
|
page read and write
|
|
|
|
1FE0A200000
|
unkown image
|
page readonly
|
|
|
|
1FE0AA70000
|
unkown
|
page read and write
|
|
|
|
7FF5E27A5000
|
unkown image
|
page readonly
|
|
|
|
7FF57BACB000
|
unkown image
|
page readonly
|
|
|
|
7FF56A214000
|
unkown image
|
page readonly
|
|
|
|
1F49E502000
|
unkown
|
page read and write
|
|
|
|
1FE0A3A0000
|
unkown image
|
page write copy
|
|
|
|
7FFD0000
|
unkown image
|
page readonly
|
|
|
|
7FF5E2892000
|
unkown image
|
page readonly
|
|
|
|
2329000
|
heap private
|
page read and write
|
|
|
|
1F49E45B000
|
unkown
|
page read and write
|
|
|
|
1FE0B202000
|
unkown
|
page read and write
|
|
|
|
7FF56A073000
|
unkown image
|
page readonly
|
|
|
|
1FE0ADD1000
|
unkown
|
page read and write
|
|
|
|
202B3A48000
|
unkown
|
page read and write
|
|
|
|
1FE0A502000
|
unkown
|
page read and write
|
|
|
|
1FE0AD8A000
|
unkown
|
page read and write
|
|
|
|
C40000
|
unkown image
|
page readonly
|
|
|
|
7FF525C59000
|
unkown image
|
page readonly
|
|
|
|
1FE0B200000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown image
|
page readonly
|
|
|
|
F2814F000
|
stack
|
page read and write
|
|
|
|
7FFC0000
|
unkown image
|
page readonly
|
|
|
|
1F49E429000
|
unkown
|
page read and write
|
|
|
|
7FF525442000
|
unkown image
|
page readonly
|
|
|
|
7FF57BA21000
|
unkown image
|
page readonly
|
|
|
|
7FF50070D000
|
unkown image
|
page readonly
|
|
|
|
58E000
|
stack
|
page read and write
|
|
|
|
1FE0B263000
|
unkown
|
page read and write
|
|
|
|
2250000
|
heap private
|
page read and write
|
|
|
|
1B957450000
|
unkown image
|
page readonly
|
|
|
|
7FF525BCC000
|
unkown image
|
page readonly
|
|
|
|
7FF5007D7000
|
unkown image
|
page readonly
|
|
|
|
7FFB0000
|
unkown image
|
page readonly
|
|
|
|
7FF5006A1000
|
unkown image
|
page readonly
|
|
|
|
1F49E467000
|
unkown
|
page read and write
|
|
|
|
1FE0A4D6000
|
unkown
|
page read and write
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
1FE0A600000
|
unkown image
|
page readonly
|
|
|
|
7DF57F360000
|
unkown image
|
page readonly
|
|
|
|
7DF53AD60000
|
unkown image
|
page readonly
|
|
|
|
7FF500681000
|
unkown image
|
page readonly
|
|
|
|
9C2517F000
|
stack
|
page read and write
|
|
|
|
7DF5F7910000
|
unkown image
|
page readonly
|
|
|
|
19C000
|
unkown
|
page read and write
|
|
|
|
698B177000
|
stack
|
page read and write
|
|
|
|
422000
|
unkown image
|
page read and write
|
|
|
|
7FF525752000
|
unkown image
|
page readonly
|
|
|
|
5D0000
|
unkown image
|
page readonly
|
|
|
|
7DF5F7920000
|
unkown image
|
page readonly
|
|
|
|
2378000
|
heap private
|
page read and write
|
|
|
|
7FF5007EF000
|
unkown image
|
page readonly
|
|
|
|
7FFB2000
|
unkown image
|
page readonly
|
|
|
|
7FF525BF7000
|
unkown image
|
page readonly
|
|
|
|
7FF569F47000
|
unkown image
|
page readonly
|
|
|
|
202B4050000
|
unkown image
|
page readonly
|
|
|
|
7FF56A1CE000
|
unkown image
|
page readonly
|
|
|
|
1FE0ADA9000
|
unkown
|
page read and write
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
DC0000
|
unkown image
|
page readonly
|
|
|
|
400000
|
unkown image
|
page readonly
|
|
|
|
21D9C765000
|
heap private
|
page read and write
|
|
|
|
1B956E8E000
|
unkown
|
page read and write
|
|
|
|
7DF48EC10000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD78000
|
unkown
|
page read and write
|
|
|
|
7FF5E27A0000
|
unkown image
|
page readonly
|
|
|
|
7DF590D42000
|
unkown image
|
page readonly
|
|
|
|
7FF5006BB000
|
unkown image
|
page readonly
|
|
|
|
7DF5F7912000
|
unkown image
|
page readonly
|
|
|
|
7DF515940000
|
unkown image
|
page readonly
|
|
|
|
7FF525957000
|
unkown image
|
page readonly
|
|
|
|
7FF5257F7000
|
unkown image
|
page readonly
|
|
|
|
7FF5257B5000
|
unkown image
|
page readonly
|
|
|
|
7FF5E27AB000
|
unkown image
|
page readonly
|
|
|
|
1FE0A4DF000
|
unkown
|
page read and write
|
|
|
|
1B956E4D000
|
unkown
|
page read and write
|
|
|
|
1F49E465000
|
unkown
|
page read and write
|
|
|
|
1F49E460000
|
unkown
|
page read and write
|
|
|
|
7FF525B80000
|
unkown image
|
page readonly
|
|
|
|
1B956D80000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD67000
|
unkown
|
page read and write
|
|
|
|
7FF56A1D5000
|
unkown image
|
page readonly
|
|
|
|
1B956E5A000
|
unkown
|
page read and write
|
|
|
|
1FE0AD98000
|
unkown
|
page read and write
|
|
|
|
1FE0A452000
|
unkown
|
page read and write
|
|
|
|
7FF525AC1000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD91000
|
unkown
|
page read and write
|
|
|
|
7B07F6F000
|
stack
|
page read and write
|
|
|
|
1FE0AD8E000
|
unkown
|
page read and write
|
|
|
|
1F49E454000
|
unkown
|
page read and write
|
|
|
|
1B956D70000
|
heap private
|
page read and write
|
|
|
|
7FF5254E2000
|
unkown image
|
page readonly
|
|
|
|
7FF5007BE000
|
unkown image
|
page readonly
|
|
|
|
1FE0A330000
|
unkown image
|
page readonly
|
|
|
|
1B957602000
|
unkown
|
page read and write
|
|
|
|
1FE0AD7D000
|
unkown
|
page read and write
|
|
|
|
7FF57BBBA000
|
unkown image
|
page readonly
|
|
|
|
21D9CA30000
|
unkown image
|
page readonly
|
|
|
|
1FE0A429000
|
unkown
|
page read and write
|
|
|
|
7DF4F57E0000
|
unkown image
|
page readonly
|
|
|
|
5F0000
|
heap private
|
page read and write
|
|
|
|
1FE0B202000
|
unkown
|
page read and write
|
|
|
|
21D9C8A1000
|
unkown
|
page read and write
|
|
|
|
7FF525BE0000
|
unkown image
|
page readonly
|
|
|
|
7FF57BC4D000
|
unkown image
|
page readonly
|
|
|
|
1FE0A4C0000
|
unkown
|
page read and write
|
|
|
|
1FE0AD0E000
|
unkown
|
page read and write
|
|
|
|
202B38F0000
|
heap private
|
page read and write
|
|
|
|
1FE0A1E0000
|
unkown image
|
page read and write
|
|
|
|
2320000
|
heap private
|
page read and write
|
|
|
|
7FF5E27EA000
|
unkown image
|
page readonly
|
|
|
|
1FE0AD87000
|
unkown
|
page read and write
|
|
|
|
1B956F02000
|
unkown
|
page read and write
|
|
|
|
1F49E600000
|
unkown image
|
page readonly
|
|
There are 629 hidden memdumps, click here to show them.