IOC Report
HaPJ2rPP6w.exe

loading gif

Files

File Path
Type
Category
Malicious
HaPJ2rPP6w.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Temp\89ED.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\C12E.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Roaming\bbdeaec
PE32 executable (GUI) Intel 80386, for MS Windows
modified
malicious
C:\Users\user\AppData\Roaming\wideaec
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Roaming\wideaec:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
JSON data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\HaPJ2rPP6w.exe
"C:\Users\user\Desktop\HaPJ2rPP6w.exe"
malicious
C:\Windows\explorer.exe
C:\Windows\Explorer.EXE
malicious
C:\Users\user\AppData\Roaming\wideaec
C:\Users\user\AppData\Roaming\wideaec
malicious
C:\Users\user\AppData\Local\Temp\C12E.exe
C:\Users\user\AppData\Local\Temp\C12E.exe
malicious
C:\Users\user\AppData\Local\Temp\89ED.exe
C:\Users\user\AppData\Local\Temp\89ED.exe
malicious
C:\Users\user\AppData\Local\Temp\89ED.exe
"C:\Users\user\AppData\Local\Temp\89ED.exe" -sfxelevation
malicious
C:\Users\user\AppData\Roaming\bbdeaec
C:\Users\user\AppData\Roaming\bbdeaec
malicious
C:\Users\user\AppData\Roaming\bbdeaec
C:\Users\user\AppData\Roaming\bbdeaec
malicious
C:\Users\user\AppData\Roaming\wideaec
C:\Users\user\AppData\Roaming\wideaec
malicious

URLs

Name
IP
Malicious
https://23.145.40.164/ksa9104.exe
23.145.40.164
malicious
http://unicea.ws/tmp/index.php
malicious
http://nwgrus.ru/tmp/index.php
malicious
https://codeberg.org/alexcode11/templates/raw/branch/main/setup.exe
217.197.91.145
malicious
http://tech-servers.in.net/tmp/index.php
malicious
https://aka.ms/odirmr
unknown
http://schemas.mi
unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
unknown
https://powerpoint.office.comcember
unknown
https://api.msn.com:443/v1/news/Feed/Windows?
unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
unknown
https://excel.office.com
unknown
http://schemas.micro
unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
unknown
https://api.msn.com/q
unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
unknown
http://sourceforge.net/projects/s-zipsfxbuilder/)
unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
unknown
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
unknown
http://www.autoitscript.com/autoit3/J
unknown
https://wns.windows.com/L
unknown
https://word.office.com
unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
unknown
http://schemas.micr
unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
unknown
https://aka.ms/Vh5j3k
unknown
http://brightdata.com
unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
unknown
https://api.msn.com/v1/news/Feed/Windows?&
unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
unknown
https://www.rd.com/list/polite-habits-campers-dislike/
unknown
https://android.notify.windows.com/iOS
unknown
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
unknown
https://api.msn.com/
unknown
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
unknown
https://outlook.com_
unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
unknown
https://www.msn.com:443/en-us/feed
unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
unknown
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
unknown
There are 47 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
codeberg.org
217.197.91.145
malicious
nwgrus.ru
177.129.90.106
malicious
calvinandhalls.com
unknown
malicious
bestworldhools.com
unknown
malicious

IPs

IP
Domain
Country
Malicious
180.75.11.133
unknown
Malaysia
malicious
177.129.90.106
nwgrus.ru
Brazil
malicious
23.145.40.164
unknown
Reserved
malicious
217.197.91.145
codeberg.org
Germany
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000D0068
VirtualDesktop
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB
@explorerframe.dll,-13137
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB
@explorerframe.dll,-13138
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithProgids
Unpacker
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Classes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
~reserved~
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
IconLayouts
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.102
CheckSetting
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
TaskbarStateLastRun
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021492-0000-0000-C000-000000000046}\Enum
Implementing
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithProgids
WMP11.AssocFile.3G2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithProgids
WMP11.AssocFile.3GP
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\OpenWithProgids
WMP11.AssocFile.ADTS
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithProgids
WMP11.AssocFile.AIFF
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithProgids
WMP11.AssocFile.ASF
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithProgids
WMP11.AssocFile.ASX
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithProgids
WMP11.AssocFile.AU
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au3\OpenWithProgids
AutoIt3Script
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithProgids
WMP11.AssocFile.AVI
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids
Paint.Picture
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab\OpenWithProgids
CABFolder
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cdxml\OpenWithProgids
Microsoft.PowerShellCmdletDefinitionXML.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.css\OpenWithProgids
CSSfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.csv\OpenWithProgids
Excel.CSV
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dds\OpenWithProgids
ddsfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithProgids
Paint.Picture
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dll\OpenWithProgids
dllfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithProgids
Word.Document.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docm\OpenWithProgids
Word.DocumentMacroEnabled.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx\OpenWithProgids
Word.Document.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dot\OpenWithProgids
Word.Template.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dotm\OpenWithProgids
Word.TemplateMacroEnabled.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dotx\OpenWithProgids
Word.Template.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\OpenWithProgids
emffile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids
exefile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\OpenWithProgids
WMP11.AssocFile.FLAC
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fon\OpenWithProgids
fonfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithProgids
giffile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithProgids
htmlfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids
htmlfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithProgids
icofile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inf\OpenWithProgids
inffile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini\OpenWithProgids
inifile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithProgids
pjpegfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithProgids
jpegfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithProgids
jpegfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithProgids
jpegfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jxr\OpenWithProgids
wdpfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\OpenWithProgids
lnkfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithProgids
WMP11.AssocFile.MPEG
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2t\OpenWithProgids
WMP11.AssocFile.M2TS
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithProgids
WMP11.AssocFile.m3u
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithProgids
WMP11.AssocFile.M4A
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithProgids
WMP11.AssocFile.MP4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithProgids
mhtmlfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithProgids
mhtmlfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithProgids
WMP11.AssocFile.MIDI
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mk3d\OpenWithProgids
WMP11.AssocFile.MK3D
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mka\OpenWithProgids
WMP11.AssocFile.MKA
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mkv\OpenWithProgids
WMP11.AssocFile.MKV
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithProgids
WMP11.AssocFile.MOV
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MP2\OpenWithProgids
WMP11.AssocFile.MP3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithProgids
WMP11.AssocFile.MP3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithProgids
WMP11.AssocFile.MP4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MPE\OpenWithProgids
WMP11.AssocFile.MPEG
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msg\OpenWithProgids
Outlook.File.msg.15
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ocx\OpenWithProgids
ocxfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.odp\OpenWithProgids
PowerPoint.OpenDocumentPresentation.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ods\OpenWithProgids
Excel.OpenDocumentSpreadsheet.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.odt\OpenWithProgids
Word.OpenDocumentText.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.otf\OpenWithProgids
otffile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithProgids
pngfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pot\OpenWithProgids
PowerPoint.Template.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.potm\OpenWithProgids
PowerPoint.TemplateMacroEnabled.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.potx\OpenWithProgids
PowerPoint.Template.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppam\OpenWithProgids
PowerPoint.Addin.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppsm\OpenWithProgids
PowerPoint.SlideShowMacroEnabled.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppsx\OpenWithProgids
PowerPoint.SlideShow.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppt\OpenWithProgids
PowerPoint.Show.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pptm\OpenWithProgids
PowerPoint.ShowMacroEnabled.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pptx\OpenWithProgids
PowerPoint.Show.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1\OpenWithProgids
Microsoft.PowerShellScript.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1xml\OpenWithProgids
Microsoft.PowerShellXMLData.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd1\OpenWithProgids
Microsoft.PowerShellData.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psm1\OpenWithProgids
Microsoft.PowerShellModule.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pssc\OpenWithProgids
Microsoft.PowerShellSessionConfiguration.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\OpenWithProgids
rlefile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithProgids
WMP11.AssocFile.MIDI
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rtf\OpenWithProgids
Word.RTF.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.scf\OpenWithProgids
SHCmdFile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.search-ms\OpenWithProgids
SearchFolder
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithProgids
shtmlfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sldm\OpenWithProgids
PowerPoint.SlideMacroEnabled.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sldx\OpenWithProgids
PowerPoint.Slide.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithProgids
WMP11.AssocFile.AU
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sys\OpenWithProgids
sysfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithProgids
TIFImage.Document
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithProgids
TIFImage.Document
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithProgids
WMP11.AssocFile.TTS
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\OpenWithProgids
ttcfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\OpenWithProgids
ttffile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithProgids
WMP11.AssocFile.TTS
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids
txtfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vsto\OpenWithProgids
bootstrap.vsto.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithProgids
WMP11.AssocFile.WAV
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\OpenWithProgids
WMP11.AssocFile.WAX
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithProgids
wdpfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithProgids
WMP11.AssocFile.ASF
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithProgids
WMP11.AssocFile.WMA
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\OpenWithProgids
wmffile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithProgids
WMP11.AssocFile.WMV
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\OpenWithProgids
WMP11.AssocFile.ASX
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WPL\OpenWithProgids
WMP11.AssocFile.WPL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithProgids
WMP11.AssocFile.WVX
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xlam\OpenWithProgids
Excel.AddInMacroEnabled
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xls\OpenWithProgids
Excel.Sheet.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xlsb\OpenWithProgids
Excel.SheetBinaryMacroEnabled.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xlsm\OpenWithProgids
Excel.SheetMacroEnabled.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xlsx\OpenWithProgids
Excel.Sheet.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xlt\OpenWithProgids
Excel.Template.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xltm\OpenWithProgids
Excel.TemplateMacroEnabled
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xltx\OpenWithProgids
Excel.Template
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithProgids
xmlfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xsl\OpenWithProgids
xslfile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
TaskbarStateLastRun
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021492-0000-0000-C000-000000000046}\Enum
Implementing
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
TaskbarStateLastRun
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021492-0000-0000-C000-000000000046}\Enum
Implementing
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
LastUpdate
There are 213 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
6E1000
unclassified section
page read and write
malicious
5C0000
direct allocation
page read and write
malicious
2170000
direct allocation
page read and write
malicious
2191000
unclassified section
page read and write
malicious
6C0000
direct allocation
page read and write
malicious
631000
unclassified section
page read and write
malicious
2170000
direct allocation
page read and write
malicious
5C0000
direct allocation
page read and write
malicious
6D0000
direct allocation
page read and write
malicious
2091000
unclassified section
page read and write
malicious
1490000
unkown
page read and write
8780000
unkown
page read and write
3150000
unkown
page read and write
9C80000
unkown
page read and write
223F000
stack
page read and write
FB16000
unkown
page read and write
41B000
unkown
page write copy
7FF5EDA0D000
unkown
page readonly
A4FC000
unkown
page read and write
AAD1000
unkown
page read and write
140000000
unkown
page readonly
9340000
unkown
page read and write
4C9A000
unkown
page read and write
8780000
unkown
page read and write
7857000
unkown
page read and write
140027000
unkown
page write copy
10D0000
heap
page read and write
7FF5ED409000
unkown
page readonly
9C80000
unkown
page read and write
8760000
unkown
page read and write
7F50000
unkown
page read and write
7FF5ED821000
unkown
page readonly
3580000
unkown
page readonly
9ADE000
stack
page read and write
8760000
unkown
page read and write
7E70000
unkown
page read and write
87B0000
unkown
page read and write
9795000
unkown
page read and write
87B0000
unkown
page read and write
630000
direct allocation
page execute and read and write
58E000
stack
page read and write
9C60000
unkown
page read and write
7884000
unkown
page read and write
3150000
unkown
page read and write
8760000
unkown
page read and write
7869000
unkown
page read and write
3150000
unkown
page read and write
9C80000
unkown
page read and write
9380000
unkown
page read and write
B8C0000
unkown
page readonly
97AD000
unkown
page read and write
B140000
unkown
page readonly
7DF4F3071000
unkown
page execute read
8780000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED3DA000
unkown
page readonly
6BC000
heap
page read and write
9340000
unkown
page read and write
C6C1000
unkown
page read and write
9C80000
unkown
page read and write
A491000
unkown
page read and write
3700000
unkown
page read and write
9340000
unkown
page read and write
1350000
unkown
page read and write
BD1D000
stack
page read and write
8760000
unkown
page read and write
9340000
unkown
page read and write
A37B000
unkown
page read and write
9885000
unkown
page read and write
9929000
unkown
page read and write
7FF5ED750000
unkown
page readonly
418000
unkown
page readonly
8760000
unkown
page read and write
1350000
unkown
page read and write
2160000
direct allocation
page execute and read and write
9340000
unkown
page read and write
987D000
unkown
page read and write
87B0000
unkown
page read and write
9340000
unkown
page read and write
7F50000
unkown
page read and write
24E1000
heap
page read and write
7953000
unkown
page read and write
7DF4F3050000
unkown
page readonly
95F000
stack
page read and write
10000000
unkown
page read and write
10042000
unkown
page read and write
9C00000
unkown
page read and write
37F2000
unkown
page read and write
710000
heap
page read and write
C846000
unkown
page read and write
4B78000
unkown
page read and write
7DF4F3061000
unkown
page execute read
B8B0000
unkown
page read and write
8D90000
unkown
page read and write
3150000
unkown
page read and write
8760000
unkown
page read and write
8780000
unkown
page read and write
8760000
unkown
page read and write
3170000
unkown
page read and write
5D6000
heap
page read and write
9F9E000
stack
page read and write
6FA000
heap
page read and write
9340000
unkown
page read and write
77B000
heap
page read and write
7E70000
unkown
page read and write
8780000
unkown
page read and write
516000
unkown
page readonly
3150000
unkown
page read and write
7F50000
unkown
page read and write
1F0000
heap
page read and write
7FF5ED818000
unkown
page readonly
7FF5EDA14000
unkown
page readonly
8C51000
unkown
page read and write
9340000
unkown
page read and write
8770000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED800000
unkown
page readonly
7FF5ED4BB000
unkown
page readonly
610000
heap
page read and write
9C80000
unkown
page read and write
C563000
unkown
page read and write
8780000
unkown
page read and write
9C00000
unkown
page read and write
9340000
unkown
page read and write
7FF5ED956000
unkown
page readonly
8760000
unkown
page read and write
C5E4000
unkown
page read and write
9C80000
unkown
page read and write
140027000
unkown
page write copy
8760000
unkown
page read and write
8780000
unkown
page read and write
9C00000
unkown
page read and write
1350000
unkown
page read and write
37F6000
unkown
page read and write
7FF5ED695000
unkown
page readonly
89E0000
unkown
page read and write
3170000
unkown
page read and write
9C80000
unkown
page read and write
8760000
unkown
page read and write
869000
heap
page read and write
9C000
stack
page read and write
7E70000
unkown
page read and write
9340000
unkown
page read and write
9C80000
unkown
page read and write
7FF5ED46E000
unkown
page readonly
B170000
unkown
page readonly
7FF5ED5A8000
unkown
page readonly
7FF5D1CD4000
unkown
page readonly
9C60000
unkown
page read and write
3150000
unkown
page read and write
37BD000
unkown
page read and write
3170000
unkown
page read and write
7FF5ED7D6000
unkown
page readonly
84E000
heap
page execute and read and write
C5AA000
unkown
page read and write
8780000
unkown
page read and write
7E11000
unkown
page read and write
7FF5ED516000
unkown
page readonly
3150000
unkown
page read and write
7FF5ED735000
unkown
page readonly
401000
unkown
page execute read
8210000
unkown
page read and write
9C00000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED59E000
unkown
page readonly
7F50000
unkown
page read and write
8760000
unkown
page read and write
97B5000
unkown
page read and write
B10D000
stack
page read and write
7FF5ED4C6000
unkown
page readonly
3170000
unkown
page read and write
3150000
unkown
page read and write
8D90000
unkown
page read and write
7FF5ED76D000
unkown
page readonly
140021000
unkown
page readonly
8CF000
stack
page read and write
1500000
heap
page read and write
41A000
unkown
page read and write
88EE000
stack
page read and write
9CE0000
unkown
page read and write
CA42000
unkown
page read and write
9070000
unkown
page read and write
8780000
unkown
page read and write
87A0000
unkown
page read and write
41A000
unkown
page read and write
7F50000
unkown
page read and write
8770000
unkown
page read and write
3170000
unkown
page read and write
8EF000
stack
page read and write
9C00000
unkown
page read and write
5CB000
heap
page read and write
9C80000
unkown
page read and write
5D6000
heap
page read and write
7FF5ED71B000
unkown
page readonly
7FF5ED4DF000
unkown
page readonly
7FF5ED77E000
unkown
page readonly
8760000
unkown
page read and write
11C0000
unkown
page readonly
3439000
stack
page read and write
7FF5ED5C9000
unkown
page readonly
7FF5ED337000
unkown
page readonly
87B0000
unkown
page read and write
7FF5ED91A000
unkown
page readonly
7FF5ED9A1000
unkown
page readonly
79FB000
unkown
page read and write
8780000
unkown
page read and write
8770000
unkown
page read and write
3150000
unkown
page read and write
7E70000
unkown
page read and write
8760000
unkown
page read and write
6C0000
direct allocation
page read and write
3150000
unkown
page read and write
9C80000
unkown
page read and write
9798000
unkown
page read and write
140001000
unkown
page execute read
C512000
unkown
page read and write
9340000
unkown
page read and write
89C0000
unkown
page read and write
79B000
heap
page read and write
9C80000
unkown
page read and write
1510000
unkown
page readonly
87B0000
unkown
page read and write
9A10000
unkown
page read and write
9CE0000
unkown
page read and write
140027000
unkown
page write copy
8D90000
unkown
page read and write
9877000
unkown
page read and write
3150000
unkown
page read and write
3150000
unkown
page read and write
78AD000
unkown
page read and write
8780000
unkown
page read and write
9C80000
unkown
page read and write
8D90000
unkown
page read and write
987B000
unkown
page read and write
418000
unkown
page readonly
8D90000
unkown
page read and write
8780000
unkown
page read and write
14B0000
unkown
page readonly
AB5F000
unkown
page read and write
3150000
unkown
page read and write
97C3000
unkown
page read and write
C503000
unkown
page read and write
7FF5ED1D6000
unkown
page readonly
8780000
unkown
page read and write
9C80000
unkown
page read and write
7F50000
unkown
page read and write
9C00000
unkown
page read and write
7FF5ED68F000
unkown
page readonly
35D0000
unkown
page read and write
9340000
unkown
page read and write
87A0000
unkown
page read and write
7FF5EDA47000
unkown
page readonly
8780000
unkown
page read and write
9C80000
unkown
page read and write
3150000
unkown
page read and write
87B0000
unkown
page read and write
9C00000
unkown
page read and write
8FB9000
stack
page read and write
9070000
unkown
page read and write
8760000
unkown
page read and write
8A6E000
stack
page read and write
516000
unkown
page readonly
3150000
unkown
page read and write
7FF5ED9FF000
unkown
page readonly
5D0000
unclassified section
page read and write
7861000
unkown
page read and write
3170000
unkown
page read and write
7FF5ED5EB000
unkown
page readonly
7E70000
unkown
page read and write
9C80000
unkown
page read and write
9340000
unkown
page read and write
986F000
unkown
page read and write
93F000
stack
page read and write
8D90000
unkown
page read and write
8D90000
unkown
page read and write
3150000
unkown
page read and write
9C80000
unkown
page read and write
7A34000
unkown
page read and write
C88B000
unkown
page read and write
A3BE000
unkown
page read and write
9C00000
unkown
page read and write
A379000
unkown
page read and write
40B000
unkown
page execute read
7F50000
unkown
page read and write
3150000
unkown
page read and write
9C000
stack
page read and write
8760000
unkown
page read and write
7FF5ED669000
unkown
page readonly
7FF5ED418000
unkown
page readonly
7FF5ED3A7000
unkown
page readonly
19D000
stack
page read and write
A21E000
stack
page read and write
68E000
stack
page read and write
8D90000
unkown
page read and write
9C80000
unkown
page read and write
62E000
stack
page read and write
9D64000
unkown
page read and write
9CD0000
heap
page read and write
91C0000
unkown
page read and write
9883000
unkown
page read and write
9C80000
unkown
page read and write
91C0000
stack
page read and write
7D00000
unkown
page readonly
8780000
unkown
page read and write
1483000
heap
page read and write
1F0000
heap
page read and write
7FF5EDA31000
unkown
page readonly
5D8000
heap
page read and write
8B70000
unkown
page read and write
7FF5D1CCD000
unkown
page readonly
40B000
unkown
page execute read
9340000
unkown
page read and write
7F50000
unkown
page read and write
987F000
unkown
page read and write
87B0000
unkown
page read and write
9C00000
unkown
page read and write
1350000
unkown
page read and write
8780000
unkown
page read and write
3150000
unkown
page read and write
CA20000
unkown
page read and write
9C80000
unkown
page read and write
9C80000
unkown
page read and write
C89C000
unkown
page read and write
8760000
unkown
page read and write
A361000
unkown
page read and write
1350000
unkown
page read and write
9370000
unkown
page read and write
7FF5ED915000
unkown
page readonly
4BE1000
unkown
page read and write
7F50000
unkown
page read and write
9340000
unkown
page read and write
87B0000
unkown
page read and write
1340000
unkown
page read and write
140021000
unkown
page readonly
7F50000
unkown
page read and write
A39B000
unkown
page read and write
9340000
unkown
page read and write
8780000
unkown
page read and write
9380000
unkown
page read and write
9C80000
unkown
page read and write
AADB000
unkown
page read and write
1350000
unkown
page read and write
9869000
unkown
page read and write
8780000
unkown
page read and write
8770000
unkown
page read and write
8D90000
unkown
page read and write
AF0C000
stack
page read and write
9C80000
unkown
page read and write
8760000
unkown
page read and write
8760000
unkown
page read and write
4C34000
unkown
page read and write
14002B000
unkown
page readonly
7FF5ED980000
unkown
page readonly
9C80000
unkown
page read and write
7E70000
unkown
page read and write
19D000
stack
page read and write
8780000
unkown
page read and write
CA7C000
unkown
page read and write
8770000
unkown
page read and write
66E000
stack
page read and write
9C000
stack
page read and write
8780000
unkown
page read and write
943F000
stack
page read and write
7F30000
unkown
page read and write
7FF5ED6A5000
unkown
page readonly
1350000
unkown
page read and write
9F1E000
stack
page read and write
9C80000
unkown
page read and write
9340000
unkown
page read and write
87B0000
unkown
page read and write
8780000
unkown
page read and write
9340000
unkown
page read and write
1350000
unkown
page read and write
87B0000
unkown
page read and write
9340000
unkown
page read and write
9881000
unkown
page read and write
9380000
unkown
page read and write
147000
stack
page read and write
818E000
stack
page read and write
9C80000
unkown
page read and write
4CD0000
unkown
page read and write
8760000
unkown
page read and write
8760000
unkown
page read and write
9340000
unkown
page read and write
8760000
unkown
page read and write
3250000
unkown
page read and write
87B0000
unkown
page read and write
8760000
unkown
page read and write
C54A000
unkown
page read and write
C84D000
unkown
page read and write
2160000
heap
page read and write
41B000
unkown
page write copy
7E70000
unkown
page read and write
8780000
unkown
page read and write
5B9000
heap
page read and write
1350000
unkown
page read and write
4BC9000
unkown
page read and write
8780000
unkown
page read and write
CB21000
unkown
page read and write
140027000
unkown
page read and write
AAF9000
unkown
page read and write
9C40000
unkown
page read and write
401000
unkown
page execute read
7E70000
unkown
page read and write
7FF5ED5C5000
unkown
page readonly
7FF5ED295000
unkown
page readonly
9E6C000
stack
page read and write
417000
unkown
page readonly
C6BF000
unkown
page read and write
540000
heap
page read and write
FFFA000
heap
page read and write
3150000
unkown
page read and write
923E000
stack
page read and write
8F5000
heap
page read and write
9C80000
unkown
page read and write
417000
unkown
page readonly
9340000
unkown
page read and write
9C80000
unkown
page read and write
260E000
stack
page read and write
8770000
unkown
page read and write
8780000
unkown
page read and write
C700000
unkown
page read and write
9C00000
unkown
page read and write
516000
unkown
page readonly
8770000
unkown
page read and write
C893000
unkown
page read and write
22E1000
heap
page read and write
401000
unkown
page execute read
418000
unkown
page readonly
8770000
unkown
page read and write
9815000
unkown
page read and write
7FF5ED43A000
unkown
page readonly
9C80000
unkown
page read and write
9CE0000
unkown
page read and write
9340000
unkown
page read and write
9070000
unkown
page read and write
7E70000
unkown
page read and write
9380000
unkown
page read and write
9340000
unkown
page read and write
140000000
unkown
page readonly
3791000
unkown
page read and write
A433000
unkown
page read and write
8780000
unkown
page read and write
9C00000
unkown
page read and write
7FF5ED9B8000
unkown
page readonly
7FF5ED286000
unkown
page readonly
FB1B000
unkown
page read and write
C7C5000
unkown
page read and write
3150000
unkown
page read and write
5A0000
direct allocation
page execute and read and write
A32A000
unkown
page read and write
7E70000
unkown
page read and write
400000
unkown
page execute and read and write
8760000
unkown
page read and write
3150000
unkown
page read and write
2130000
heap
page read and write
982D000
unkown
page read and write
9C40000
unkown
page read and write
9C000
stack
page read and write
8760000
unkown
page read and write
580000
heap
page read and write
97A9000
unkown
page read and write
7FF5ED4E8000
unkown
page readonly
7FF5ED52F000
unkown
page readonly
690000
heap
page read and write
8D90000
unkown
page read and write
8760000
unkown
page read and write
896B000
stack
page read and write
7E70000
unkown
page read and write
9C80000
unkown
page read and write
640000
heap
page read and write
7CA0000
unkown
page read and write
A01B000
stack
page read and write
9340000
unkown
page read and write
787C000
unkown
page read and write
3170000
unkown
page read and write
AF8D000
stack
page read and write
308A000
stack
page read and write
614000
heap
page read and write
2521000
heap
page read and write
8760000
unkown
page read and write
FFF2000
heap
page read and write
9C00000
unkown
page read and write
1350000
unkown
page read and write
BD98000
stack
page read and write
7FF5ED4B0000
unkown
page readonly
3150000
unkown
page read and write
8770000
unkown
page read and write
93BE000
stack
page read and write
7FF5ED5C1000
unkown
page readonly
516000
unkown
page readonly
8D90000
unkown
page read and write
41A000
unkown
page read and write
180000
heap
page read and write
6E0000
unclassified section
page read and write
7FF5ED9C6000
unkown
page readonly
9340000
unkown
page read and write
41B000
unkown
page read and write
8770000
unkown
page read and write
8770000
unkown
page read and write
3150000
unkown
page read and write
8770000
unkown
page read and write
A502000
unkown
page read and write
7FF5ED62F000
unkown
page readonly
4B8B000
unkown
page read and write
418000
unkown
page readonly
400000
unkown
page execute and read and write
7FF5ED451000
unkown
page readonly
9C80000
unkown
page read and write
9C60000
unkown
page read and write
400000
unkown
page execute and read and write
A323000
unkown
page read and write
226F000
stack
page read and write
7D20000
unkown
page readonly
7FF5ED864000
unkown
page readonly
418000
unkown
page readonly
418000
unkown
page readonly
8770000
unkown
page read and write
9893000
unkown
page read and write
9340000
unkown
page read and write
8760000
unkown
page read and write
9340000
unkown
page read and write
8780000
unkown
page read and write
7FF5ED853000
unkown
page readonly
6B0000
direct allocation
page execute and read and write
9340000
unkown
page read and write
8108000
stack
page read and write
7F50000
unkown
page read and write
9340000
unkown
page read and write
9380000
unkown
page read and write
9C00000
unkown
page read and write
8D90000
unkown
page read and write
9340000
unkown
page read and write
20AE000
stack
page read and write
10031000
unkown
page read and write
A4B8000
unkown
page read and write
FB54000
unkown
page read and write
270E000
stack
page read and write
3250000
unkown
page read and write
9070000
unkown
page read and write
B8AB000
stack
page read and write
3150000
unkown
page read and write
7E70000
unkown
page read and write
7E70000
unkown
page read and write
9380000
unkown
page read and write
1003D000
unkown
page read and write
4C1E000
unkown
page read and write
A49E000
unkown
page read and write
7F2E000
stack
page read and write
6D0000
direct allocation
page read and write
526000
heap
page read and write
3800000
unkown
page readonly
7FF5ED625000
unkown
page readonly
400000
unkown
page readonly
9C00000
unkown
page read and write
8770000
unkown
page read and write
7FF5ED996000
unkown
page readonly
9340000
unkown
page read and write
5C0000
heap
page read and write
8760000
unkown
page read and write
3170000
unkown
page read and write
3797000
unkown
page read and write
9C00000
unkown
page read and write
AB5C000
unkown
page read and write
9070000
unkown
page read and write
7900000
unkown
page read and write
A37D000
unkown
page read and write
7FF5ED8E7000
unkown
page readonly
8760000
unkown
page read and write
7E70000
unkown
page read and write
7FF5ED81B000
unkown
page readonly
3150000
unkown
page read and write
1380000
unkown
page read and write
6D0000
unclassified section
page read and write
620000
heap
page read and write
7FF5ED55F000
unkown
page readonly
8760000
unkown
page read and write
8780000
unkown
page read and write
9C80000
unkown
page read and write
9C80000
unkown
page read and write
6F0000
heap
page read and write
3120000
unkown
page readonly
9DED000
stack
page read and write
8760000
unkown
page read and write
9340000
unkown
page read and write
7CE0000
unkown
page read and write
3170000
unkown
page read and write
7FF5ED86B000
unkown
page readonly
7FF5ED7FD000
unkown
page readonly
8BEE000
stack
page read and write
8780000
unkown
page read and write
B82A000
stack
page read and write
7FF5ED810000
unkown
page readonly
7DF4F3040000
unkown
page readonly
714000
heap
page read and write
7E50000
unkown
page readonly
7E70000
unkown
page read and write
3150000
unkown
page read and write
3150000
unkown
page read and write
8760000
unkown
page read and write
19D000
stack
page read and write
5E0000
heap
page read and write
C08A000
stack
page read and write
9C00000
unkown
page read and write
644000
heap
page read and write
9340000
unkown
page read and write
9C80000
unkown
page read and write
7FF5ED71E000
unkown
page readonly
C962000
unkown
page read and write
8780000
unkown
page read and write
37B0000
unkown
page read and write
FA94000
unkown
page read and write
610000
heap
page read and write
7F50000
unkown
page read and write
7FF5ED9F2000
unkown
page readonly
7FF5ED7CF000
unkown
page readonly
417000
unkown
page readonly
7E70000
unkown
page read and write
9C80000
unkown
page read and write
9070000
unkown
page read and write
5DC000
heap
page read and write
C4D0000
unkown
page read and write
A50B000
unkown
page read and write
B190000
unkown
page read and write
8EC6000
unkown
page read and write
3150000
unkown
page read and write
4C18000
unkown
page read and write
140000000
unkown
page readonly
22E0000
heap
page read and write
36D3000
stack
page read and write
8780000
unkown
page read and write
41A000
unkown
page write copy
4B90000
unkown
page read and write
3170000
unkown
page read and write
4C4B000
unkown
page read and write
7FF5ED39B000
unkown
page readonly
A29E000
stack
page read and write
87B0000
unkown
page read and write
7FF5ED3EA000
unkown
page readonly
8780000
unkown
page read and write
A19F000
stack
page read and write
7FF5ED85F000
unkown
page readonly
9340000
unkown
page read and write
7FF5ED3D6000
unkown
page readonly
78D000
heap
page execute and read and write
8000000
unkown
page read and write
1350000
unkown
page read and write
A2F000
stack
page read and write
9340000
unkown
page read and write
14002B000
unkown
page readonly
8770000
unkown
page read and write
2190000
heap
page read and write
9340000
unkown
page read and write
7FF5ED65C000
unkown
page readonly
9C00000
unkown
page read and write
7FF5EDA53000
unkown
page readonly
36F0000
unkown
page readonly
7FF5ED534000
unkown
page readonly
3150000
unkown
page read and write
1210000
unkown
page readonly
8760000
unkown
page read and write
9C80000
unkown
page read and write
8770000
unkown
page read and write
978E000
unkown
page read and write
9C80000
unkown
page read and write
5E4000
heap
page read and write
87B0000
unkown
page read and write
C57F000
unkown
page read and write
517000
unkown
page readonly
3758000
unkown
page read and write
21C0000
heap
page read and write
8770000
unkown
page read and write
9879000
unkown
page read and write
87B0000
unkown
page read and write
3250000
unkown
page read and write
83E000
heap
page read and write
7E70000
unkown
page read and write
8780000
unkown
page read and write
B629000
stack
page read and write
140001000
unkown
page execute read
8770000
unkown
page read and write
9340000
unkown
page read and write
22E0000
heap
page read and write
9B60000
unkown
page readonly
5F8000
heap
page read and write
3748000
unkown
page read and write
517000
unkown
page readonly
7FF5ED449000
unkown
page readonly
8760000
unkown
page read and write
9340000
unkown
page read and write
7FF5ED5F7000
unkown
page readonly
9C80000
unkown
page read and write
784A000
unkown
page read and write
7FF5ED87D000
unkown
page readonly
81E000
stack
page read and write
8760000
unkown
page read and write
770000
heap
page read and write
4BA6000
unkown
page read and write
CBA5000
unkown
page read and write
8770000
unkown
page read and write
7FF5ED3D0000
unkown
page readonly
8760000
unkown
page read and write
7FF5ED1CF000
unkown
page readonly
991D000
unkown
page read and write
7F50000
unkown
page read and write
1340000
unkown
page read and write
8780000
unkown
page read and write
8760000
unkown
page read and write
41B000
unkown
page read and write
7FF5ED803000
unkown
page readonly
785D000
unkown
page read and write
8760000
unkown
page read and write
7E70000
unkown
page read and write
520000
heap
page read and write
3319000
stack
page read and write
87B0000
unkown
page read and write
C41F000
stack
page read and write
7FF5ED342000
unkown
page readonly
7F50000
unkown
page read and write
600000
heap
page read and write
670000
heap
page read and write
7FF5ED68C000
unkown
page readonly
977A000
unkown
page read and write
C4A0000
unkown
page read and write
9C80000
unkown
page read and write
3150000
unkown
page read and write
3170000
unkown
page read and write
A11F000
stack
page read and write
8770000
unkown
page read and write
41B000
unkown
page read and write
9C80000
unkown
page read and write
3150000
unkown
page read and write
4B93000
unkown
page read and write
89A0000
unkown
page read and write
785B000
unkown
page read and write
7F50000
unkown
page read and write
8780000
unkown
page read and write
517000
unkown
page readonly
9340000
unkown
page read and write
7FF5ED80C000
unkown
page readonly
9C80000
unkown
page read and write
DE0000
unkown
page readonly
8780000
unkown
page read and write
608000
heap
page read and write
3170000
unkown
page read and write
3150000
unkown
page read and write
22D0000
heap
page read and write
9C80000
unkown
page read and write
87B0000
unkown
page read and write
986B000
unkown
page read and write
7FF5ED8C1000
unkown
page readonly
7FF5ED6B9000
unkown
page readonly
8D6C000
stack
page read and write
9C80000
unkown
page read and write
C51E000
unkown
page read and write
71B000
heap
page read and write
1350000
unkown
page read and write
8780000
unkown
page read and write
7FF5ED986000
unkown
page readonly
37A0000
unkown
page read and write
7FF5ED7DB000
unkown
page readonly
7FF5ED4C2000
unkown
page readonly
FB94000
unkown
page read and write
3170000
unkown
page read and write
9340000
unkown
page read and write
7FF5EDA76000
unkown
page readonly
7FF5ED2A4000
unkown
page readonly
9C80000
unkown
page read and write
3170000
unkown
page read and write
B640000
unkown
page read and write
7F50000
unkown
page read and write
9C00000
unkown
page read and write
8780000
unkown
page read and write
7847000
unkown
page read and write
3010000
unkown
page read and write
190000
heap
page read and write
9CE0000
unkown
page read and write
9C80000
unkown
page read and write
87B0000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED7E0000
unkown
page readonly
8760000
unkown
page read and write
7FF5ED97E000
unkown
page readonly
280F000
stack
page read and write
4B56000
unkown
page read and write
B5AE000
stack
page read and write
7E70000
unkown
page read and write
3150000
unkown
page read and write
C857000
unkown
page read and write
7FF5ECED2000
unkown
page readonly
A4A1000
unkown
page read and write
5C1000
heap
page read and write
503000
heap
page read and write
7FF5ED9E1000
unkown
page readonly
9340000
unkown
page read and write
9C80000
unkown
page read and write
7FF5ED867000
unkown
page readonly
CAE4000
unkown
page read and write
3150000
unkown
page read and write
7FF5ED9D9000
unkown
page readonly
8780000
unkown
page read and write
7FF5ED9AE000
unkown
page readonly
9C00000
unkown
page read and write
71D000
stack
page read and write
7E70000
unkown
page read and write
7E70000
unkown
page read and write
9873000
unkown
page read and write
7852000
unkown
page read and write
6BB000
heap
page read and write
7FF5ED8AC000
unkown
page readonly
9C80000
unkown
page read and write
69E000
heap
page read and write
8760000
unkown
page read and write
9C00000
unkown
page read and write
78A0000
unkown
page read and write
8760000
unkown
page read and write
9340000
unkown
page read and write
7FF5ED9C8000
unkown
page readonly
7E70000
unkown
page read and write
4C8A000
unkown
page read and write
3150000
unkown
page read and write
1350000
unkown
page read and write
3150000
unkown
page read and write
7FF5ED847000
unkown
page readonly
9C80000
unkown
page read and write
516000
unkown
page readonly
310E000
stack
page read and write
AB4D000
unkown
page read and write
8760000
unkown
page read and write
3150000
unkown
page read and write
3150000
unkown
page read and write
9C80000
unkown
page read and write
1220000
unkown
page readonly
7E70000
unkown
page read and write
7FF5ED814000
unkown
page readonly
3170000
unkown
page read and write
3150000
unkown
page read and write
9380000
unkown
page read and write
7FF5ED265000
unkown
page readonly
8770000
unkown
page read and write
8760000
unkown
page read and write
6AD000
heap
page execute and read and write
8780000
unkown
page read and write
7E70000
unkown
page read and write
8760000
unkown
page read and write
8D90000
unkown
page read and write
14002B000
unkown
page readonly
2C0C000
stack
page read and write
9370000
unkown
page read and write
8760000
unkown
page read and write
91C0000
unkown
page read and write
7FF5ED64F000
unkown
page readonly
9C80000
unkown
page read and write
9C00000
unkown
page read and write
8760000
unkown
page read and write
87B0000
unkown
page read and write
9340000
unkown
page read and write
8760000
unkown
page read and write
417000
unkown
page readonly
7FF5ED505000
unkown
page readonly
87B0000
unkown
page read and write
8780000
unkown
page read and write
563000
heap
page read and write
5590000
unkown
page write copy
7977000
unkown
page read and write
9C80000
unkown
page read and write
7F50000
unkown
page read and write
9C00000
unkown
page read and write
8760000
unkown
page read and write
8770000
unkown
page read and write
87BB000
stack
page read and write
883E000
stack
page read and write
5641000
unkown
page read and write
33B9000
stack
page read and write
8760000
unkown
page read and write
8780000
unkown
page read and write
9340000
unkown
page read and write
9C00000
unkown
page read and write
87B0000
unkown
page read and write
2370000
heap
page read and write
FAD3000
unkown
page read and write
3170000
unkown
page read and write
9C00000
unkown
page read and write
7FF5ED3CE000
unkown
page readonly
8780000
unkown
page read and write
3738000
unkown
page read and write
CB19000
unkown
page read and write
8710000
unkown
page readonly
7FF5ED692000
unkown
page readonly
8760000
unkown
page read and write
37AC000
unkown
page read and write
79B1000
unkown
page read and write
7FF5ED8E2000
unkown
page readonly
1350000
unkown
page read and write
8780000
unkown
page read and write
1360000
unkown
page read and write
3150000
unkown
page read and write
10C0000
unkown
page readonly
7FF5ED8A4000
unkown
page readonly
590000
heap
page read and write
229F000
stack
page read and write
9340000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED885000
unkown
page readonly
76F000
stack
page read and write
C50A000
unkown
page read and write
8790000
unkown
page read and write
7FF5ED1CB000
unkown
page readonly
7FF5ED793000
unkown
page readonly
7FFE000
stack
page read and write
8760000
unkown
page read and write
9C00000
unkown
page read and write
3209000
stack
page read and write
3170000
unkown
page read and write
9340000
unkown
page read and write
7FF5ED4A1000
unkown
page readonly
1230000
unkown
page read and write
3150000
unkown
page read and write
1440000
unkown
page read and write
9A5B000
unkown
page read and write
401000
unkown
page execute read
3150000
unkown
page read and write
5CB000
heap
page read and write
9C80000
unkown
page read and write
7FF5ED92C000
unkown
page readonly
C964000
unkown
page read and write
8D90000
unkown
page read and write
9340000
unkown
page read and write
1F0000
heap
page read and write
7695000
stack
page read and write
7CC0000
unkown
page readonly
9C00000
unkown
page read and write
AA90000
unkown
page read and write
9340000
unkown
page read and write
5F8000
heap
page read and write
7FF5ED644000
unkown
page readonly
9C00000
unkown
page read and write
9340000
unkown
page read and write
9CE0000
unkown
page read and write
8770000
unkown
page read and write
8760000
unkown
page read and write
3150000
unkown
page read and write
9C80000
unkown
page read and write
8760000
unkown
page read and write
1350000
unkown
page read and write
7FF5EDA08000
unkown
page readonly
87B0000
unkown
page read and write
7E70000
unkown
page read and write
60E000
stack
page read and write
87B0000
unkown
page read and write
8760000
unkown
page read and write
8770000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED4FD000
unkown
page readonly
41A000
unkown
page write copy
9340000
unkown
page read and write
8760000
unkown
page read and write
8B60000
unkown
page readonly
4BE3000
unkown
page read and write
7FF5ED975000
unkown
page readonly
9340000
unkown
page read and write
7FF5ED426000
unkown
page readonly
7FF5ED586000
unkown
page readonly
9C00000
unkown
page read and write
9340000
unkown
page read and write
9C80000
unkown
page read and write
7E70000
unkown
page read and write
2150000
heap
page read and write
8770000
unkown
page read and write
7FF5ED41C000
unkown
page readonly
4CE0000
unkown
page read and write
41A000
unkown
page write copy
9C80000
unkown
page read and write
3150000
unkown
page read and write
9C80000
unkown
page read and write
3150000
unkown
page read and write
9C80000
unkown
page read and write
3170000
unkown
page read and write
9340000
unkown
page read and write
7FF5ED40D000
unkown
page readonly
8EFC000
unkown
page read and write
7FF5ED1BC000
unkown
page readonly
9CE0000
unkown
page read and write
8780000
unkown
page read and write
7FF5EDA2A000
unkown
page readonly
5C4000
heap
page read and write
8D90000
unkown
page read and write
9C00000
unkown
page read and write
7867000
unkown
page read and write
87B0000
unkown
page read and write
9CE0000
unkown
page read and write
7FF5ED279000
unkown
page readonly
9C80000
unkown
page read and write
979C000
unkown
page read and write
400000
unkown
page execute and read and write
8208000
stack
page read and write
8780000
unkown
page read and write
3170000
unkown
page read and write
9C80000
unkown
page read and write
1350000
unkown
page read and write
37A8000
unkown
page read and write
A4AE000
unkown
page read and write
7FF5ED7E9000
unkown
page readonly
7E70000
unkown
page read and write
290E000
stack
page read and write
9875000
unkown
page read and write
9792000
unkown
page read and write
7FF5ED9D2000
unkown
page readonly
8780000
unkown
page read and write
7FF5ED9D6000
unkown
page readonly
7FF5ED937000
unkown
page readonly
8770000
unkown
page read and write
7FF5ED46A000
unkown
page readonly
5557000
stack
page read and write
9C80000
unkown
page read and write
B150000
unkown
page read and write
57E000
stack
page read and write
785F000
unkown
page read and write
7863000
unkown
page read and write
8760000
unkown
page read and write
9C80000
unkown
page read and write
3150000
unkown
page read and write
AAF2000
unkown
page read and write
A494000
unkown
page read and write
7FF5EDA69000
unkown
page readonly
7FF5ED850000
unkown
page readonly
7E70000
unkown
page read and write
7FF5ED849000
unkown
page readonly
9660000
unkown
page read and write
7FF5ED755000
unkown
page readonly
7FF5ED74A000
unkown
page readonly
9C80000
unkown
page read and write
9C00000
unkown
page read and write
7FF5ED4F3000
unkown
page readonly
7FF5ED939000
unkown
page readonly
8AE000
stack
page read and write
6FE000
heap
page read and write
143B000
stack
page read and write
3150000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED94A000
unkown
page readonly
7FF5ED961000
unkown
page readonly
3150000
unkown
page read and write
9C80000
unkown
page read and write
14002B000
unkown
page readonly
7F50000
unkown
page read and write
1F0000
heap
page read and write
9CE0000
unkown
page read and write
7FF5ED602000
unkown
page readonly
22D0000
heap
page read and write
4B50000
unkown
page read and write
8760000
unkown
page read and write
3150000
unkown
page read and write
8B70000
unkown
page read and write
C516000
unkown
page read and write
9340000
unkown
page read and write
2A0F000
stack
page read and write
7FF5ED9CC000
unkown
page readonly
9340000
unkown
page read and write
2460000
heap
page read and write
1380000
stack
page read and write
2241000
heap
page read and write
3756000
unkown
page read and write
4BDC000
unkown
page read and write
8780000
unkown
page read and write
9C00000
unkown
page read and write
1F0000
heap
page read and write
2520000
heap
page read and write
87B0000
unkown
page read and write
2510000
heap
page read and write
34E9000
stack
page read and write
1350000
unkown
page read and write
7FF5ED412000
unkown
page readonly
786B000
unkown
page read and write
9C80000
unkown
page read and write
91C0000
unkown
page read and write
7FF5ED42B000
unkown
page readonly
8720000
unkown
page readonly
8780000
unkown
page read and write
8780000
unkown
page read and write
8760000
unkown
page read and write
DD0000
unkown
page readonly
7E70000
unkown
page read and write
9340000
unkown
page read and write
7FF5ED33F000
unkown
page readonly
BDA0000
unkown
page readonly
9C00000
unkown
page read and write
5DA000
heap
page read and write
5D0000
heap
page read and write
7FF5ED404000
unkown
page readonly
8760000
unkown
page read and write
19D000
stack
page read and write
9C000
stack
page read and write
1005E000
unkown
page read and write
9340000
unkown
page read and write
9C00000
unkown
page read and write
3659000
stack
page read and write
7E60000
unkown
page read and write
1451000
unkown
page readonly
C92D000
unkown
page read and write
8780000
unkown
page read and write
B728000
stack
page read and write
7FF5ED714000
unkown
page readonly
3240000
unkown
page read and write
7FF5EDA70000
unkown
page readonly
379E000
unkown
page read and write
96DF000
unkown
page read and write
7E70000
unkown
page read and write
C6CF000
unkown
page read and write
9C60000
unkown
page read and write
7865000
unkown
page read and write
9C80000
unkown
page read and write
C507000
unkown
page read and write
7FF5ED8C6000
unkown
page readonly
4C50000
unkown
page read and write
3170000
unkown
page read and write
7FF5ED990000
unkown
page readonly
797D000
unkown
page read and write
A4AB000
unkown
page read and write
2240000
heap
page read and write
97D4000
unkown
page read and write
8780000
unkown
page read and write
9340000
unkown
page read and write
400000
unkown
page readonly
8780000
unkown
page read and write
3150000
unkown
page read and write
1095000
stack
page read and write
C6F2000
unkown
page read and write
C49E000
stack
page read and write
7FF5ED77C000
unkown
page readonly
3170000
unkown
page read and write
9340000
unkown
page read and write
9C60000
unkown
page read and write
24E0000
heap
page read and write
8D90000
unkown
page read and write
9340000
unkown
page read and write
7FF5ED9A6000
unkown
page readonly
9C00000
unkown
page read and write
7FF5ED4EF000
unkown
page readonly
140001000
unkown
page execute read
19D000
stack
page read and write
8D90000
unkown
page read and write
8B70000
unkown
page read and write
7FF5ED8FF000
unkown
page readonly
7FF5ED556000
unkown
page readonly
4C60000
unkown
page read and write
7DF4F3041000
unkown
page execute read
7FF5ED445000
unkown
page readonly
C6C9000
unkown
page read and write
8760000
unkown
page read and write
4CC0000
unkown
page read and write
C10A000
stack
page read and write
B08D000
stack
page read and write
3170000
unkown
page read and write
7859000
unkown
page read and write
8D90000
unkown
page read and write
7FF5ED9BE000
unkown
page readonly
8760000
unkown
page read and write
8760000
unkown
page read and write
7E70000
unkown
page read and write
8760000
unkown
page read and write
3150000
unkown
page read and write
9340000
unkown
page read and write
70D000
heap
page execute and read and write
FFF0000
heap
page read and write
7DF4F3030000
unkown
page readonly
9C80000
unkown
page read and write
91B9000
stack
page read and write
7FF5EDA38000
unkown
page readonly
C6F4000
unkown
page read and write
7DA1000
unkown
page read and write
87B0000
unkown
page read and write
7FF5ED97A000
unkown
page readonly
8760000
unkown
page read and write
8780000
unkown
page read and write
9340000
unkown
page read and write
2A10000
heap
page read and write
3150000
unkown
page read and write
9C00000
unkown
page read and write
2A16000
heap
page read and write
9340000
unkown
page read and write
7F40000
unkown
page readonly
9871000
unkown
page read and write
8760000
unkown
page read and write
3150000
unkown
page read and write
1370000
unkown
page read and write
8770000
unkown
page read and write
3150000
unkown
page read and write
9C60000
unkown
page read and write
8780000
unkown
page read and write
3150000
unkown
page read and write
7FF5ED942000
unkown
page readonly
7FF5ED349000
unkown
page readonly
C5A3000
unkown
page read and write
B650000
unkown
page read and write
CADE000
unkown
page read and write
8760000
unkown
page read and write
1370000
unkown
page read and write
87B0000
unkown
page read and write
8780000
unkown
page read and write
7FF5ED50A000
unkown
page readonly
C557000
unkown
page read and write
517000
unkown
page readonly
140001000
unkown
page execute read
7B80000
unkown
page read and write
BC9B000
stack
page read and write
3150000
unkown
page read and write
8780000
unkown
page read and write
9C80000
unkown
page read and write
3170000
unkown
page read and write
5D1000
heap
page read and write
8780000
unkown
page read and write
8770000
unkown
page read and write
8780000
unkown
page read and write
C52C000
unkown
page read and write
C9DE000
unkown
page read and write
9340000
unkown
page read and write
7FF5ED471000
unkown
page readonly
95DB000
stack
page read and write
7FF5ED743000
unkown
page readonly
5B9000
heap
page read and write
1240000
heap
page read and write
3170000
unkown
page read and write
9C000
stack
page read and write
9C80000
unkown
page read and write
8780000
unkown
page read and write
7FF5ED872000
unkown
page readonly
5B0000
heap
page read and write
8780000
unkown
page read and write
87B0000
unkown
page read and write
9977000
unkown
page read and write
3150000
unkown
page read and write
9C80000
unkown
page read and write
A364000
unkown
page read and write
9C80000
unkown
page read and write
9340000
unkown
page read and write
8760000
unkown
page read and write
77E000
heap
page read and write
C811000
unkown
page read and write
417000
unkown
page readonly
8770000
unkown
page read and write
3795000
unkown
page read and write
8780000
unkown
page read and write
3150000
unkown
page read and write
87B0000
unkown
page read and write
1B0000
heap
page read and write
24D0000
heap
page read and write
7FF5ED8F9000
unkown
page readonly
56C3000
unkown
page read and write
400000
unkown
page readonly
7F50000
unkown
page read and write
A33E000
unkown
page read and write
7E70000
unkown
page read and write
8760000
unkown
page read and write
9380000
unkown
page read and write
9340000
unkown
page read and write
8D90000
unkown
page read and write
9C80000
unkown
page read and write
6CE000
stack
page read and write
1350000
unkown
page read and write
3150000
unkown
page read and write
9340000
unkown
page read and write
9C80000
unkown
page read and write
517000
unkown
page readonly
8780000
unkown
page read and write
3150000
unkown
page read and write
7E70000
unkown
page read and write
7FF5ED26E000
unkown
page readonly
9CE0000
unkown
page read and write
417000
unkown
page readonly
9C80000
unkown
page read and write
8780000
unkown
page read and write
9C00000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED519000
unkown
page readonly
140000000
unkown
page readonly
9C80000
unkown
page read and write
7FF5ED9ED000
unkown
page readonly
65E000
stack
page read and write
B22B000
stack
page read and write
76A0000
unkown
page read and write
9C80000
unkown
page read and write
7FF5EDA0B000
unkown
page readonly
400000
unkown
page readonly
8D90000
unkown
page read and write
7DF4F3051000
unkown
page execute read
517000
unkown
page readonly
7FF5ED779000
unkown
page readonly
7E70000
unkown
page read and write
3170000
unkown
page read and write
8780000
unkown
page read and write
8860000
unkown
page read and write
7FF5ED933000
unkown
page readonly
37F9000
unkown
page read and write
8780000
unkown
page read and write
7C80000
unkown
page read and write
9340000
unkown
page read and write
7FF5ED670000
unkown
page readonly
9340000
unkown
page read and write
8760000
unkown
page read and write
965C000
stack
page read and write
3250000
unkown
page read and write
18A0000
unkown
page readonly
8F0000
heap
page read and write
9CE0000
unkown
page read and write
678000
heap
page read and write
906E000
stack
page read and write
A375000
unkown
page read and write
3150000
unkown
page read and write
9AF000
stack
page read and write
8760000
unkown
page read and write
52C000
heap
page read and write
7C90000
unkown
page read and write
1340000
stack
page read and write
7FF5ED28E000
unkown
page readonly
7FF5ED844000
unkown
page readonly
C8E1000
unkown
page read and write
C6F8000
unkown
page read and write
87B0000
unkown
page read and write
1505000
heap
page read and write
4C7A000
unkown
page read and write
1340000
unkown
page read and write
3150000
unkown
page read and write
A327000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED7C4000
unkown
page readonly
BDD0000
unkown
page readonly
9340000
unkown
page read and write
9550000
unkown
page readonly
35A0000
unkown
page readonly
7FF5ED48A000
unkown
page readonly
8760000
unkown
page read and write
87B0000
unkown
page read and write
7FF5ED781000
unkown
page readonly
9340000
unkown
page read and write
610000
heap
page read and write
8D90000
unkown
page read and write
C5A0000
unkown
page read and write
8730000
unkown
page read and write
40B000
unkown
page execute read
7E70000
unkown
page read and write
7FF5ED3F3000
unkown
page readonly
8780000
unkown
page read and write
BDC0000
unkown
page readonly
9340000
unkown
page read and write
37AE000
unkown
page read and write
400000
unkown
page readonly
8780000
unkown
page read and write
19D000
stack
page read and write
A479000
unkown
page read and write
C6E3000
unkown
page read and write
401000
unkown
page execute read
7FF5ED5CE000
unkown
page readonly
8760000
unkown
page read and write
C89A000
unkown
page read and write
9C80000
unkown
page read and write
7FF5ED433000
unkown
page readonly
9C80000
unkown
page read and write
87B0000
unkown
page read and write
9C00000
unkown
page read and write
7FF5ED39E000
unkown
page readonly
401000
unkown
page execute read
401000
unkown
page execute read
79D3000
unkown
page read and write
1480000
heap
page read and write
1350000
unkown
page read and write
8770000
unkown
page read and write
8760000
unkown
page read and write
7E70000
unkown
page read and write
9340000
unkown
page read and write
3150000
unkown
page read and write
13BC000
stack
page read and write
9C80000
unkown
page read and write
400000
unkown
page readonly
8780000
unkown
page read and write
9C00000
unkown
page read and write
3150000
unkown
page read and write
8780000
unkown
page read and write
9C80000
unkown
page read and write
8770000
unkown
page read and write
5BD000
heap
page read and write
3150000
unkown
page read and write
9340000
unkown
page read and write
8B70000
unkown
page read and write
9340000
unkown
page read and write
9340000
unkown
page read and write
9C80000
unkown
page read and write
8760000
unkown
page read and write
7E70000
unkown
page read and write
9070000
unkown
page read and write
9C60000
unkown
page read and write
7FF5ED93B000
unkown
page readonly
2360000
heap
page read and write
7FF5ED495000
unkown
page readonly
8760000
unkown
page read and write
9C80000
unkown
page read and write
8D90000
unkown
page read and write
7D40000
unkown
page read and write
8D90000
unkown
page read and write
8770000
unkown
page read and write
7FF5ED476000
unkown
page readonly
C6D8000
unkown
page read and write
3220000
unkown
page readonly
1350000
unkown
page read and write
9C80000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED1F7000
unkown
page readonly
B6A0000
heap
page read and write
4560000
trusted library allocation
page read and write
830000
heap
page read and write
36D5000
stack
page read and write
7E70000
unkown
page read and write
98A8000
unkown
page read and write
2230000
heap
page read and write
9C80000
unkown
page read and write
7FF5ED4B4000
unkown
page readonly
A310000
unkown
page read and write
7FF5ED806000
unkown
page readonly
7E70000
unkown
page read and write
76C0000
unkown
page read and write
3150000
unkown
page read and write
7FF5ED73D000
unkown
page readonly
9340000
unkown
page read and write
7DF4F3031000
unkown
page execute read
8770000
unkown
page read and write
3150000
unkown
page read and write
A391000
unkown
page read and write
3150000
unkown
page read and write
CA63000
unkown
page read and write
7FF5ED928000
unkown
page readonly
4CB0000
unkown
page read and write
C56F000
unkown
page read and write
9C80000
unkown
page read and write
3210000
unkown
page read and write
8760000
unkown
page read and write
3290000
unkown
page read and write
8780000
unkown
page read and write
8770000
unkown
page read and write
3180000
unkown
page read and write
9340000
unkown
page read and write
7D53000
unkown
page read and write
8780000
unkown
page read and write
8760000
unkown
page read and write
40B000
unkown
page execute read
500000
heap
page read and write
8DA0000
unkown
page read and write
7FF5ED9CA000
unkown
page readonly
8780000
unkown
page read and write
9340000
unkown
page read and write
57E000
stack
page read and write
8780000
unkown
page read and write
7FF5ED6DB000
unkown
page readonly
41B000
unkown
page write copy
8CED000
stack
page read and write
400000
unkown
page readonly
C544000
unkown
page read and write
7FF5EDA11000
unkown
page readonly
7FF5ED507000
unkown
page readonly
7FF5ED697000
unkown
page readonly
1F0000
heap
page read and write
7FF5ED660000
unkown
page readonly
9C80000
unkown
page read and write
401000
unkown
page execute read
2180000
unclassified section
page read and write
69E000
stack
page read and write
7950000
unkown
page read and write
3170000
unkown
page read and write
21FF000
stack
page read and write
3170000
unkown
page read and write
1350000
unkown
page read and write
7F50000
unkown
page read and write
8BF0000
unkown
page readonly
580000
heap
page read and write
8760000
unkown
page read and write
9370000
unkown
page read and write
9C80000
unkown
page read and write
9139000
stack
page read and write
9C80000
unkown
page read and write
81F000
stack
page read and write
7FF5ED8B4000
unkown
page readonly
140021000
unkown
page readonly
AAF6000
unkown
page read and write
2340000
heap
page read and write
3590000
unkown
page read and write
BAF9000
stack
page read and write
1350000
unkown
page read and write
9C80000
unkown
page read and write
8760000
unkown
page read and write
7FF5ED674000
unkown
page readonly
69A000
heap
page read and write
9340000
unkown
page read and write
C561000
unkown
page read and write
7FF5ED2A9000
unkown
page readonly
8780000
unkown
page read and write
8760000
unkown
page read and write
7E70000
unkown
page read and write
140021000
unkown
page readonly
8760000
unkown
page read and write
85C000
heap
page read and write
3150000
unkown
page read and write
8770000
unkown
page read and write
7E70000
unkown
page read and write
7F50000
unkown
page read and write
87B0000
unkown
page read and write
7FF5ED93E000
unkown
page readonly
2240000
heap
page read and write
9070000
unkown
page read and write
87B0000
unkown
page read and write
516000
unkown
page readonly
7FF5ED503000
unkown
page readonly
8770000
unkown
page read and write
8780000
unkown
page read and write
400000
unkown
page readonly
7FF5ED7F1000
unkown
page readonly
37D2000
unkown
page read and write
56D9000
unkown
page read and write
8760000
unkown
page read and write
9070000
unkown
page read and write
839000
heap
page read and write
7CD0000
unkown
page read and write
There are 1510 hidden memdumps, click here to show them.