Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
FILE_915494026923219.xlsm
|
Microsoft Excel 2007+
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\gb[1].dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\~$FILE_915494026923219.xlsm
|
data
|
dropped
|
|
|
|
C:\Users\user\besta.ocx
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3326FDF8.png
|
PNG image data, 1714 x 241, 8-bit colormap, non-interlaced
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Temp\B960.tmp
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\~DF331C8CD839ED59BF.TMP
|
data
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4022966435
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\besta.ocx",Control_RunDLL
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://www.escapelle.uz/wp-includes/n1vS/a
|
unknown
|
|
|
|
https://www.escapelle.uz/wp-includ$https://www.escapelle.uz/wp-includes
|
unknown
|
|
|
|
https://www.escapelle.uz/wp-in
|
unknown
|
|
|
|
https://www.escapelle.uz/wp-includes/n1
|
unknown
|
|
|
|
https://www.escapelle.uz/wp-includes/n1vS/D
|
unknown
|
|
|
|
https://www.escapelle.uz/w
|
unknown
|
|
|
|
https://www.escapelle.uz/1
|
unknown
|
|
|
|
https://www.escapelle.uz/wp-incl
|
unknown
|
|
|
|
https://www.escapelle.uz/)
|
unknown
|
|
|
|
https://www.escapelle.uz/wp-includes/n1vS/
|
62.209.128.105
|
|
|
|
http://www.windows.com/pctv.
|
unknown
|
|
|
|
http://investor.msn.com
|
unknown
|
|
|
|
http://www.msnbc.com/news/ticker.txt
|
unknown
|
|
|
|
http://crl.entrust.net/server1.crl0
|
unknown
|
|
|
|
http://schemas.openformatrg/drawml/2006/spreadsheetD
|
unknown
|
|
|
|
http://ocsp.entrust.net03
|
unknown
|
|
|
|
http://schemas.openformatrg/package/2006/content-t
|
unknown
|
|
|
|
https://www.escapelle.u
|
unknown
|
|
|
|
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
|
unknown
|
|
|
|
http://www.diginotar.nl/cps/pkioverheid0
|
unknown
|
|
|
|
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
|
unknown
|
|
|
|
http://www.hotmail.com/oe
|
unknown
|
|
|
|
http://schemas.open
|
unknown
|
|
|
|
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
|
unknown
|
|
|
|
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
|
unknown
|
|
|
|
http://www.icra.org/vocabulary/.
|
unknown
|
|
|
|
http://schemas.openformatrg/package/2006/r
|
unknown
|
|
|
|
http://investor.msn.com/
|
unknown
|
|
|
|
http://ocsp.entrust.net0D
|
unknown
|
|
|
|
https://secure.comodo.com/CPS0
|
unknown
|
|
|
|
http://crl.entrust.net/2048ca.crl0
|
unknown
|
|
There are 21 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
escapelle.uz
|
62.209.128.105
|
|
|
|
www.escapelle.uz
|
unknown
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
195.154.133.20
|
unknown
|
France
|
|
|
|
212.237.17.99
|
unknown
|
Italy
|
|
|
|
110.232.117.186
|
unknown
|
Australia
|
|
|
|
104.245.52.73
|
unknown
|
United States
|
|
|
|
138.185.72.26
|
unknown
|
Brazil
|
|
|
|
81.0.236.90
|
unknown
|
Czech Republic
|
|
|
|
45.118.115.99
|
unknown
|
Indonesia
|
|
|
|
103.75.201.2
|
unknown
|
Thailand
|
|
|
|
216.158.226.206
|
unknown
|
United States
|
|
|
|
107.182.225.142
|
unknown
|
United States
|
|
|
|
45.118.135.203
|
unknown
|
Japan
|
|
|
|
50.116.54.215
|
unknown
|
United States
|
|
|
|
51.68.175.8
|
unknown
|
France
|
|
|
|
62.209.128.105
|
escapelle.uz
|
Uzbekistan
|
|
|
|
103.8.26.102
|
unknown
|
Malaysia
|
|
|
|
46.55.222.11
|
unknown
|
Bulgaria
|
|
|
|
41.76.108.46
|
unknown
|
South Africa
|
|
|
|
103.8.26.103
|
unknown
|
Malaysia
|
|
|
|
178.79.147.66
|
unknown
|
United Kingdom
|
|
|
|
212.237.5.209
|
unknown
|
Italy
|
|
|
|
176.104.106.96
|
unknown
|
Serbia
|
|
|
|
207.38.84.195
|
unknown
|
United States
|
|
|
|
212.237.56.116
|
unknown
|
Italy
|
|
|
|
45.142.114.231
|
unknown
|
Germany
|
|
|
|
203.114.109.124
|
unknown
|
Thailand
|
|
|
|
210.57.217.132
|
unknown
|
Indonesia
|
|
|
|
58.227.42.236
|
unknown
|
Korea Republic of
|
|
|
|
185.184.25.237
|
unknown
|
Turkey
|
|
|
|
158.69.222.101
|
unknown
|
Canada
|
|
|
|
104.251.214.46
|
unknown
|
United States
|
|
There are 20 hidden IPs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
kp$
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
|
MTTT
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
|
ReviewToken
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\2D7E8
|
2D7E8
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
VBAFiles
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
.|$
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E
|
@%SystemRoot%\system32\qagentrt.dll,-10
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E
|
@%SystemRoot%\System32\fveui.dll,-843
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E
|
@%SystemRoot%\System32\fveui.dll,-844
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E
|
@%SystemRoot%\System32\wuaueng.dll,-400
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\3C2C2
|
3C2C2
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\3D95E
|
3D95E
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
EXCELFiles
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
|
Blob
|
|
There are 59 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2F0000
|
unkown
|
page execute and read and write
|
|
|
|
41D000
|
heap default
|
page read and write
|
|
|
|
46D000
|
heap default
|
page read and write
|
|
|
|
5A37000
|
unkown
|
page read and write
|
|
|
|
30000
|
unkown image
|
page readonly
|
|
|
|
144000
|
heap private
|
page read and write
|
|
|
|
530000
|
unkown image
|
page readonly
|
|
|
|
65300000
|
unkown image
|
page readonly
|
|
|
|
35BD000
|
unkown
|
page read and write
|
|
|
|
5938000
|
unkown
|
page read and write
|
|
|
|
5AE0000
|
unkown image
|
page read and write
|
|
|
|
2060000
|
unkown
|
page read and write
|
|
|
|
10000
|
unkown image
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
7CC8000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
7250000
|
unkown
|
page read and write
|
|
|
|
59AF000
|
unkown
|
page read and write
|
|
|
|
4E0000
|
unkown image
|
page readonly
|
|
|
|
8232000
|
unkown
|
page read and write
|
|
|
|
7220000
|
unkown
|
page read and write
|
|
|
|
59EA000
|
unkown
|
page read and write
|
|
|
|
5971000
|
unkown
|
page read and write
|
|
|
|
2010000
|
unkown image
|
page readonly
|
|
|
|
7334000
|
unkown
|
page read and write
|
|
|
|
5714000
|
stack
|
page read and write
|
|
|
|
6B0000
|
unkown image
|
page readonly
|
|
|
|
5584000
|
stack
|
page read and write
|
|
|
|
4250000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
360000
|
heap private
|
page read and write
|
|
|
|
33C0000
|
unkown
|
page read and write
|
|
|
|
7B60000
|
heap private
|
page read and write
|
|
|
|
7080000
|
unkown
|
page read and write
|
|
|
|
1D70000
|
unkown
|
page read and write
|
|
|
|
58FF000
|
unkown
|
page read and write
|
|
|
|
6C10000
|
unkown
|
page read and write
|
|
|
|
59AF000
|
unkown
|
page read and write
|
|
|
|
74F0000
|
unkown
|
page read and write
|
|
|
|
4FB0000
|
unkown
|
page read and write
|
|
|
|
460000
|
heap default
|
page read and write
|
|
|
|
7222000
|
unkown
|
page read and write
|
|
|
|
3365000
|
unkown
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
3F60000
|
unkown
|
page read and write
|
|
|
|
427000
|
unkown
|
page read and write
|
|
|
|
1D97000
|
unkown
|
page read and write
|
|
|
|
6E45D000
|
unkown image
|
page read and write
|
|
|
|
10000
|
unkown image
|
page read and write
|
|
|
|
4B30000
|
stack
|
page read and write
|
|
|
|
2B0000
|
heap default
|
page read and write
|
|
|
|
6C0000
|
unkown image
|
page readonly
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
6B40000
|
unkown
|
page read and write
|
|
|
|
55F0000
|
unkown
|
page read and write
|
|
|
|
40FF000
|
stack
|
page read and write
|
|
|
|
72F0000
|
unkown
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
A0000
|
unkown image
|
page readonly
|
|
|
|
6E84000
|
unkown image
|
page readonly
|
|
|
|
41D7000
|
unkown
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
6C60000
|
unkown
|
page read and write
|
|
|
|
4F56000
|
unkown
|
page read and write
|
|
|
|
7076000
|
unkown
|
page read and write
|
|
|
|
3F50000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
3B0000
|
unkown
|
page read and write
|
|
|
|
5AE0000
|
unkown
|
page read and write
|
|
|
|
6E44A000
|
unkown image
|
page readonly
|
|
|
|
6E520000
|
unkown image
|
page readonly
|
|
|
|
6E410000
|
unkown image
|
page readonly
|
|
|
|
6B10000
|
unkown
|
page read and write
|
|
|
|
4A6000
|
heap default
|
page read and write
|
|
|
|
20B0000
|
heap private
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
3F8F000
|
unkown
|
page read and write
|
|
|
|
3540000
|
unkown
|
page read and write
|
|
|
|
3F7A000
|
unkown
|
page read and write
|
|
|
|
5973000
|
unkown
|
page read and write
|
|
|
|
2E0000
|
heap default
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
70F000
|
stack
|
page read and write
|
|
|
|
670000
|
unkown image
|
page readonly
|
|
|
|
4AA0000
|
unkown
|
page read and write
|
|
|
|
7EFE0000
|
unkown image
|
page readonly
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
240000
|
unkown
|
page read and write
|
|
|
|
3380000
|
unkown
|
page read and write
|
|
|
|
83A0000
|
heap private
|
page read and write
|
|
|
|
81B0000
|
heap private
|
page read and write
|
|
|
|
4AA8000
|
unkown
|
page read and write
|
|
|
|
417000
|
unkown
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
6B30000
|
unkown
|
page read and write
|
|
|
|
10000
|
unkown image
|
page read and write
|
|
|
|
81F5000
|
unkown
|
page read and write
|
|
|
|
A0000
|
unkown
|
page read and write
|
|
|
|
7210000
|
unkown
|
page read and write
|
|
|
|
7EFE0000
|
unkown image
|
page readonly
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
1D40000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
7FFFFFD0000
|
unkown image
|
page readonly
|
|
|
|
204D000
|
unkown
|
page read and write
|
|
|
|
6E90000
|
unkown
|
page read and write
|
|
|
|
8421000
|
unkown
|
page read and write
|
|
|
|
5930000
|
unkown
|
page read and write
|
|
|
|
A0000
|
unkown image
|
page readonly
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
7FFFFFC0000
|
unkown image
|
page readonly
|
|
|
|
417000
|
heap default
|
page read and write
|
|
|
|
6DF4000
|
unkown
|
page read and write
|
|
|
|
2044000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
3040000
|
heap private
|
page read and write
|
|
|
|
803A000
|
stack
|
page read and write
|
|
|
|
8430000
|
unkown
|
page read and write
|
|
|
|
6B40000
|
unkown
|
page read and write
|
|
|
|
3070000
|
unkown
|
page read and write
|
|
|
|
4A92000
|
unkown
|
page read and write
|
|
|
|
4FAA000
|
unkown
|
page read and write
|
|
|
|
6B22000
|
unkown
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
55C0000
|
unkown
|
page read and write
|
|
|
|
4B20000
|
unkown
|
page read and write
|
|
|
|
5925000
|
unkown
|
page read and write
|
|
|
|
2064000
|
unkown
|
page read and write
|
|
|
|
4B0000
|
unkown
|
page read and write
|
|
|
|
35B2000
|
unkown
|
page read and write
|
|
|
|
33A0000
|
unkown
|
page read and write
|
|
|
|
6C30000
|
unkown
|
page read and write
|
|
|
|
1D53000
|
unkown
|
page read and write
|
|
|
|
359E000
|
unkown
|
page read and write
|
|
|
|
2565000
|
heap private
|
page read and write
|
|
|
|
20B5000
|
heap private
|
page read and write
|
|
|
|
1D50000
|
unkown
|
page read and write
|
|
|
|
790D000
|
unkown
|
page read and write
|
|
|
|
8430000
|
unkown
|
page read and write
|
|
|
|
3FE0000
|
unkown
|
page read and write
|
|
|
|
7CFC000
|
unkown
|
page read and write
|
|
|
|
7FEFF1A0000
|
unkown
|
page execute read
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
4C0000
|
unkown
|
page read and write
|
|
|
|
1E60000
|
unkown image
|
page readonly
|
|
|
|
3F7E000
|
unkown
|
page read and write
|
|
|
|
6E411000
|
unkown image
|
page execute read
|
|
|
|
7EFE0000
|
unkown image
|
page readonly
|
|
|
|
7FFFFFC0000
|
unkown image
|
page readonly
|
|
|
|
4D50000
|
unkown
|
page read and write
|
|
|
|
4FAD000
|
unkown
|
page read and write
|
|
|
|
20C000
|
unkown
|
page read and write
|
|
|
|
90000
|
unkown image
|
page readonly
|
|
|
|
79B0000
|
unkown
|
page read and write
|
|
|
|
7EFDF000
|
unkown
|
page read and write
|
|
|
|
34C000
|
heap default
|
page read and write
|
|
|
|
7C00000
|
heap private
|
page read and write
|
|
|
|
303F000
|
stack
|
page read and write
|
|
|
|
4190000
|
unkown
|
page read and write
|
|
|
|
7060000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
6B95000
|
heap private
|
page read and write
|
|
|
|
35B0000
|
unkown
|
page read and write
|
|
|
|
6C20000
|
unkown
|
page read and write
|
|
|
|
26D000
|
unkown
|
page read and write
|
|
|
|
2020000
|
unkown
|
page read and write
|
|
|
|
7020000
|
unkown
|
page read and write
|
|
|
|
31A0000
|
unkown
|
page read and write
|
|
|
|
840000
|
unkown image
|
page readonly
|
|
|
|
3E76000
|
unkown
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
7FFFFFC2000
|
unkown image
|
page readonly
|
|
|
|
49D000
|
heap default
|
page read and write
|
|
|
|
6EA0000
|
heap private
|
page read and write
|
|
|
|
6B50000
|
unkown
|
page read and write
|
|
|
|
304C000
|
heap private
|
page read and write
|
|
|
|
7EFE0000
|
unkown image
|
page readonly
|
|
|
|
790D000
|
unkown
|
page read and write
|
|
|
|
30000
|
unkown image
|
page readonly
|
|
|
|
58E0000
|
unkown
|
page read and write
|
|
|
|
3FE000
|
stack
|
page read and write
|
|
|
|
31F0000
|
unkown
|
page read and write
|
|
|
|
6B64000
|
unkown
|
page read and write
|
|
|
|
6E521000
|
unkown image
|
page execute read
|
|
|
|
4F48000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
6B9E000
|
heap private
|
page read and write
|
|
|
|
4FAF000
|
unkown
|
page read and write
|
|
|
|
7226000
|
unkown
|
page read and write
|
|
|
|
6E89000
|
unkown image
|
page readonly
|
|
|
|
A0000
|
unkown image
|
page readonly
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
4E5F000
|
stack
|
page read and write
|
|
|
|
3F40000
|
unkown
|
page read and write
|
|
|
|
7921000
|
unkown
|
page read and write
|
|
|
|
59CD000
|
unkown
|
page read and write
|
|
|
|
7FFFFFB2000
|
unkown image
|
page readonly
|
|
|
|
90000
|
unkown image
|
page readonly
|
|
|
|
4FAF000
|
unkown
|
page read and write
|
|
|
|
1C76000
|
unkown
|
page read and write
|
|
|
|
7B1E000
|
stack
|
page read and write
|
|
|
|
324000
|
heap default
|
page read and write
|
|
|
|
7CFC000
|
unkown
|
page read and write
|
|
|
|
7925000
|
unkown
|
page read and write
|
|
|
|
4110000
|
heap private
|
page execute and read and write
|
|
|
|
8D000
|
unkown
|
page read and write
|
|
|
|
3210000
|
unkown image
|
page read and write
|
|
|
|
7CA0000
|
unkown
|
page read and write
|
|
|
|
C0000
|
heap private
|
page read and write
|
|
|
|
4FC5000
|
unkown
|
page read and write
|
|
|
|
3F77000
|
unkown
|
page read and write
|
|
|
|
6E411000
|
unkown image
|
page execute read
|
|
|
|
2069000
|
unkown
|
page read and write
|
|
|
|
78FC000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
7040000
|
unkown
|
page read and write
|
|
|
|
7030000
|
unkown
|
page read and write
|
|
|
|
60000
|
unkown image
|
page readonly
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
3FF0000
|
unkown
|
page read and write
|
|
|
|
5A3E000
|
unkown
|
page read and write
|
|
|
|
404000
|
heap default
|
page read and write
|
|
|
|
20000
|
unkown image
|
page readonly
|
|
|
|
2F10000
|
unkown
|
page read and write
|
|
|
|
2F30000
|
unkown image
|
page readonly
|
|
|
|
7210000
|
unkown
|
page read and write
|
|
|
|
8088000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
4B2F000
|
unkown
|
page read and write
|
|
|
|
55F7000
|
unkown
|
page read and write
|
|
|
|
6B0000
|
unkown image
|
page readonly
|
|
|
|
6E20000
|
unkown image
|
page readonly
|
|
|
|
6B20000
|
unkown
|
page read and write
|
|
|
|
467000
|
heap default
|
page read and write
|
|
|
|
33D0000
|
unkown
|
page read and write
|
|
|
|
3244000
|
heap private
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
33B0000
|
unkown
|
page read and write
|
|
|
|
7240000
|
unkown
|
page read and write
|
|
|
|
1D4E000
|
unkown
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
2D0000
|
heap private
|
page read and write
|
|
|
|
7316000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
400000
|
unkown
|
page read and write
|
|
|
|
7090000
|
heap private
|
page read and write
|
|
|
|
2A0000
|
unkown image
|
page readonly
|
|
|
|
7FFFFFB2000
|
unkown image
|
page readonly
|
|
|
|
41DB000
|
unkown
|
page read and write
|
|
|
|
404000
|
unkown
|
page read and write
|
|
|
|
6D00000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
7240000
|
unkown
|
page read and write
|
|
|
|
31C0000
|
unkown
|
page read and write
|
|
|
|
A60000
|
unkown image
|
page readonly
|
|
|
|
190000
|
heap private
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
35A0000
|
unkown
|
page read and write
|
|
|
|
5AE0000
|
unkown
|
page read and write
|
|
|
|
90000
|
unkown image
|
page readonly
|
|
|
|
4FC8000
|
unkown
|
page read and write
|
|
|
|
3570000
|
unkown
|
page read and write
|
|
|
|
3418000
|
unkown
|
page read and write
|
|
|
|
436000
|
unkown
|
page read and write
|
|
|
|
6E460000
|
unkown image
|
page readonly
|
|
|
|
8060000
|
unkown
|
page read and write
|
|
|
|
6E70000
|
heap private
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
7FFFFFB2000
|
unkown image
|
page readonly
|
|
|
|
304A000
|
unkown
|
page read and write
|
|
|
|
7CE5000
|
unkown
|
page read and write
|
|
|
|
7230000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown image
|
page readonly
|
|
|
|
2130000
|
unkown image
|
page readonly
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
6E80000
|
unkown image
|
page readonly
|
|
|
|
6A0000
|
unkown image
|
page readonly
|
|
|
|
30000
|
unkown image
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
4570000
|
unkown image
|
page readonly
|
|
|
|
58E8000
|
unkown
|
page read and write
|
|
|
|
4AB000
|
heap default
|
page read and write
|
|
|
|
6F56000
|
unkown
|
page read and write
|
|
|
|
7FFFFFC2000
|
unkown image
|
page readonly
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
2047000
|
unkown image
|
page readonly
|
|
|
|
6F20000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown image
|
page readonly
|
|
|
|
707A000
|
unkown
|
page read and write
|
|
|
|
3080000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
4AD0000
|
unkown
|
page read and write
|
|
|
|
59F2000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
135000
|
heap private
|
page read and write
|
|
|
|
6B40000
|
unkown
|
page read and write
|
|
|
|
6E44A000
|
unkown image
|
page readonly
|
|
|
|
315000
|
unkown
|
page execute and read and write
|
|
|
|
1D60000
|
unkown
|
page read and write
|
|
|
|
1DA0000
|
unkown
|
page read and write
|
|
|
|
6B1B000
|
unkown
|
page read and write
|
|
|
|
4D0000
|
unkown
|
page read and write
|
|
|
|
6E844000
|
unkown image
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
180000
|
heap private
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
6E30000
|
unkown
|
page read and write
|
|
|
|
7020000
|
unkown
|
page read and write
|
|
|
|
7260000
|
unkown
|
page read and write
|
|
|
|
1DBE000
|
unkown
|
page read and write
|
|
|
|
7080000
|
unkown
|
page read and write
|
|
|
|
78FC000
|
unkown
|
page read and write
|
|
|
|
7CE5000
|
unkown
|
page read and write
|
|
|
|
7FFFFFD0000
|
unkown image
|
page readonly
|
|
|
|
1DA8000
|
unkown
|
page read and write
|
|
|
|
3240000
|
heap private
|
page read and write
|
|
|
|
2500000
|
unkown
|
page read and write
|
|
|
|
520000
|
unkown image
|
page readonly
|
|
|
|
4FC1000
|
unkown
|
page read and write
|
|
|
|
6B88000
|
unkown
|
page read and write
|
|
|
|
A0000
|
unkown image
|
page readonly
|
|
|
|
7020000
|
unkown
|
page read and write
|
|
|
|
6CF0000
|
unkown
|
page read and write
|
|
|
|
4FC0000
|
unkown
|
page read and write
|
|
|
|
31D0000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
33E8000
|
unkown
|
page read and write
|
|
|
|
3060000
|
unkown
|
page read and write
|
|
|
|
6E8F000
|
unkown image
|
page readonly
|
|
|
|
130000
|
heap private
|
page read and write
|
|
|
|
100000
|
unkown image
|
page readonly
|
|
|
|
2EE000
|
heap default
|
page read and write
|
|
|
|
4FC8000
|
unkown
|
page read and write
|
|
|
|
7BE0000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
1D43000
|
unkown
|
page read and write
|
|
|
|
5A1E000
|
unkown
|
page read and write
|
|
|
|
6B86000
|
unkown
|
page read and write
|
|
|
|
7FFFFFC2000
|
unkown image
|
page readonly
|
|
|
|
6D40000
|
unkown image
|
page read and write
|
|
|
|
6E410000
|
unkown image
|
page readonly
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
6E84F000
|
unkown image
|
page readonly
|
|
|
|
90000
|
unkown image
|
page readonly
|
|
|
|
1D75000
|
unkown
|
page read and write
|
|
|
|
206000
|
unkown
|
page read and write
|
|
|
|
3560000
|
unkown
|
page read and write
|
|
|
|
6E410000
|
unkown image
|
page readonly
|
|
|
|
6B09000
|
unkown
|
page read and write
|
|
|
|
4FD7000
|
unkown
|
page read and write
|
|
|
|
8280000
|
unkown
|
page read and write
|
|
|
|
2A6000
|
unkown
|
page read and write
|
|
|
|
7320000
|
unkown
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
3220000
|
unkown
|
page read and write
|
|
|
|
2040000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
31B0000
|
unkown
|
page read and write
|
|
|
|
4FC1000
|
unkown
|
page read and write
|
|
|
|
6B8A000
|
unkown
|
page read and write
|
|
|
|
3F75000
|
unkown
|
page read and write
|
|
|
|
3E6000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
7270000
|
heap private
|
page read and write
|
|
|
|
304C000
|
unkown
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
417000
|
unkown
|
page read and write
|
|
|
|
2050000
|
unkown
|
page read and write
|
|
|
|
4370000
|
unkown
|
page read and write
|
|
|
|
3F80000
|
unkown
|
page read and write
|
|
|
|
33F0000
|
unkown
|
page read and write
|
|
|
|
7FFFFFB2000
|
unkown image
|
page readonly
|
|
|
|
20EB000
|
heap private
|
page read and write
|
|
|
|
5A40000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
6E848000
|
unkown image
|
page write copy
|
|
|
|
270000
|
unkown
|
page read and write
|
|
|
|
6B4B000
|
unkown
|
page read and write
|
|
|
|
2030000
|
unkown
|
page read and write
|
|
|
|
1DAE000
|
unkown
|
page read and write
|
|
|
|
3F90000
|
unkown
|
page read and write
|
|
|
|
4E60000
|
unkown
|
page read and write
|
|
|
|
3550000
|
unkown
|
page read and write
|
|
|
|
6E90000
|
unkown
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
35A8000
|
unkown
|
page read and write
|
|
|
|
5994000
|
unkown
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
3E0000
|
heap default
|
page read and write
|
|
|
|
3200000
|
unkown image
|
page readonly
|
|
|
|
571E000
|
stack
|
page read and write
|
|
|
|
7CA0000
|
unkown
|
page read and write
|
|
|
|
F0000
|
unkown
|
page read and write
|
|
|
|
7470000
|
heap private
|
page read and write
|
|
|
|
746E000
|
stack
|
page read and write
|
|
|
|
170000
|
unkown image
|
page readonly
|
|
|
|
4F60000
|
unkown
|
page read and write
|
|
|
|
1E60000
|
unkown image
|
page readonly
|
|
|
|
6B50000
|
unkown
|
page read and write
|
|
|
|
6DD8000
|
unkown
|
page read and write
|
|
|
|
416000
|
unkown
|
page read and write
|
|
|
|
2B7000
|
heap default
|
page read and write
|
|
|
|
2560000
|
heap private
|
page read and write
|
|
|
|
6E74000
|
heap private
|
page read and write
|
|
|
|
7040000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
6AE6000
|
unkown
|
page read and write
|
|
|
|
120000
|
unkown image
|
page readonly
|
|
|
|
7062000
|
unkown
|
page read and write
|
|
|
|
7FFFFFB0000
|
unkown image
|
page readonly
|
|
|
|
7070000
|
unkown
|
page read and write
|
|
|
|
467000
|
heap default
|
page read and write
|
|
|
|
910000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
6B3E000
|
unkown
|
page read and write
|
|
|
|
6B40000
|
unkown
|
page read and write
|
|
|
|
6E3C000
|
unkown
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
59D7000
|
unkown
|
page read and write
|
|
|
|
7FFFFFC0000
|
unkown image
|
page readonly
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
430000
|
heap default
|
page read and write
|
|
|
|
3520000
|
unkown
|
page read and write
|
|
|
|
24E0000
|
unkown
|
page read and write
|
|
|
|
90000
|
unkown image
|
page readonly
|
|
|
|
7C3F000
|
heap private
|
page read and write
|
|
|
|
7FFFFFB0000
|
unkown image
|
page readonly
|
|
|
|
2047000
|
unkown image
|
page readonly
|
|
|
|
7300000
|
unkown
|
page read and write
|
|
|
|
270000
|
unkown
|
page read and write
|
|
|
|
35C0000
|
heap private
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
59CD000
|
unkown
|
page read and write
|
|
|
|
7240000
|
unkown
|
page read and write
|
|
|
|
6B40000
|
unkown
|
page read and write
|
|
|
|
437000
|
heap default
|
page read and write
|
|
|
|
6E7F1000
|
unkown image
|
page readonly
|
|
|
|
6B27000
|
unkown
|
page read and write
|
|
|
|
A0000
|
unkown image
|
page readonly
|
|
|
|
6CFF000
|
unkown
|
page read and write
|
|
|
|
7CC8000
|
unkown
|
page read and write
|
|
|
|
1F0000
|
unkown
|
page read and write
|
|
|
|
140000
|
unkown
|
page read and write
|
|
|
|
80BC000
|
unkown
|
page read and write
|
|
|
|
6D50000
|
heap private
|
page read and write
|
|
|
|
3047000
|
heap private
|
page read and write
|
|
|
|
290000
|
unkown
|
page read and write
|
|
|
|
454000
|
heap default
|
page read and write
|
|
|
|
110000
|
unkown
|
page read and write
|
|
|
|
3530000
|
unkown
|
page read and write
|
|
|
|
7022000
|
unkown
|
page read and write
|
|
|
|
4D30000
|
unkown
|
page read and write
|
|
|
|
290000
|
unkown
|
page execute and read and write
|
|
|
|
7DE0000
|
heap private
|
page read and write
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
81F5000
|
unkown
|
page read and write
|
|
|
|
7FFFFFC0000
|
unkown image
|
page readonly
|
|
|
|
31E0000
|
unkown
|
page read and write
|
|
|
|
D0000
|
unkown image
|
page readonly
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
3400000
|
unkown
|
page read and write
|
|
|
|
8280000
|
unkown
|
page read and write
|
|
|
|
6E23000
|
unkown
|
page read and write
|
|
|
|
7240000
|
unkown
|
page read and write
|
|
|
|
5AE0000
|
unkown
|
page read and write
|
|
|
|
35BB000
|
unkown
|
page read and write
|
|
|
|
5994000
|
unkown
|
page read and write
|
|
|
|
A0000
|
unkown image
|
page readonly
|
|
|
|
3590000
|
unkown
|
page read and write
|
|
|
|
10C000
|
unkown
|
page read and write
|
|
|
|
59F2000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
7CE5000
|
unkown
|
page read and write
|
|
|
|
1C40000
|
unkown
|
page read and write
|
|
|
|
90000
|
unkown image
|
page readonly
|
|
|
|
40000
|
unkown image
|
page readonly
|
|
|
|
7EFB0000
|
unkown image
|
page readonly
|
|
|
|
2400000
|
heap private
|
page read and write
|
|
|
|
7060000
|
unkown
|
page read and write
|
|
|
|
6E90000
|
unkown
|
page read and write
|
|
|
|
5600000
|
unkown
|
page read and write
|
|
|
|
80A5000
|
unkown
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
2F20000
|
unkown image
|
page readonly
|
|
|
|
510000
|
heap private
|
page read and write
|
|
|
|
5470000
|
unkown
|
page read and write
|
|
|
|
90000
|
unkown image
|
page readonly
|
|
|
|
7CA0000
|
unkown
|
page read and write
|
|
|
|
5247000
|
unkown image
|
page readonly
|
|
|
|
660000
|
unkown image
|
page readonly
|
|
|
|
7CC8000
|
unkown
|
page read and write
|
|
|
|
50000
|
unkown image
|
page readonly
|
|
|
|
6B13000
|
unkown
|
page read and write
|
|
|
|
8232000
|
unkown
|
page read and write
|
|
|
|
7060000
|
unkown
|
page read and write
|
|
|
|
40000
|
unkown image
|
page readonly
|
|
|
|
3090000
|
unkown
|
page read and write
|
|
|
|
5610000
|
unkown
|
page read and write
|
|
|
|
6D10000
|
unkown image
|
page readonly
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
17C000
|
unkown
|
page read and write
|
|
|
|
456C000
|
stack
|
page read and write
|
|
|
|
82CF000
|
stack
|
page read and write
|
|
|
|
6E45D000
|
unkown image
|
page read and write
|
|
|
|
6C40000
|
unkown
|
page read and write
|
|
|
|
6E410000
|
unkown image
|
page readonly
|
|
|
|
6DE4000
|
unkown
|
page read and write
|
|
|
|
270000
|
heap default
|
page read and write
|
|
|
|
4FC5000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
7266000
|
unkown
|
page read and write
|
|
|
|
7FFFFFC2000
|
unkown image
|
page readonly
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
7310000
|
unkown
|
page read and write
|
|
|
|
160000
|
unkown image
|
page readonly
|
|
|
|
6D20000
|
unkown image
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
90000
|
unkown image
|
page read and write
|
|
|
|
431000
|
unkown
|
page read and write
|
|
|
|
1D84000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
7FFFFFD0000
|
unkown image
|
page readonly
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
334F000
|
stack
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
6B90000
|
heap private
|
page read and write
|
|
|
|
319E000
|
stack
|
page read and write
|
|
|
|
6C70000
|
heap private
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
6D04000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
2023000
|
unkown
|
page read and write
|
|
|
|
6E460000
|
unkown image
|
page readonly
|
|
|
|
55FC000
|
unkown
|
page read and write
|
|
|
|
3580000
|
unkown
|
page read and write
|
|
|
|
351F000
|
stack
|
page read and write
|
|
|
|
7921000
|
unkown
|
page read and write
|
|
|
|
6E83B000
|
unkown image
|
page read and write
|
|
|
|
9F0000
|
heap private
|
page read and write
|
|
|
|
8420000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
5060000
|
unkown image
|
page readonly
|
|
|
|
110000
|
unkown image
|
page readonly
|
|
|
|
3E40000
|
unkown
|
page read and write
|
|
|
|
7EFB2000
|
unkown image
|
page readonly
|
|
|
|
514000
|
heap private
|
page read and write
|
|
|
|
6C20000
|
unkown
|
page read and write
|
|
|
|
A0000
|
unkown image
|
page readonly
|
|
|
|
3E7000
|
heap default
|
page read and write
|
|
|
|
4AC0000
|
unkown image
|
page readonly
|
|
|
|
7CFC000
|
unkown
|
page read and write
|
|
|
|
6B40000
|
unkown
|
page read and write
|
|
|
|
6B50000
|
unkown
|
page read and write
|
|
|
|
7FFFFFD0000
|
unkown image
|
page readonly
|
|
|
|
140000
|
heap private
|
page read and write
|
|
|
|
7C80000
|
unkown
|
page read and write
|
|
|
|
7EFDF000
|
unkown
|
page read and write
|
|
|
|
E0000
|
unkown
|
page read and write
|
|
|
|
33E0000
|
unkown
|
page read and write
|
|
|
|
6D30000
|
unkown image
|
page read and write
|
|
|
|
6AFD000
|
unkown
|
page read and write
|
|
|
|
5A1E000
|
unkown
|
page read and write
|
|
|
|
1CF000
|
stack
|
page read and write
|
|
|
|
9D0000
|
heap private
|
page read and write
|
|
|
|
3363000
|
unkown
|
page read and write
|
|
|
|
6E84C000
|
unkown image
|
page read and write
|
|
|
|
3F72000
|
unkown
|
page read and write
|
|
|
|
31C8000
|
unkown
|
page read and write
|
|
|
|
6C50000
|
unkown
|
page read and write
|
|
|
|
1D80000
|
unkown
|
page read and write
|
|
|
|
7FFFFFB0000
|
unkown image
|
page readonly
|
|
|
|
90000
|
unkown image
|
page readonly
|
|
|
|
7962000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
436E000
|
stack
|
page read and write
|
|
|
|
561B000
|
unkown
|
page read and write
|
|
|
|
2569000
|
heap private
|
page read and write
|
|
|
|
6B2A000
|
unkown
|
page read and write
|
|
|
|
35B9000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
6AF0000
|
unkown
|
page read and write
|
|
|
|
210000
|
unkown
|
page read and write
|
|
|
|
8421000
|
unkown
|
page read and write
|
|
|
|
7FFFFFB0000
|
unkown image
|
page readonly
|
|
|
|
7060000
|
unkown
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
4FA7000
|
unkown
|
page read and write
|
|
|
|
5AE0000
|
unkown
|
page read and write
|
|
|
|
7C09000
|
heap private
|
page read and write
|
|
|
|
10000
|
unkown image
|
page read and write
|
|
|
|
4A8B000
|
stack
|
page read and write
|
|
|
|
7EFC2000
|
unkown image
|
page readonly
|
|
|
|
6B80000
|
unkown
|
page read and write
|
|
|
|
7EFD0000
|
unkown image
|
page readonly
|
|
|
|
204000
|
unkown
|
page read and write
|
|
|
|
3350000
|
unkown
|
page read and write
|
|
|
|
A0000
|
unkown image
|
page readonly
|
|
|
|
4E0000
|
unkown
|
page read and write
|
|
|
|
4B2C000
|
unkown
|
page read and write
|
|
|
|
6B00000
|
unkown
|
page read and write
|
|
|
|
35B5000
|
unkown
|
page read and write
|
|
|
|
7EFC0000
|
unkown image
|
page readonly
|
|
|
|
6B40000
|
unkown
|
page read and write
|
|
|
|
6AE0000
|
unkown
|
page read and write
|
|
|
|
37B000
|
heap default
|
page read and write
|
|
|
|
72F0000
|
unkown
|
page read and write
|
|
|
|
6B40000
|
unkown
|
page read and write
|
|
|
|
3390000
|
unkown
|
page read and write
|
|
There are 611 hidden memdumps, click here to show them.