IOC Report
1.0.0.2.exe

loading gif

Files

File Path
Type
Category
Malicious
1.0.0.2.exe
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
initial sample
 malicious
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe
MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe
PE32 executable (GUI) Intel 80386, for MS Windows
modified
 malicious
C:\Program Files\7-Zip\Uninstall.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\rksowY.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\winmefmb.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Desktop\VF.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\autorun.inf
Microsoft Windows Autorun file
dropped
 malicious
C:\iuepn.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\k1[1].rar
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\062D5100.exe
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\cgsc.exe
data
dropped
C:\Users\user\AppData\Local\Temp\winiomwfx.exe
data
modified
C:\Users\user\AppData\Local\Temp\winuoocay.exe
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
C:\Windows\system.ini
Windows SYSTEM.INI
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\1.0.0.2.exe
"C:\Users\user\Desktop\1.0.0.2.exe"
 malicious
C:\Users\user\AppData\Local\Temp\rksowY.exe
C:\Users\user\AppData\Local\Temp\rksowY.exe
 malicious
C:\Windows\System32\fontdrvhost.exe
"fontdrvhost.exe"
 malicious
C:\Windows\System32\fontdrvhost.exe
"fontdrvhost.exe"
 malicious
C:\Windows\System32\dwm.exe
"dwm.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 1328

URLs

Name
IP
Malicious
http://www.careerdesk.org/images/xs.jpg
unknown
 malicious
http://www.careerdesk.org/images/xs.jpg?5059c3=10531718
54.244.188.177
 malicious
http://althawry.org/images/xs.jpghttp://www.careerdesk.org/images/xs.jpghttp://arthur.niria.biz/xs.j
unknown
 malicious
http://ahmediye.net/xs.jpg?5827cf=5777359
78.46.2.155
 malicious
http://ampyazilim.com.tr/images/xs2.jpg?6cbf0c=21380388
37.230.104.89
 malicious
http://ddos.dnsnb8.net:799/cj//k1.rar
44.221.84.105
 malicious
http://ahmediye.net/xs.jpg?e14213=73812575
78.46.2.155
 malicious
http://ampyazilim.com.tr/images/xs2.jpg?1
37.230.104.89
 malicious
http://arthur.niria.biz/xs.jpg?c12b4b=126595310
44.221.84.105
 malicious
http://apple-pie.in/images/xs.jpg?ce2fff=121614327
44.221.84.105
 malicious
http://apple-pie.in/images/xs.jpg?554c8c=39131092
44.221.84.105
 malicious
http://arthur.niria.biz/xs.jpg?51fbda=48356010
44.221.84.105
 malicious
http://ampyazilim.com.tr/images/xs2.jpg?f4c967=160423430
37.230.104.89
 malicious
http://www.careerdesk.org/images/xs.jpg?ad5654=34079484
54.244.188.177
 malicious
http://www.scintilla.org/scite.rng
unknown
http://amsamex.com/xs.jpg
unknown
http://www.activestate.comHolger
unknown
http://a3inforservice.com.br/images/logof.gif
unknown
http://ddos.dnsnb8.net:799/cj//k1.rars
unknown
http://g2.arrowhitech.com/xs.jpg?6bfcc6=28308248
unknown
http://g2.arrowhitech.com/xs.jpg?f4ae4e=160354060Nh
unknown
http://www.klkjwre9fqwieluoi.info/
unknown
http://g2.arrowhitech.com/xs.jpg?f4ae4e=160354060
unknown
http://g2.arrowhitech.com/xs.jpg?f4ae4e=160354060704hM
unknown
http://ampyazilim.com.tr/images/xs2.jpg?f4c967=160423430M
unknown
http://arthur.niria.biz/xs.jpg
unknown
http://arthur.niria.biz/xs.jpg?51fbda=483560101
unknown
http://amsamex.com/xs.jpg?ce2fff=94588921
unknown
http://accnet.ca/xs.jpg
unknown
http://ahmediye.net/xs.jpg
unknown
http://g2.arrowhitech.com/xs.jpg?f4ae4e=160354060xoP
unknown
http://www.baanboard.comBrendon
unknown
http://althawry.org/images/xs.jpg?4f8fad=26070625
unknown
http://althawry.org/images/xs.jpg?4f8fad=26070625d
unknown
http://kukutrustnet777888.info/DisableTaskMgrSoftware
unknown
https://www.smartsharesystems.com/
unknown
http://www.scintilla.org
unknown
http://althawry.org/images/xs.jpg
unknown
http://ampyazilim.com.tr/images/xs2.jpg?f4c967=160423430x
unknown
http://accnet.ca/xs.jpghttp://a3inforservice.com.br/images/logof.gif
unknown
http://ahmediye.net/xs.jpg?5827cf=5777359V
unknown
http://apple-pie.in/images/xs.jpg
unknown
http://arthur.niria.biz/xs.jpg?51fbda=48356010a
unknown
http://amsamex.com/xs.jpg?ce2fff=945889216
unknown
http://g2.arrowhitech.com/xs.jpg?f4ae4e=160354060-
unknown
http://www.develop.com
unknown
http://althawry.org/images/xs.jpg?4f8fad=260706254
unknown
http://www.youku.com/playlist_show/id_25824322.html
unknown
http://www.spaceblue.com
unknown
http://www.baanboard.com
unknown
http://ampyazilim.com.tr/images/xs2.jpg?f4c967=160423430j
unknown
http://www.develop.comDeepak
unknown
http://ampyazilim.com.tr/images/xs2.jpg?f4c967=160423430ellNoRoam
unknown
http://127.0.0.1/R2_2021/ServerInfo.json
unknown
http://arthur.niria.biz/xs.jpg?c12b4b=126595310T
unknown
http://kukutrustnet987.info/home.gif
unknown
http://ddos.dnsnb8.net:799/cj//k1.rar9
unknown
http://ampyazilim.com.tr/images/xs2.jpg
unknown
http://www.rftp.comJosiah
unknown
http://ddos.dnsnb8.net:799/cj//k1.rar6
unknown
http://www.activestate.com
unknown
http://ddos.dnsnb8.net:799/cj//k1.rar4
unknown
http://173.193.19.14/logo.gif
unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
unknown
http://kukutrustnet888.info/home.gif
unknown
http://althawry.org/images/xs.jpg?a6d450=65599968
unknown
http://upx.sf.net
unknown
http://www.rftp.com
unknown
http://arthur.niria.biz/xs.jpg?c12b4b=126595310C
unknown
http://ddos.dnsnb8.net:799/cj//k1.rarL
unknown
http://g2.arrowhitech.com/xs.jpg?f4ae4e=1603540608oI
unknown
http://kukutrustnet777.info/home.gif
unknown
http://www.spaceblue.comMathias
unknown
https://www.smartsharesystems.com/Morten
unknown
http://89.119.67.154/testo5/http://kukutrustnet777.info/home.gifhttp://kukutrustnet888.info/home.gif
unknown
http://amsamex.com/xs.jpg?549590=27716560
unknown
http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers
unknown
http://ampyazilim.com.tr/images/xs2.jpg?f4c967=160423430ed;0
unknown
http://www.lua.org
unknown
http://ddos.dnsnb8.net/
unknown
http://g2.arrowhitech.com/xs.jpg
unknown
http://ddos.dnsnb8.net:799/cj//k1.rarp
unknown
http://ampyazilim.com.tr/images/xs2.jpg?1.
unknown
http://kukutrustnet777888.info/
unknown
http://pan.baidu.com/s/1qWKD5ve
unknown
http://89.119.67.154/testo5/
unknown
http://g2.arrowhitech.com/xs.jpg?6bfcc6=28308248jh7
unknown
http://ampyazilim.com.tr/images/xs2.jpg?f4c967=160423430ed
unknown
http://ampyazilim.com.tr/images/xs2.jpg?f4c967=160423430edK2
unknown
http://g2.arrowhitech.com/xs.jpg?f4ae4e=160354060&o
unknown
There are 80 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
www.careerdesk.org
54.244.188.177
 malicious
ddos.dnsnb8.net
44.221.84.105
 malicious
ampyazilim.com.tr
37.230.104.89
 malicious
apple-pie.in
44.221.84.105
 malicious
arthur.niria.biz
44.221.84.105
 malicious
ahmediye.net
78.46.2.155
 malicious
amsamex.com
unknown
 malicious
althawry.org
unknown
 malicious
g2.arrowhitech.com
unknown
 malicious

IPs

IP
Domain
Country
Malicious
44.221.84.105
ddos.dnsnb8.net
United States
malicious
78.46.2.155
ahmediye.net
Germany
malicious
54.244.188.177
www.careerdesk.org
United States
malicious
37.230.104.89
ampyazilim.com.tr
Turkey
malicious
85.17.167.196
unknown
Netherlands

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
UacDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA
 malicious
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
DisableNotifications
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
GlobalUserOffline
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx\-1781625383
1768386149
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx\-1781625383
-758194998
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx\-1781625383
1010191151
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx\-1781625383
-1516389996
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx\-1781625383
251996153
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx\-1781625383
2020382302
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx\-1781625383
-506198845
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx
e1_0
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx
e2_0
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx
e3_0
HKEY_CURRENT_USER\SOFTWARE\Akgppfgx
e4_0
There are 182 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2BE0000
direct allocation
page execute and read and write
 malicious
1D156000000
unkown
page readonly
5BB4000
heap
page read and write
7DF492FD0000
unkown
page readonly
4E7E000
stack
page read and write
1D1595AF000
unkown
page read and write
1D154390000
unkown
page readonly
1D15A800000
unkown
page read and write
1D155F2D000
unkown
page read and write
1D159175000
unkown
page read and write
338D000
stack
page read and write
7FF58BCEB000
unkown
page readonly
7602000
heap
page read and write
BD6000
heap
page read and write
1D15A800000
unkown
page read and write
5F55E1B000
stack
page read and write
1D156B6B000
unkown
page read and write
1D155FAB000
unkown
page read and write
1D154380000
unkown
page readonly
1D1590BC000
unkown
page read and write
1D156B80000
unkown
page read and write
1D1590BC000
unkown
page read and write
1D156031000
unkown
page readonly
21B73002000
heap
page read and write
5F5611B000
stack
page read and write
1D158FB0000
unkown
page read and write
28C8D364000
unkown
page read and write
1D156053000
heap
page read and write
7F0000
direct allocation
page read and write
5F556FC000
stack
page read and write
7DF492F80000
unkown
page readonly
75FC000
heap
page read and write
7DF492EF1000
unkown
page execute read
28C8BAD0000
unkown
page readonly
7FF58BE2C000
unkown
page readonly
7DF492F11000
unkown
page execute read
512D000
stack
page read and write
1D15B160000
unkown
page read and write
7FF5097AA000
unkown
page readonly
1D156050000
heap
page read and write
1D158FA5000
unkown
page read and write
1D15A020000
unkown
page readonly
1D15AAA7000
unkown
page read and write
1D1591B0000
unkown
page readonly
400000
unkown
page readonly
1D159FAD000
unkown
page read and write
7FF58BE10000
unkown
page readonly
1D155FE0000
unkown
page read and write
1D15AA3B000
unkown
page read and write
110A000
heap
page read and write
7DF492F40000
unkown
page readonly
1D1590D0000
unkown
page read and write
7DF492FA0000
unkown
page readonly
1D15AFD8000
unkown
page read and write
7FF560DB8000
unkown
page readonly
7FF58BC7B000
unkown
page readonly
7DF492EC0000
unkown
page readonly
3E6E000
stack
page read and write
7DFCDA721000
unkown
page readonly
324E000
stack
page read and write
1D1590A8000
unkown
page read and write
5F55F1E000
stack
page read and write
D28000
unkown
page execute and read and write
7DF492F10000
unkown
page readonly
1D154475000
heap
page read and write
1D158FEF000
unkown
page read and write
28C8D364000
unkown
page read and write
1D159279000
unkown
page read and write
1D158FAC000
unkown
page read and write
1D159595000
unkown
page read and write
1D15959F000
unkown
page read and write
1D159604000
unkown
page read and write
1D156060000
unkown
page read and write
B3E70FE000
unkown
page readonly
1D159CA9000
unkown
page read and write
1D1590AC000
unkown
page read and write
1D15B170000
unkown
page read and write
1D159C00000
unkown
page readonly
28C8D356000
unkown
page read and write
1D159294000
unkown
page read and write
B3E707E000
stack
page read and write
7FF58BC81000
unkown
page readonly
1D1590D7000
unkown
page read and write
DE0000
unkown
page execute and read and write
1D15915A000
unkown
page read and write
115D000
heap
page read and write
1D159553000
unkown
page read and write
1D15A87F000
unkown
page read and write
5D7E000
stack
page read and write
7DF492F00000
unkown
page readonly
1D15934C000
unkown
page read and write
5B0000
unkown
page readonly
1D159098000
unkown
page read and write
7592000
heap
page read and write
7FF58BD8D000
unkown
page readonly
1D1590C2000
unkown
page read and write
1D159436000
unkown
page read and write
1D1590C6000
unkown
page read and write
28C8C5A0000
unkown
page read and write
111D000
heap
page read and write
B50587E000
stack
page read and write
28C8D380000
unkown
page read and write
1D15AFA8000
unkown
page read and write
7DF492FC1000
unkown
page execute read
F27000
heap
page read and write
1D156EE1000
unkown
page readonly
1D15A210000
unkown
page read and write
1D15AC39000
unkown
page read and write
5F55A9B000
stack
page read and write
D31000
unkown
page execute and read and write
7DF492E61000
unkown
page execute read
1D159068000
unkown
page read and write
1D155F6A000
unkown
page read and write
1D15A1C0000
unkown
page read and write
7FF58BC5C000
unkown
page readonly
7FF58BD5C000
unkown
page readonly
7FF58BDE4000
unkown
page readonly
1D159240000
unkown
page read and write
760A000
heap
page read and write
1D15905C000
unkown
page read and write
1D15AAAB000
unkown
page read and write
B3E6D7E000
stack
page read and write
1D154710000
heap
page read and write
760A000
heap
page read and write
7FF58BCDF000
unkown
page readonly
1D159C10000
unkown
page read and write
1D156B6F000
unkown
page read and write
1D155F52000
unkown
page read and write
1D158FDE000
unkown
page read and write
7FF58BC0F000
unkown
page readonly
1D154430000
heap
page read and write
1D15B070000
unkown
page read and write
1D15AA72000
unkown
page read and write
2BDB000
direct allocation
page execute and read and write
31FF000
stack
page read and write
1D1544EF000
heap
page read and write
7FF58BD2D000
unkown
page readonly
F30000
heap
page read and write
99000
stack
page read and write
1D158FEB000
unkown
page read and write
1D15901F000
unkown
page read and write
1D155F31000
unkown
page read and write
EAE000
stack
page read and write
1D15A710000
unkown
page readonly
1D155F16000
unkown
page read and write
1D1595A3000
unkown
page read and write
B3E6DFE000
unkown
page readonly
1D156B69000
unkown
page read and write
1D15913B000
unkown
page read and write
5B80000
heap
page read and write
1D156EE1000
unkown
page readonly
7FF58BDAD000
unkown
page readonly
5B85000
heap
page read and write
7DF492F70000
unkown
page readonly
1D15955E000
unkown
page read and write
7FF58BC81000
unkown
page readonly
BA6000
heap
page read and write
7FF58BC3D000
unkown
page readonly
5F55D9E000
stack
page read and write
28C8D35C000
unkown
page read and write
1D15AAAD000
unkown
page read and write
1D155FA6000
unkown
page read and write
1D15B150000
unkown
page read and write
B6B000
heap
page read and write
1D154715000
heap
page read and write
1D15934C000
unkown
page read and write
28C8BB50000
unkown
page read and write
1D15A80C000
unkown
page read and write
7DF492ED1000
unkown
page execute read
7FF58BC3D000
unkown
page readonly
28C8BBD0000
heap
page read and write
B3E6AFE000
unkown
page readonly
1D15CB98000
unkown
page read and write
7FF58BD5C000
unkown
page readonly
1D159F8D000
unkown
page read and write
B5056FE000
unkown
page readonly
1D158F80000
unkown
page read and write
7FF58BCC6000
unkown
page readonly
1D156AA0000
unkown
page read and write
7FF58BCA3000
unkown
page readonly
7FF58BE1E000
unkown
page readonly
5B6000
unkown
page execute and write copy
7590000
heap
page read and write
7FF58BCC6000
unkown
page readonly
473F000
stack
page read and write
1D159157000
unkown
page read and write
1D159650000
unkown
page read and write
1D159C27000
unkown
page read and write
7DF492FE1000
unkown
page execute read
1D15A080000
unkown
page read and write
1D15A7F8000
unkown
page read and write
1D15A1D0000
unkown
page readonly
1D15AAB1000
unkown
page read and write
EF0000
heap
page read and write
1D15AEE8000
unkown
page read and write
1165000
heap
page read and write
CC3000
unkown
page execute and read and write
B3E000
stack
page read and write
1D1590C0000
unkown
page read and write
1080000
heap
page read and write
BD6000
heap
page read and write
1D1590B0000
unkown
page read and write
7580000
heap
page read and write
7FF58BE50000
unkown
page readonly
7FF58BD9F000
unkown
page readonly
4FEE000
stack
page read and write
761C000
heap
page read and write
1D1546A0000
unkown
page write copy
1D1590B2000
unkown
page read and write
E60000
heap
page read and write
1D15905E000
unkown
page read and write
1D15AE84000
unkown
page read and write
1D1592A2000
unkown
page read and write
7FF58BD0B000
unkown
page readonly
1D1595A7000
unkown
page read and write
1D1590D4000
unkown
page read and write
2B48000
stack
page read and write
7FF56F52C000
unkown
page readonly
7FF56F52C000
unkown
page readonly
1D156B32000
unkown
page read and write
28C8BCC3000
heap
page read and write
7FF58BD67000
unkown
page readonly
1D15AF61000
unkown
page read and write
1D155F16000
unkown
page read and write
7FF58BE0E000
unkown
page readonly
7FF58BCD2000
unkown
page readonly
1D15B150000
unkown
page read and write
B4A000
heap
page read and write
1D155FAB000
unkown
page read and write
7FF58BC1E000
unkown
page readonly
1D159C03000
unkown
page readonly
1D159015000
unkown
page read and write
1D15A161000
unkown
page read and write
5F55F1E000
stack
page read and write
1D158FEF000
unkown
page read and write
28C8BBD0000
heap
page read and write
7DF492E61000
unkown
page execute read
1D1590D2000
unkown
page read and write
1D156B76000
unkown
page read and write
1D15A7F0000
unkown
page read and write
1D1590B2000
unkown
page read and write
B5058FE000
unkown
page readonly
1D155F29000
unkown
page read and write
7DF492FB0000
unkown
page readonly
1D159C8D000
unkown
page read and write
1D155F6E000
unkown
page read and write
1D158FE6000
unkown
page read and write
B50577E000
stack
page read and write
1D15A161000
unkown
page read and write
1D15AA20000
unkown
page read and write
7DF492F70000
unkown
page readonly
1D15B040000
unkown
page read and write
1D1595A3000
unkown
page read and write
1D15A1E0000
unkown
page readonly
7FF58BDF1000
unkown
page readonly
1D15A030000
unkown
page readonly
5DA0000
heap
page read and write
1D1590C2000
unkown
page read and write
1D15A780000
unkown
page readonly
28C8BBDB000
heap
page read and write
7DF492F91000
unkown
page execute read
B50557E000
stack
page read and write
1D15448D000
heap
page read and write
5CBE000
stack
page read and write
1D156B6D000
unkown
page read and write
7DF492E60000
unkown
page readonly
7DF492F81000
unkown
page execute read
1D15A86F000
unkown
page read and write
7DF492F81000
unkown
page execute read
7FF58BD53000
unkown
page readonly
1D154410000
unkown
page read and write
1D15A760000
unkown
page readonly
7DFCDA69F000
unkown
page readonly
7FF58BC5C000
unkown
page readonly
1D159E88000
unkown
page read and write
1D15AEEC000
unkown
page read and write
28C8BDA0000
unkown
page read and write
1D155F7D000
unkown
page read and write
780000
heap
page read and write
1D15AFA5000
unkown
page read and write
7FF58BC1E000
unkown
page readonly
1D1590B8000
unkown
page read and write
1D15A050000
unkown
page readonly
117B000
heap
page read and write
1D155FE0000
unkown
page read and write
7DFCDA698000
unkown
page readonly
1D158FF3000
unkown
page read and write
1D15B220000
unkown
page read and write
1D15909E000
unkown
page read and write
1D159045000
unkown
page read and write
87B000
unkown
page execute and write copy
1D154AB0000
unkown
page readonly
1D15913B000
unkown
page read and write
1D159FA0000
unkown
page read and write
7FF50984E000
unkown
page readonly
B3E6EFE000
unkown
page readonly
5B4000
unkown
page read and write
7DF492FD1000
unkown
page execute read
1D15B180000
unkown
page read and write
1D15959D000
unkown
page read and write
7DF492E60000
unkown
page readonly
2EB0000
heap
page read and write
3D2D000
stack
page read and write
1D159EA8000
unkown
page read and write
7FF58BC88000
unkown
page readonly
7FF58BCEF000
unkown
page readonly
27CF000
stack
page read and write
BA6000
heap
page read and write
5F5631C000
stack
page read and write
1D159529000
unkown
page read and write
34DB000
stack
page read and write
21B72FB9000
heap
page read and write
28C8D347000
unkown
page read and write
21B72E40000
unkown
page readonly
7FF58BC8D000
unkown
page readonly
10C5000
heap
page read and write
1D155FA6000
unkown
page read and write
1D15A0A0000
unkown
page readonly
B6D000
heap
page read and write
1D1590A4000
unkown
page read and write
1D159609000
unkown
page read and write
7FF58BD4F000
unkown
page readonly
1D15B180000
unkown
page read and write
1D15AADE000
unkown
page read and write
1D159640000
unkown
page read and write
1D156B4D000
unkown
page read and write
7FF58BDF1000
unkown
page readonly
1D158FED000
unkown
page read and write
7FF58BC7D000
unkown
page readonly
5990000
heap
page read and write
1D159436000
unkown
page read and write
7FF5783F8000
unkown
page readonly
1D159068000
unkown
page read and write
1D15A710000
unkown
page readonly
1D155EC0000
unkown
page read and write
21B72DE0000
unkown
page readonly
1D159E98000
unkown
page read and write
1D15A060000
unkown
page read and write
B3E6A7D000
stack
page read and write
7FF58BC41000
unkown
page readonly
1D1590D4000
unkown
page read and write
7FF58BDFE000
unkown
page readonly
7DF492FE0000
unkown
page readonly
5F5629F000
stack
page read and write
5F5609E000
stack
page read and write
1D158FC6000
unkown
page read and write
1D1590A4000
unkown
page read and write
EEE000
stack
page read and write
5F55C9B000
stack
page read and write
CB5000
unkown
page execute and read and write
C7A000
stack
page read and write
28C8BB40000
heap
page read and write
1D1590CC000
unkown
page read and write
4ABE000
stack
page read and write
1D156000000
unkown
page readonly
5763000
unclassified section
page read and write
1D1594FA000
unkown
page read and write
78CE000
stack
page read and write
7DF492E70000
unkown
page readonly
1D15955A000
unkown
page read and write
1D159141000
unkown
page read and write
7B0E000
stack
page read and write
1D15B080000
unkown
page read and write
AFC000
stack
page read and write
7DF493000000
unkown
page readonly
E6F000
stack
page read and write
1D159C23000
unkown
page read and write
1D15A7E0000
unkown
page readonly
7DF492EB0000
unkown
page readonly
1D156B0A000
unkown
page read and write
1D15AFD8000
unkown
page read and write
1D15A87B000
unkown
page read and write
7DF492FA0000
unkown
page readonly
1D1593B5000
unkown
page read and write
1D155FD0000
unkown
page readonly
1D15961B000
unkown
page read and write
1D15959F000
unkown
page read and write
28C8D347000
unkown
page read and write
7DF492FB1000
unkown
page execute read
7FF58BC7B000
unkown
page readonly
28C8D36B000
unkown
page read and write
1D15A8AB000
unkown
page read and write
1D15AAA5000
unkown
page read and write
1D159650000
unkown
page read and write
7592000
heap
page read and write
1D15901B000
unkown
page read and write
1D15B090000
unkown
page read and write
D68000
unkown
page execute and write copy
1D15A200000
unkown
page readonly
1D1591A0000
heap
page read and write
1D156B9A000
unkown
page read and write
1D159003000
unkown
page read and write
70A9000
heap
page read and write
B50537E000
unkown
page read and write
1D15A750000
unkown
page readonly
1D15A828000
unkown
page read and write
7FF58BD43000
unkown
page readonly
21B72F30000
unkown
page read and write
2FBF000
stack
page read and write
1D156B4A000
unkown
page read and write
1D158FA5000
unkown
page read and write
1D156B6D000
unkown
page read and write
1D158F60000
unkown
page read and write
7394000
heap
page read and write
1144000
heap
page read and write
5B6000
unkown
page execute and read and write
7FF58BD4F000
unkown
page readonly
1D155EC0000
unkown
page read and write
7DF492EF0000
unkown
page readonly
7DF492EE1000
unkown
page execute read
1D15A84B000
unkown
page read and write
5F55C1E000
stack
page read and write
1D158FB4000
unkown
page read and write
828000
unkown
page execute and read and write
760B000
heap
page read and write
1D15CBD1000
unkown
page read and write
1D1595C9000
unkown
page read and write
753E000
stack
page read and write
1D155F52000
unkown
page read and write
1060000
heap
page read and write
B50577E000
stack
page read and write
1D1590C4000
unkown
page read and write
28C8D371000
unkown
page read and write
B3E6E7E000
stack
page read and write
1D15B150000
unkown
page read and write
1D1590A2000
unkown
page read and write
7602000
heap
page read and write
7FF58BE50000
unkown
page readonly
1D156B4D000
unkown
page read and write
7DF492EB0000
unkown
page readonly
1D159B70000
unkown
page readonly
7DF492F60000
unkown
page readonly
7DF492F21000
unkown
page execute read
7FF58BD1D000
unkown
page readonly
1D15AFA8000
unkown
page read and write
1D158FA1000
unkown
page read and write
7FF5783E2000
unkown
page readonly
7DF492F20000
unkown
page readonly
D80000
heap
page read and write
7DF492E81000
unkown
page execute read
21B72E50000
heap
page read and write
7FF58BCDF000
unkown
page readonly
1D15A832000
unkown
page read and write
7DF492F51000
unkown
page execute read
1D15B160000
unkown
page read and write
21B72DF0000
unkown
page readonly
1D159175000
unkown
page read and write
1D1595C9000
unkown
page read and write
1D1594FA000
unkown
page read and write
7FF58BCEF000
unkown
page readonly
1D15A0D0000
unkown
page readonly
7FF58BC17000
unkown
page readonly
1D156B0A000
unkown
page read and write
7F0000
direct allocation
page read and write
7FF58BD26000
unkown
page readonly
1D159515000
unkown
page read and write
1D158FF3000
unkown
page read and write
5F557FF000
stack
page read and write
1D159E83000
unkown
page read and write
334F000
stack
page read and write
54FE000
stack
page read and write
1D15B163000
unkown
page read and write
1D156B6B000
unkown
page read and write
7625000
heap
page read and write
1D159B70000
unkown
page readonly
1D159439000
unkown
page read and write
7DF492FA1000
unkown
page execute read
21B72E40000
unkown
page readonly
1D1590AE000
unkown
page read and write
1D1590C6000
unkown
page read and write
BAF000
heap
page read and write
1D155ECA000
unkown
page read and write
7396000
heap
page read and write
1D159F9D000
unkown
page read and write
1D154400000
heap
page read and write
1D159F80000
unkown
page read and write
7FF58BBF7000
unkown
page readonly
71C000
stack
page read and write
30BF000
stack
page read and write
7FF58BC22000
unkown
page readonly
10B4000
heap
page read and write
1D154720000
unkown
page readonly
1D1590CA000
unkown
page read and write
4F7F000
stack
page read and write
1D1544BA000
heap
page read and write
7FF5097AA000
unkown
page readonly
1D15B080000
unkown
page read and write
7FF58BDEA000
unkown
page readonly
5010000
heap
page read and write
7DF492EE0000
unkown
page readonly
7FF58BCFC000
unkown
page readonly
BF2000
heap
page read and write
7DAE000
stack
page read and write
28C8D330000
unkown
page read and write
1D15A832000
unkown
page read and write
7DF492F41000
unkown
page execute read
7DF492EB1000
unkown
page execute read
54BD000
stack
page read and write
1D155F29000
unkown
page read and write
7FF58BCF4000
unkown
page readonly
1D159011000
unkown
page read and write
5DB0000
heap
page read and write
1D159402000
unkown
page read and write
7FF58BE03000
unkown
page readonly
57BE000
stack
page read and write
7FF58BCF4000
unkown
page readonly
1D1590BA000
unkown
page read and write
1D159589000
unkown
page read and write
1D1590C8000
unkown
page read and write
1D15909C000
unkown
page read and write
1D1544FF000
heap
page read and write
1108000
heap
page read and write
7FF58BE15000
unkown
page readonly
B5053FE000
unkown
page readonly
1D159E83000
unkown
page read and write
1D155F2D000
unkown
page read and write
7FF578400000
unkown
page readonly
7FF58BD47000
unkown
page readonly
1D15915A000
unkown
page read and write
1D15A790000
unkown
page read and write
D53000
unkown
page execute and read and write
1D154720000
unkown
page readonly
3FEC000
stack
page read and write
7DF492F61000
unkown
page execute read
28C8BB30000
unkown
page readonly
1D159C00000
unkown
page readonly
7FF5783F8000
unkown
page readonly
59F0000
trusted library section
page readonly
1D15A0A0000
unkown
page readonly
1D1591C0000
unkown
page readonly
1D1590D0000
unkown
page read and write
1D1590AC000
unkown
page read and write
5F55C1E000
stack
page read and write
1D159098000
unkown
page read and write
1D15A9EA000
unkown
page read and write
7FF58BC9C000
unkown
page readonly
4F80000
heap
page read and write
1D1590A2000
unkown
page read and write
7FF57847E000
unkown
page readonly
1D159E10000
unkown
page read and write
1D15A020000
unkown
page readonly
1D159011000
unkown
page read and write
1D15B070000
unkown
page read and write
1D1590BA000
unkown
page read and write
1D1590A0000
unkown
page read and write
EF0000
heap
page read and write
21B738B0000
unkown
page read and write
7FF58BD2A000
unkown
page readonly
1D15AC40000
unkown
page read and write
348D000
stack
page read and write
1D15AA50000
unkown
page read and write
1D15A885000
unkown
page read and write
5F55D1C000
stack
page read and write
1D15A9EA000
unkown
page read and write
1D159349000
unkown
page read and write
1D15B1A0000
unkown
page read and write
4BFE000
stack
page read and write
7DF492F31000
unkown
page execute read
1D159F4E000
unkown
page read and write
21B72F30000
unkown
page read and write
7DF492F01000
unkown
page execute read
7FF5097C8000
unkown
page readonly
28C8BB40000
heap
page read and write
1D158FE6000
unkown
page read and write
1D1590AA000
unkown
page read and write
7FF58BD2D000
unkown
page readonly
7FF58BE83000
unkown
page readonly
1D1590CA000
unkown
page read and write
1D156B32000
unkown
page read and write
28C8BAE0000
unkown
page readonly
1D159045000
unkown
page read and write
761C000
heap
page read and write
1D1590B4000
unkown
page read and write
1D1595A9000
unkown
page read and write
7DF492F01000
unkown
page execute read
7FF58BC8D000
unkown
page readonly
770000
heap
page read and write
28CA000
stack
page read and write
1D154601000
unkown
page readonly
7DF492F80000
unkown
page readonly
BE3000
heap
page read and write
1D15A86F000
unkown
page read and write
1D15B190000
unkown
page read and write
7FF58BD47000
unkown
page readonly
5A00000
heap
page read and write
2B60000
direct allocation
page execute and read and write
7FF58BE13000
unkown
page readonly
7FF5783E2000
unkown
page readonly
1D15A87F000
unkown
page read and write
760A000
heap
page read and write
1D159B60000
unkown
page readonly
1D159C2A000
unkown
page read and write
7FF5097D0000
unkown
page readonly
1D15B090000
unkown
page read and write
28C8D36B000
unkown
page read and write
1D154680000
unkown
page readonly
D64000
unkown
page execute and write copy
117A000
heap
page read and write
7FF58BDE4000
unkown
page readonly
1D15A0B0000
unkown
page readonly
28C8D38F000
unkown
page read and write
5F5621B000
stack
page read and write
B3E6FFE000
unkown
page readonly
B3E6F7E000
stack
page read and write
21B72FB9000
heap
page read and write
28C8BAD0000
unkown
page readonly
1D154475000
heap
page read and write
1D158FCA000
unkown
page read and write
526E000
stack
page read and write
2E5E000
stack
page read and write
1D15A0C0000
unkown
page read and write
BBD000
heap
page read and write
EAE000
stack
page read and write
7DF492ED1000
unkown
page execute read
7DF493001000
unkown
page execute read
1D159EAD000
unkown
page read and write
1D159B80000
unkown
page read and write
1D15A080000
unkown
page read and write
1D154465000
heap
page read and write
1D159E98000
unkown
page read and write
5F55C9B000
stack
page read and write
1D154715000
heap
page read and write
1D15B170000
unkown
page read and write
7FF58BE8C000
unkown
page readonly
7FF58BE86000
unkown
page readonly
5F55D9E000
stack
page read and write
21B73057000
heap
page read and write
1D1590AE000
unkown
page read and write
1D155FC0000
unkown
page readonly
7FF58BD43000
unkown
page readonly
1D15904D000
unkown
page read and write
7DF492E80000
unkown
page readonly
1D1546A0000
unkown
page write copy
B50587E000
stack
page read and write
1D1543F0000
unkown
page readonly
1D156B9A000
unkown
page read and write
7DF492FF0000
unkown
page readonly
1D156B4A000
unkown
page read and write
1D15A1F0000
unkown
page readonly
7FF58BCA3000
unkown
page readonly
1D154430000
heap
page read and write
28C8BC77000
heap
page read and write
1D155EC4000
unkown
page read and write
1D1544FF000
heap
page read and write
1D15AFC8000
unkown
page read and write
7DFCDA69F000
unkown
page readonly
1D15902A000
unkown
page read and write
1D15AFEA000
unkown
page read and write
1D159640000
unkown
page read and write
7FF57847E000
unkown
page readonly
BC3000
heap
page read and write
7FF58BD92000
unkown
page readonly
1D15A050000
unkown
page readonly
C90000
heap
page read and write
1D15AAA9000
unkown
page read and write
28C8BB30000
unkown
page readonly
28C8D332000
unkown
page read and write
7FF58BC91000
unkown
page readonly
21B73057000
heap
page read and write
3810000
heap
page read and write
373E000
stack
page read and write
7DF492FE1000
unkown
page execute read
79CE000
unkown
page read and write
7FF58BC17000
unkown
page readonly
21B730B0000
unkown
page read and write
1D1590A0000
unkown
page read and write
1D15CBC9000
unkown
page read and write
1D1543F0000
unkown
page readonly
7DF492FE0000
unkown
page readonly
5B1000
unkown
page execute and write copy
1D15A828000
unkown
page read and write
7DF492FD0000
unkown
page readonly
7FF58BC0F000
unkown
page readonly
1D1593F3000
unkown
page read and write
21B738B0000
unkown
page read and write
7FF578400000
unkown
page readonly
1D159589000
unkown
page read and write
1D1590CE000
unkown
page read and write
363E000
stack
page read and write
7FF58BD35000
unkown
page readonly
B3E6FFE000
unkown
page readonly
1D159599000
unkown
page read and write
1089000
heap
page read and write
7FF58BE86000
unkown
page readonly
1D158F80000
unkown
page read and write
6F9D000
stack
page read and write
B5057FE000
unkown
page readonly
1D15AFC8000
unkown
page read and write
BBD000
heap
page read and write
7DF492F51000
unkown
page execute read
5F5609E000
stack
page read and write
7FF58BCD8000
unkown
page readonly
1D155ED1000
unkown
page read and write
1D155ECA000
unkown
page read and write
1D155F66000
unkown
page read and write
1D15909A000
unkown
page read and write
7FF58BD35000
unkown
page readonly
7FF58BCEB000
unkown
page readonly
1D15A0D0000
unkown
page readonly
536F000
stack
page read and write
7FF58BCB8000
unkown
page readonly
1D15AA20000
unkown
page read and write
1D15A1B0000
unkown
page read and write
1D155F6C000
unkown
page read and write
1D15CBD1000
unkown
page read and write
1D154420000
unkown
page read and write
1D15AA9F000
unkown
page read and write
1D1590B0000
unkown
page read and write
1D15A7E0000
unkown
page readonly
1D15A87B000
unkown
page read and write
5B3000
unkown
page write copy
1D15AAB1000
unkown
page read and write
1D155F6E000
unkown
page read and write
1D15B170000
unkown
page read and write
1D15B040000
unkown
page read and write
7FF58BDD7000
unkown
page readonly
7FF58BD57000
unkown
page readonly
1D155FC0000
unkown
page readonly
7FF560DB8000
unkown
page readonly
58BF000
stack
page read and write
5DBC000
heap
page read and write
21B73069000
heap
page read and write
7FF58BE5C000
unkown
page readonly
1D159595000
unkown
page read and write
1D156B67000
unkown
page read and write
1D159553000
unkown
page read and write
1D15CBC9000
unkown
page read and write
522B000
stack
page read and write
35DD000
stack
page read and write
EF7000
heap
page read and write
1D159604000
unkown
page read and write
2B4E000
stack
page read and write
28C8D35C000
unkown
page read and write
1D15B090000
unkown
page read and write
5F5621B000
stack
page read and write
B50557E000
stack
page read and write
1D15B160000
unkown
page read and write
B3E6AFE000
unkown
page readonly
1D159F90000
unkown
page read and write
C95000
heap
page read and write
1D156B80000
unkown
page read and write
1D159F10000
unkown
page read and write
21B72E50000
heap
page read and write
45FD000
stack
page read and write
1D15A885000
unkown
page read and write
7399000
heap
page read and write
1D15A8D0000
unkown
page read and write
1D159F4E000
unkown
page read and write
1D156050000
heap
page read and write
7DF492EC0000
unkown
page readonly
B5052FE000
unkown
page readonly
7DF492EE1000
unkown
page execute read
1D154690000
unkown
page read and write
7DF492E81000
unkown
page execute read
1D15AF69000
unkown
page read and write
1D159EA6000
unkown
page read and write
7FF58BE0E000
unkown
page readonly
28C8BB50000
unkown
page read and write
7DF492F91000
unkown
page execute read
7FF58BE10000
unkown
page readonly
7FF58BC19000
unkown
page readonly
1D1590C4000
unkown
page read and write
28C8D38F000
unkown
page read and write
5F55D1C000
stack
page read and write
7591000
heap
page read and write
1D15B210000
unkown
page read and write
28C8D33A000
unkown
page read and write
1172000
heap
page read and write
1D15901F000
unkown
page read and write
7DF492EB1000
unkown
page execute read
1D15A1F0000
unkown
page readonly
3C2E000
stack
page read and write
380000
unkown
page execute and read and write
1D154390000
unkown
page readonly
5F55B98000
stack
page read and write
1D154380000
unkown
page readonly
21B72DE0000
unkown
page readonly
7FF58BC26000
unkown
page readonly
7FF58BD53000
unkown
page readonly
F20000
heap
page read and write
7398000
heap
page read and write
1D156B76000
unkown
page read and write
7FF58BD57000
unkown
page readonly
103D000
stack
page read and write
1D15AAA1000
unkown
page read and write
1D1590D7000
unkown
page read and write
5D94000
heap
page read and write
1D15B180000
unkown
page read and write
1D15902A000
unkown
page read and write
1D159E88000
unkown
page read and write
7FF4F2188000
unkown
page readonly
21B72FB0000
heap
page read and write
1D159F4C000
unkown
page read and write
19C000
stack
page read and write
1D1590A6000
unkown
page read and write
1D159240000
unkown
page read and write
1D15909E000
unkown
page read and write
2AC7000
stack
page read and write
28C8C5A0000
unkown
page read and write
412E000
stack
page read and write
108E000
heap
page read and write
28C8BC64000
heap
page read and write
1D159F90000
unkown
page read and write
B5056FE000
unkown
page readonly
7FF58BCBD000
unkown
page readonly
7DF492FC0000
unkown
page readonly
1D156053000
heap
page read and write
1D159E85000
unkown
page read and write
1D15AB53000
unkown
page read and write
1D15909C000
unkown
page read and write
1D1591A0000
heap
page read and write
44BF000
stack
page read and write
1D159B60000
unkown
page readonly
7FF58BC4C000
unkown
page readonly
7FF58BCBD000
unkown
page readonly
1D159015000
unkown
page read and write
7DF492F11000
unkown
page execute read
7391000
heap
page read and write
1D155F76000
unkown
page read and write
28C8BAE0000
unkown
page readonly
1D158FD6000
unkown
page read and write
30FE000
stack
page read and write
1D159EA8000
unkown
page read and write
7FF50984E000
unkown
page readonly
1D15A7F0000
unkown
page read and write
1D159580000
unkown
page read and write
1D159F9D000
unkown
page read and write
7DF492E71000
unkown
page execute read
1D155F31000
unkown
page read and write
1D15CB98000
unkown
page read and write
D68000
unkown
page execute and write copy
1D158FF1000
unkown
page read and write
1D158FC6000
unkown
page read and write
50EF000
stack
page read and write
1D159E8A000
unkown
page read and write
7FF58BC19000
unkown
page readonly
7FF58BC4C000
unkown
page readonly
B3E6A7D000
stack
page read and write
1D15A7A0000
unkown
page read and write
1D15B060000
unclassified section
page read and write
28C8D371000
unkown
page read and write
5F55E1B000
stack
page read and write
7DF492EF1000
unkown
page execute read
1D1592AC000
unkown
page read and write
1D159060000
unkown
page read and write
1D155FB6000
unkown
page read and write
1D15AA05000
unkown
page read and write
B3E707E000
stack
page read and write
7DF492E91000
unkown
page execute read
4340000
trusted library allocation
page read and write
7607000
heap
page read and write
1D15448D000
heap
page read and write
1D158F60000
unkown
page read and write
1D1590AA000
unkown
page read and write
D2F000
unkown
page execute and read and write
1D15A1C0000
unkown
page read and write
1D159E20000
unkown
page readonly
D60000
unkown
page execute and read and write
B5055FE000
unkown
page readonly
7DF492FF1000
unkown
page execute read
55FD000
stack
page read and write
28C8D379000
unkown
page read and write
1D15AAA9000
unkown
page read and write
573B000
stack
page read and write
1D159CA9000
unkown
page read and write
1D154710000
heap
page read and write
7FF58BCE6000
unkown
page readonly
1D1590CE000
unkown
page read and write
21B72FBB000
heap
page read and write
A5C0000
trusted library allocation
page read and write
1D15A82E000
unkown
page read and write
1D1590A6000
unkown
page read and write
7E0000
direct allocation
page read and write
1D1590B6000
unkown
page read and write
D37000
unkown
page execute and read and write
1D15AA9F000
unkown
page read and write
1D15A804000
unkown
page read and write
1D159F8D000
unkown
page read and write
7FF58BDE2000
unkown
page readonly
21B72FB0000
heap
page read and write
7FF58BE13000
unkown
page readonly
7FF58BE5C000
unkown
page readonly
1D15A1B0000
unkown
page read and write
422F000
stack
page read and write
7CE000
stack
page read and write
1D158FB0000
unkown
page read and write
1D154410000
unkown
page read and write
1D156860000
unkown
page readonly
1D155ED3000
unkown
page read and write
7DF493001000
unkown
page execute read
7DF492F21000
unkown
page execute read
B3E6B7E000
unkown
page read and write
1D159E8A000
unkown
page read and write
1D159609000
unkown
page read and write
7DF492E71000
unkown
page execute read
7DF492ED0000
unkown
page readonly
1D15905E000
unkown
page read and write
563E000
stack
page read and write
7FF5783DA000
unkown
page readonly
40EB000
stack
page read and write
D6C000
unkown
page execute and read and write
1D156B57000
unkown
page read and write
28C8D341000
unkown
page read and write
1D15AA6A000
unkown
page read and write
7FF58BCB2000
unkown
page readonly
7DF492FF0000
unkown
page readonly
28C8BC22000
heap
page read and write
7FF58BBF7000
unkown
page readonly
1D1593F3000
unkown
page read and write
7FF58BC22000
unkown
page readonly
7FF58BCE6000
unkown
page readonly
5A1B000
heap
page read and write
1D154AB1000
unkown
page readonly
AD0000
unkown
page execute and read and write
3EAE000
stack
page read and write
1D15A0B0000
unkown
page readonly
D79000
unkown
page execute and write copy
7FF58BD26000
unkown
page readonly
1D15A210000
unkown
page read and write
5F5631C000
stack
page read and write
5A10000
heap
page read and write
7FF5097C8000
unkown
page readonly
1D15961B000
unkown
page read and write
1D158FCA000
unkown
page read and write
7FF58BE83000
unkown
page readonly
1D15CB80000
unkown
page read and write
1D15952D000
unkown
page read and write
1D15955A000
unkown
page read and write
1D15A060000
unkown
page read and write
1D15A760000
unkown
page readonly
EEE000
stack
page read and write
1D154690000
unkown
page read and write
7FF58BD1D000
unkown
page readonly
1D158FEB000
unkown
page read and write
21B73002000
heap
page read and write
7FF5783DA000
unkown
page readonly
1D15A804000
unkown
page read and write
1D15AA72000
unkown
page read and write
4E3F000
stack
page read and write
B5057FE000
unkown
page readonly
7DF492FD1000
unkown
page execute read
463E000
stack
page read and write
1D1592AC000
unkown
page read and write
28C8BC22000
heap
page read and write
7DF492FF1000
unkown
page execute read
7FF58BD8D000
unkown
page readonly
1040000
unclassified section
page read and write
B50527C000
stack
page read and write
1D155EC4000
unkown
page read and write
1D15A8AB000
unkown
page read and write
1D159E85000
unkown
page read and write
7DF492F71000
unkown
page execute read
1D158FFA000
unkown
page read and write
1D1591D0000
unkown
page readonly
7FF58BC7D000
unkown
page readonly
1D15A0C0000
unkown
page read and write
1D159F70000
unkown
page readonly
75F3000
heap
page read and write
7FF58BE03000
unkown
page readonly
1D15B150000
unkown
page read and write
58D0000
heap
page read and write
1D15B160000
unkown
page read and write
1D159294000
unkown
page read and write
7DF492F20000
unkown
page readonly
7FF58BDEA000
unkown
page readonly
28C8BC8F000
heap
page read and write
7FF58BD0B000
unkown
page readonly
1D154601000
unkown
page readonly
1D15B170000
unkown
page read and write
1D155F76000
unkown
page read and write
127F000
stack
page read and write
1D15A1D0000
unkown
page readonly
28C8D356000
unkown
page read and write
DE0000
unkown
page execute and read and write
CC1000
unkown
page execute and read and write
1D156B63000
unkown
page read and write
7FF4F2188000
unkown
page readonly
3D6E000
stack
page read and write
1D15A1E0000
unkown
page readonly
F35000
heap
page read and write
1D15A7F8000
unkown
page read and write
1D1595A9000
unkown
page read and write
1D15B163000
unkown
page read and write
AD0000
unkown
page execute and read and write
7DF492F61000
unkown
page execute read
1D154680000
unkown
page readonly
7DF492EC1000
unkown
page execute read
B3E6E7E000
stack
page read and write
400000
unkown
page readonly
1D159BB0000
unkown
page read and write
1D159362000
unkown
page read and write
1D156B63000
unkown
page read and write
2BD8000
direct allocation
page execute and read and write
7DFCDA698000
unkown
page readonly
28C8D380000
unkown
page read and write
7FF58BDAD000
unkown
page readonly
401000
unkown
page execute and read and write
1D15AEE8000
unkown
page read and write
1D15A780000
unkown
page readonly
2EB4000
heap
page read and write
1D159F70000
unkown
page readonly
2E9E000
stack
page read and write
1D15AB53000
unkown
page read and write
1D15CB80000
unkown
page read and write
5A14000
heap
page read and write
1D15AA50000
unkown
page read and write
28C8BC64000
heap
page read and write
1D159E20000
unkown
page readonly
7DF492E70000
unkown
page readonly
1D15A82E000
unkown
page read and write
1D159529000
unkown
page read and write
1D15A80C000
unkown
page read and write
1D1590B8000
unkown
page read and write
7DF493000000
unkown
page readonly
B5052FE000
unkown
page readonly
1D156031000
unkown
page readonly
59EC000
stack
page read and write
1D154400000
heap
page read and write
7E0000
direct allocation
page read and write
7FF58BDFE000
unkown
page readonly
1D159123000
unkown
page read and write
7FF58BCFC000
unkown
page readonly
7DF492EC1000
unkown
page execute read
1D15A030000
unkown
page readonly
10E7000
heap
page read and write
5B1000
unkown
page execute read
1D1595A7000
unkown
page read and write
2B44000
stack
page read and write
1D159FA0000
unkown
page read and write
1D15A090000
unkown
page readonly
28C8D379000
unkown
page read and write
7DF492F60000
unkown
page readonly
1D155F66000
unkown
page read and write
1D15B153000
unkown
page read and write
1D156AA0000
unkown
page read and write
1D15B160000
unkown
page read and write
1D15B240000
unkown
page read and write
1D15AAA1000
unkown
page read and write
28C8D34F000
unkown
page read and write
7ACE000
stack
page read and write
1D156860000
unkown
page readonly
1D159FAD000
unkown
page read and write
7FF58BC9C000
unkown
page readonly
7FF58BE5F000
unkown
page readonly
D69000
unkown
page execute and read and write
7FF58BE5F000
unkown
page readonly
1119000
heap
page read and write
7DF492F10000
unkown
page readonly
1D15A84B000
unkown
page read and write
1D159439000
unkown
page read and write
1D158FAC000
unkown
page read and write
7DF492E90000
unkown
page readonly
1D1591B0000
unkown
page readonly
1D159C03000
unkown
page readonly
1D159362000
unkown
page read and write
5F55E9F000
stack
page read and write
7593000
heap
page read and write
1D156B08000
unkown
page read and write
1D158FF1000
unkown
page read and write
7FF58BC88000
unkown
page readonly
1D15B190000
unkown
page read and write
1D1590D2000
unkown
page read and write
1D159402000
unkown
page read and write
1D15A090000
unkown
page readonly
28C8D34F000
unkown
page read and write
2BD5000
direct allocation
page execute and read and write
2BE9000
direct allocation
page execute and read and write
4D3E000
stack
page read and write
1D155F6A000
unkown
page read and write
7DF492F71000
unkown
page execute read
1D155FD0000
unkown
page readonly
5F55A9B000
stack
page read and write
7FF5097D0000
unkown
page readonly
1D158FED000
unkown
page read and write
7FF5097B2000
unkown
page readonly
1D155F6C000
unkown
page read and write
29CF000
stack
page read and write
5F5577E000
stack
page read and write
1D159B80000
unkown
page read and write
1D15901B000
unkown
page read and write
1D158FFA000
unkown
page read and write
7FF58BCD2000
unkown
page readonly
1D1590B6000
unkown
page read and write
1043000
unclassified section
page read and write
7FF58BCB2000
unkown
page readonly
1D15959D000
unkown
page read and write
B3E6BFE000
unkown
page readonly
760A000
heap
page read and write
7DF492ED0000
unkown
page readonly
7FF58BD9F000
unkown
page readonly
7DF492E90000
unkown
page readonly
44FE000
stack
page read and write
1D156B69000
unkown
page read and write
1D15AA05000
unkown
page read and write
5F5611B000
stack
page read and write
1D155FB6000
unkown
page read and write
21B72DF0000
unkown
page readonly
1D159BA0000
unkown
page readonly
28C8BDA0000
unkown
page read and write
1D15AAA7000
unkown
page read and write
1D15905C000
unkown
page read and write
1D159BB0000
unkown
page read and write
7FF58BD2A000
unkown
page readonly
7FF58BE08000
unkown
page readonly
7FF58BCD8000
unkown
page readonly
1D159599000
unkown
page read and write
1D159060000
unkown
page read and write
5B70000
heap
page read and write
1D158FD6000
unkown
page read and write
1D15A200000
unkown
page readonly
B3E6DFE000
unkown
page readonly
1D15AC40000
unkown
page read and write
7FF58BC91000
unkown
page readonly
1D15A790000
unkown
page read and write
1D159C27000
unkown
page read and write
1D155F7D000
unkown
page read and write
1D15952D000
unkown
page read and write
1D156B57000
unkown
page read and write
1D1590C0000
unkown
page read and write
1D156060000
unkown
page read and write
7DF492F50000
unkown
page readonly
7625000
heap
page read and write
1D159BA0000
unkown
page readonly
1D1595CD000
unkown
page read and write
1D15AE84000
unkown
page read and write
1D159C23000
unkown
page read and write
7DF492F30000
unkown
page readonly
1D15B150000
unkown
page read and write
1D15AA6A000
unkown
page read and write
5BB0000
heap
page read and write
1D15B230000
unkown
page read and write
7DF492FC1000
unkown
page execute read
B50567E000
stack
page read and write
1D159C10000
unkown
page read and write
7FF58BE2C000
unkown
page readonly
1D15B160000
unkown
page read and write
3BF0000
trusted library allocation
page read and write
B3E70FE000
unkown
page readonly
5F5577D000
stack
page read and write
B4E000
heap
page read and write
5760000
unclassified section
page read and write
1D1544EF000
heap
page read and write
B50527C000
stack
page read and write
4BBD000
stack
page read and write
1D15A8CF000
unkown
page read and write
BAF000
heap
page read and write
1D1595AF000
unkown
page read and write
7DF492F41000
unkown
page execute read
7FF58BE08000
unkown
page readonly
7FF58BD67000
unkown
page readonly
1D15B163000
unkown
page read and write
28C8BBDB000
heap
page read and write
1D159EAB000
unkown
page read and write
2A5D000
stack
page read and write
1D159C8D000
unkown
page read and write
28C8BBD9000
heap
page read and write
1D1590A8000
unkown
page read and write
5F55E9F000
stack
page read and write
7DF492EA0000
unkown
page readonly
1D1593B5000
unkown
page read and write
1D1590BE000
unkown
page read and write
7DF492F31000
unkown
page execute read
1D15B230000
unkown
page read and write
21B73069000
heap
page read and write
380000
unkown
page execute and read and write
1D159EA6000
unkown
page read and write
1D156B6F000
unkown
page read and write
1D155ED1000
unkown
page read and write
761C000
heap
page read and write
5B3000
unkown
page readonly
1D159F10000
unkown
page read and write
1D159F80000
unkown
page read and write
7DF492EA1000
unkown
page execute read
1D158FA1000
unkown
page read and write
28C8BC8F000
heap
page read and write
B5055FE000
unkown
page readonly
B40000
heap
page read and write
1D15AF69000
unkown
page read and write
1D1590CC000
unkown
page read and write
1D159123000
unkown
page read and write
21B72FBB000
heap
page read and write
7DF492EF0000
unkown
page readonly
1D1592A2000
unkown
page read and write
7FF5097B2000
unkown
page readonly
21B730B0000
unkown
page read and write
7DF492F40000
unkown
page readonly
1D155ED3000
unkown
page read and write
1D1591D0000
unkown
page readonly
B3E6F7E000
stack
page read and write
5F55B98000
stack
page read and write
7DF492F30000
unkown
page readonly
1D15B060000
unclassified section
page read and write
1D159003000
unkown
page read and write
10C5000
heap
page read and write
5F556FC000
stack
page read and write
3FAD000
stack
page read and write
5D90000
heap
page read and write
1D158FB4000
unkown
page read and write
1D15B230000
unkown
page read and write
1D1590BE000
unkown
page read and write
7FF58BC41000
unkown
page readonly
1D156B08000
unkown
page read and write
7592000
heap
page read and write
1D15909A000
unkown
page read and write
1D156B5B000
unkown
page read and write
4240000
heap
page read and write
1D1591C0000
unkown
page readonly
28C8D341000
unkown
page read and write
1D15AFA5000
unkown
page read and write
7DF492FB1000
unkown
page execute read
6FA0000
heap
page read and write
2B5F000
stack
page read and write
1D15AFEA000
unkown
page read and write
1D159157000
unkown
page read and write
1D15904D000
unkown
page read and write
1D15A750000
unkown
page readonly
1D154420000
unkown
page read and write
1D1590C8000
unkown
page read and write
7392000
heap
page read and write
1D15AAA5000
unkown
page read and write
B5058FE000
unkown
page readonly
1D159580000
unkown
page read and write
7DF492EA1000
unkown
page execute read
1D15AAAB000
unkown
page read and write
7F0000
direct allocation
page read and write
CCF000
unkown
page execute and read and write
7FF58BE8C000
unkown
page readonly
CDC000
unkown
page execute and read and write
7FF58BD06000
unkown
page readonly
B3E6D7E000
stack
page read and write
1D1595CD000
unkown
page read and write
7602000
heap
page read and write
1D159349000
unkown
page read and write
1108000
heap
page read and write
7391000
heap
page read and write
1D154465000
heap
page read and write
1D159515000
unkown
page read and write
7FF58BDD7000
unkown
page readonly
7DF492FC0000
unkown
page readonly
5F5629F000
stack
page read and write
1D159C2A000
unkown
page read and write
28C8D33A000
unkown
page read and write
1D15B070000
unkown
page read and write
1D159EAD000
unkown
page read and write
1D15A730000
unkown
page readonly
7F0000
direct allocation
page read and write
C69000
unkown
page execute and read and write
1D15B070000
unkown
page read and write
28C8D330000
unkown
page read and write
1D156B67000
unkown
page read and write
28C8BC76000
heap
page read and write
1D158FDE000
unkown
page read and write
1D159EAB000
unkown
page read and write
43BE000
stack
page read and write
53BE000
stack
page read and write
7FF58BD92000
unkown
page readonly
7DF492FA1000
unkown
page execute read
7FF58BE15000
unkown
page readonly
1D15AAAD000
unkown
page read and write
7DF492FB0000
unkown
page readonly
1D1590B4000
unkown
page read and write
7DF492F50000
unkown
page readonly
1D15A010000
unkown
page readonly
7FF58BDE2000
unkown
page readonly
7DF492E80000
unkown
page readonly
1D15B170000
unkown
page read and write
B3E6EFE000
unkown
page readonly
1D159141000
unkown
page read and write
1D15A010000
unkown
page readonly
7FF58BCB8000
unkown
page readonly
28C8BBD9000
heap
page read and write
1D15AADE000
unkown
page read and write
1D15AED7000
unkown
page read and write
1D15A7A0000
unkown
page read and write
1D159279000
unkown
page read and write
1D15AF61000
unkown
page read and write
7DF492EE0000
unkown
page readonly
1D15AA3B000
unkown
page read and write
28C8BCC3000
heap
page read and write
1D156B5B000
unkown
page read and write
1D15B153000
unkown
page read and write
7DF492EA0000
unkown
page readonly
7DF492F00000
unkown
page readonly
4CFF000
stack
page read and write
7DFCDA721000
unkown
page readonly
1D159F4C000
unkown
page read and write
1D159E10000
unkown
page read and write
7DF492E91000
unkown
page execute read
7FF58BE1E000
unkown
page readonly
7FF58BC26000
unkown
page readonly
7FF58BD06000
unkown
page readonly
28C8D332000
unkown
page read and write
7390000
heap
page read and write
1D15A730000
unkown
page readonly
1D1544BA000
heap
page read and write
BDF000
heap
page read and write
5B0000
unkown
page readonly
3BF0000
trusted library allocation
page read and write
B50567E000
stack
page read and write
There are 1289 hidden memdumps, click here to show them.