volatilityの作法 その13

概要

volatilityの作法、調べてみた。
winxpsp3のスナップショット、取ってみた。

vadinfo

VAD node @ 0x81667a18 Start 0x76d10000 End 0x76d28fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166ae98 Segment e13cc880
NumberOfSectionReferences:          0 NumberOfPfnReferences:          16
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167ef90, Name: \Device\HarddiskVolume1\WINDOWS\system32\iphlpapi.dll
First prototype PTE: e13cc8b8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160bce0 Start 0x77b90000 End 0x77ba4fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ae7d0 Segment e1525d48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f96f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
First prototype PTE: e1525d80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81637f30 Start 0x77160000 End 0x77262fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160bcb0 Start 0x77bb0000 End 0x77bb7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817ad830 Segment e1524358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81704f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\version.dll
First prototype PTE: e1524390 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8168bfa8 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8168bfd8 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816a9200 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81636ac0 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816a9230 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x817da6d8 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x8160bc80 Start 0x7d5b0000 End 0x7ddaffff Tag Vad 
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81636a90 Start 0x7e8c0000 End 0x7e970fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b008 Segment e1532008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          31
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d5e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
First prototype PTE: e1532040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816f7278 Start 0x7ffaf000 End 0x7ffaffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81687358 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816524d8 Start 0x7ffdd000 End 0x7ffddfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 81665d18
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816f7aa8 Start 0x7ffdb000 End 0x7ffdbfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816f7a68 Start 0x7ffda000 End 0x7ffdafff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81623cd8 Start 0x7ffdc000 End 0x7ffdcfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:   1076
VAD node @ 0x816f72b8 Start 0x01000000 End 0x01005fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164feb8 Segment e151b860
NumberOfSectionReferences:          5 NumberOfPfnReferences:           6
NumberOfMappedViews:                5 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8164ff90, Name: \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
First prototype PTE: e151b898 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816afc58 Start 0x006a0000 End 0x006a1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816afc88 Segment e1ca03a8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1ca03e0 Last contiguous PTE: e1ca03e4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816f7420 Start 0x00400000 End 0x0040ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815dd790 Start 0x00190000 End 0x0019ffff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815eb590 Start 0x00020000 End 0x00020fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815dd8d0 Start 0x00010000 End 0x00010fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815dd8a0 Start 0x00080000 End 0x00082fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8170e6f0 Segment e17afac0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17afaf8 Last contiguous PTE: e17afb00
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81626da8 Start 0x00040000 End 0x0007ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815eb570 Start 0x00030000 End 0x0003ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816562b8 Start 0x00090000 End 0x0018ffff Tag VadS
Flags: CommitCharge: 54, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81637b58 Start 0x00220000 End 0x00260fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec338 Segment e1488d68
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec2c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
First prototype PTE: e14ec780 Last contiguous PTE: e14ec880
Flags2: CopyOnWrite: 1

VAD node @ 0x816f7470 Start 0x001b0000 End 0x001c5fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ecb10 Segment e1486358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816eca98, Name: \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
First prototype PTE: e14ec890 Last contiguous PTE: e14ec8e4
Flags2: CopyOnWrite: 1

VAD node @ 0x816f7500 Start 0x001a0000 End 0x001affff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815dd708 Segment e1616be8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1616c20 Last contiguous PTE: e1616c5c
Flags2: 

VAD node @ 0x816f7440 Start 0x001d0000 End 0x00210fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec940 Segment e1488f28
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec8c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
First prototype PTE: e14edef8 Last contiguous PTE: e14edff8
Flags2: CopyOnWrite: 1

VAD node @ 0x81637af8 Start 0x00280000 End 0x002c0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816c9288 Segment e156c810
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e156c848 Last contiguous PTE: e156c948
Flags2: 

VAD node @ 0x81637b28 Start 0x00270000 End 0x00275fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec730 Segment e1488e48
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec6b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
First prototype PTE: e1350a60 Last contiguous PTE: e1350a74
Flags2: CopyOnWrite: 1

VAD node @ 0x816379b8 Start 0x002d0000 End 0x00397fff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816caf88 Segment e1565730
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1565768 Last contiguous PTE: e1565a84
Flags2: SecNoChange: 1

VAD node @ 0x81697808 Start 0x003a0000 End 0x003a0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815dd7e0 Start 0x003b0000 End 0x003b0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8160d400 Start 0x003c0000 End 0x003cffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81708878 Start 0x003d0000 End 0x003d1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8168ca18 Segment e1664408
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1664440 Last contiguous PTE: e1664444
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8170ee78 Start 0x003f0000 End 0x003f1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816d5230 Segment e1ca12b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1ca12f0 Last contiguous PTE: e1ca12f4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816b41b8 Start 0x003e0000 End 0x003effff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8160d628 Start 0x00470000 End 0x00572fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816ce008 Segment e1566008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1566040 Last contiguous PTE: e1566448
Flags2: SecNoChange: 1

VAD node @ 0x8160d6a8 Start 0x00420000 End 0x00422fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e5d40 Segment e14914c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           3
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816e5cc8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
First prototype PTE: e14ed7e8 Last contiguous PTE: e14ed7f0
Flags2: CopyOnWrite: 1

VAD node @ 0x8160d6d8 Start 0x00410000 End 0x0041ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8160d688 Start 0x00430000 End 0x0046ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816af4d8 Start 0x00600000 End 0x0063ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8160d4b0 Start 0x00580000 End 0x005fffff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @8160d4e0 Segment e17acb60
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                4 NumberOfUserReferences:          5
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e17acb98 Last contiguous PTE: e17acd94
Flags2: SecNoChange: 1

VAD node @ 0x816fe6e8 Start 0x00640000 End 0x0064ffff Tag VadS
Flags: CommitCharge: 12, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81702158 Start 0x00650000 End 0x0068ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81681220 Start 0x00690000 End 0x00698fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81681008 Segment e1524118
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817da148, Name: \Device\HarddiskVolume1\WINDOWS\system32\normaliz.dll
First prototype PTE: e1524150 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81657a38 Start 0x00c60000 End 0x00c70fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e8ac0 Segment e148b6c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          17
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, WasPurged: 1
FileObject @816e8e70, Name: \Device\HarddiskVolume1\WINDOWS\system32\c_1252.nls
First prototype PTE: e14e2358 Last contiguous PTE: e14e2398
Flags2: CopyOnWrite: 1

VAD node @ 0x81607200 Start 0x00c50000 End 0x00c51fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815f5840 Segment e19d2418
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e19d2450 Last contiguous PTE: e19d2454
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816af618 Start 0x006b0000 End 0x00c0ffff Tag Vad 
Flags: ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fcd10 Segment e153e000
NumberOfSectionReferences:          0 NumberOfPfnReferences:          36
NumberOfMappedViews:               11 NumberOfUserReferences:         11
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a6f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\xpsp2res.dll
First prototype PTE: e153e038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81697ed0 Start 0x00c10000 End 0x00c4ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815f47e8 Start 0x00dc0000 End 0x00dc1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815f4750 Segment e1604fb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1604ff0 Last contiguous PTE: e1604ff4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816071e0 Start 0x00d80000 End 0x00dbffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81607230 Start 0x00c80000 End 0x00d7ffff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816ed3f8 Start 0x00de0000 End 0x00de3fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @816c2900 Segment e14ca180
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816c2888, Name: \Device\HarddiskVolume1\Documents and Settings\LocalService\Cookies\index.dat
First prototype PTE: e1514308 Last contiguous PTE: e1514314
Flags2: Inherit: 1

VAD node @ 0x815f4e70 Start 0x00dd0000 End 0x00dd7fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @816c2ce0 Segment e14ca260
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816c2c68, Name: \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
First prototype PTE: e1516da8 Last contiguous PTE: e1516dc4
Flags2: Inherit: 1

VAD node @ 0x81600fb0 Start 0x00e00000 End 0x00e3ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816ed2e0 Start 0x00df0000 End 0x00df3fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @816c26f0 Segment e14ce008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816c2678, Name: \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat
First prototype PTE: e1516d90 Last contiguous PTE: e1516d9c
Flags2: Inherit: 1

VAD node @ 0x816009d0 Start 0x00e80000 End 0x00ebffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81600ce0 Start 0x00e40000 End 0x00e7ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816e5750 Start 0x00ec0000 End 0x00efffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81694b78 Start 0x00f00000 End 0x00f3ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816fd780 Start 0x00f40000 End 0x00f7ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815dae20 Start 0x00f80000 End 0x00fbffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8169bc08 Start 0x00fc0000 End 0x00fcffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS

VAD node @ 0x815dd930 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815dd760 Start 0x7c800000 End 0x7c932fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b3008 Segment e1528798
NumberOfSectionReferences:          1 NumberOfPfnReferences:         102
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702818, Name: \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
First prototype PTE: e15287d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d8a8 Start 0x76af0000 End 0x76b1afff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81697f30 Segment e1539598
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817d9110, Name: \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
First prototype PTE: e15395d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816379e8 Start 0x5a620000 End 0x5a645fff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165f008 Segment e1536528
NumberOfSectionReferences:          0 NumberOfPfnReferences:          17
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aff28, Name: \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
First prototype PTE: e1536560 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d938 Start 0x567f0000 End 0x569b9fff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fe3d0 Segment e15396b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          28
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81668d00, Name: \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
First prototype PTE: e15396f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816811f0 Start 0x1a400000 End 0x1a531fff Tag Vad 
Flags: CommitCharge: 13, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168d008 Segment e1529ac8
NumberOfSectionReferences:          1 NumberOfPfnReferences:         119
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817048b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\urlmon.dll
First prototype PTE: e1529b00 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173c1a8 Start 0x01050000 End 0x0108ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816872d8 Start 0x01010000 End 0x0104ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81560f88 Start 0x01090000 End 0x010cffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8160d6f8 Start 0x58730000 End 0x58767fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816aea30 Segment e1538678
NumberOfSectionReferences:          0 NumberOfPfnReferences:          49
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81697028, Name: \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
First prototype PTE: e15386b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f57a8 Start 0x57f60000 End 0x57f74fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f9d20 Segment e15471d0
NumberOfSectionReferences:          0 NumberOfPfnReferences:          12
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f9ca8, Name: \Device\HarddiskVolume1\WINDOWS\system32\webclnt.dll
First prototype PTE: e1547208 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d658 Start 0x762e0000 End 0x762fcfff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f4f30 Segment e151cb60
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aad50, Name: \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
First prototype PTE: e151cb98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81659bc0 Start 0x719e0000 End 0x719f6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816bbec8 Segment e13ccc68
NumberOfSectionReferences:          0 NumberOfPfnReferences:          15
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aabd0, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2_32.dll
First prototype PTE: e13ccca0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d450 Start 0x60740000 End 0x60748fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163d008 Segment e1532570
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81707920, Name: \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
First prototype PTE: e15325a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169f2a8 Start 0x5ab60000 End 0x5abf9fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163ca68 Segment e152aa70
NumberOfSectionReferences:          1 NumberOfPfnReferences:          52
NumberOfMappedViews:               11 NumberOfUserReferences:         12
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705428, Name: \Device\HarddiskVolume1\WINDOWS\system32\comctl32.dll
First prototype PTE: e152aaa8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81607270 Start 0x5dca0000 End 0x5de87fff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f42c0 Segment e152e008
NumberOfSectionReferences:          1 NumberOfPfnReferences:         118
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170bce8, Name: \Device\HarddiskVolume1\WINDOWS\system32\iertutil.dll
First prototype PTE: e152e040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81659b90 Start 0x719d0000 End 0x719d7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ddcd0 Segment e1533550
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aac90, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2help.dll
First prototype PTE: e1533588 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81681250 Start 0x63000000 End 0x630e5fff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f7080 Segment e15296b8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          50
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81708340, Name: \Device\HarddiskVolume1\WINDOWS\system32\wininet.dll
First prototype PTE: e15296f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81681110 Start 0x607c0000 End 0x60815fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816404b0 Segment e153c298
NumberOfSectionReferences:          0 NumberOfPfnReferences:          56
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81658e98, Name: \Device\HarddiskVolume1\WINDOWS\system32\hnetcfg.dll
First prototype PTE: e153c2d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f3380 Start 0x71980000 End 0x719befff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81658f10 Segment e153c4e8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          24
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81659eb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\mswsock.dll
First prototype PTE: e153c520 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815db8a8 Start 0x719c0000 End 0x719c7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81659f30 Segment e153c180
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81640438, Name: \Device\HarddiskVolume1\WINDOWS\system32\wshtcpip.dll
First prototype PTE: e153c1b8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d420 Start 0x73f80000 End 0x73feafff Tag Vad 
Flags: CommitCharge: 16, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e008 Segment e1532350
NumberOfSectionReferences:          0 NumberOfPfnReferences:          43
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81703d28, Name: \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
First prototype PTE: e1532388 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816afc28 Start 0x71b40000 End 0x71b52fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816be978 Segment e1536258
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816b1848, Name: \Device\HarddiskVolume1\WINDOWS\system32\samlib.dll
First prototype PTE: e1536290 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816af560 Start 0x74b80000 End 0x74b85fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81664008 Segment e1541658
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81664130, Name: \Device\HarddiskVolume1\WINDOWS\system32\lmhsvc.dll
First prototype PTE: e1541690 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8165ccc0 Start 0x75b80000 End 0x75b93fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @815f2670 Segment e13285f0
NumberOfSectionReferences:          0 NumberOfPfnReferences:          19
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @817d33a8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ssdpsrv.dll
First prototype PTE: e1328628 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d878 Start 0x76970000 End 0x76aacfff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e858 Segment e1528230
NumberOfSectionReferences:          1 NumberOfPfnReferences:         155
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702648, Name: \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
First prototype PTE: e1528268 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81637a78 Start 0x77d80000 End 0x77e28fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689128 Segment e15272d8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          71
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
First prototype PTE: e1527310 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815dd860 Start 0x77cf0000 End 0x77d7ffff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745d50 Segment e152ad50
NumberOfSectionReferences:          1 NumberOfPfnReferences:          99
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81745b58, Name: \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
First prototype PTE: e152ad88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x8160d848 Start 0x77bc0000 End 0x77c17fff Tag Vad 
Flags: CommitCharge: 7, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81672248 Segment e152a648
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               16 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705680, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
First prototype PTE: e152a680 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d818 Start 0x770d0000 End 0x7715afff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e5c8 Segment e1529008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          64
NumberOfMappedViews:               14 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702478, Name: \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
First prototype PTE: e1529040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81671e68 Start 0x76c90000 End 0x76caffff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168ec08 Segment e153dce8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8168e7e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntmarta.dll
First prototype PTE: e153dd20 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8168da90 Start 0x76f10000 End 0x76f3bfff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779540 Segment e1526248
NumberOfSectionReferences:          1 NumberOfPfnReferences:           7
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705988, Name: \Device\HarddiskVolume1\WINDOWS\system32\wldap32.dll
First prototype PTE: e1526280 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81659bf0 Start 0x76d10000 End 0x76d28fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166ae98 Segment e13cc880
NumberOfSectionReferences:          0 NumberOfPfnReferences:          16
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167ef90, Name: \Device\HarddiskVolume1\WINDOWS\system32\iphlpapi.dll
First prototype PTE: e13cc8b8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d4970 Start 0x76f80000 End 0x76ffefff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164af30 Segment e1540bb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          32
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f5e48, Name: \Device\HarddiskVolume1\WINDOWS\system32\clbcatq.dll
First prototype PTE: e1540bf0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d49a0 Start 0x77000000 End 0x770aafff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f970 Segment e153c818
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8164f8f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\comres.dll
First prototype PTE: e153c850 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d7e8 Start 0x77b90000 End 0x77ba4fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ae7d0 Segment e1525d48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f96f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
First prototype PTE: e1525d80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d290 Start 0x77160000 End 0x77262fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d7b8 Start 0x77bb0000 End 0x77bb7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817ad830 Segment e1524358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81704f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\version.dll
First prototype PTE: e1524390 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81637a48 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81637a18 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d8d8 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d758 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81600a28 Start 0x7ffae000 End 0x7ffaefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 20707249 Last contiguous PTE: 00b80000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816f74d0 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x8160d788 Start 0x7d5b0000 End 0x7ddaffff Tag Vad 
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160d728 Start 0x7e8c0000 End 0x7e970fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b008 Segment e1532008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          31
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d5e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
First prototype PTE: e1532040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816ee618 Start 0x7ffac000 End 0x7ffacfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8167be28 Start 0x7ffaa000 End 0x7ffaafff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00002e00
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816173d8 Start 0x7ffa7000 End 0x7ffa7fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81682c60 Start 0x7ffa6000 End 0x7ffa6fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00730069 Last contiguous PTE: 0056006b
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8163c610 Start 0x7ffa9000 End 0x7ffa9fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816a90f0 Start 0x7ffa8000 End 0x7ffa8fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816ee448 Start 0x7ffab000 End 0x7ffabfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81600370 Start 0x7ffad000 End 0x7ffadfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 20707249 Last contiguous PTE: 00b80000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815eb5f0 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816ed138 Start 0x7ffaf000 End 0x7ffaffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815eb5b0 Start 0x7ffda000 End 0x7ffdafff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 817e4030
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815eb530 Start 0x7ffdf000 End 0x7ffdffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 04000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816195e8 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81659428 Start 0x7ffdd000 End 0x7ffddfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 01000010 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81655948 Start 0x7ffdb000 End 0x7ffdbfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000001 Last contiguous PTE: 81655968
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816238c8 Start 0x7ffdc000 End 0x7ffdcfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:   1248
VAD node @ 0x815dec90 Start 0x00920000 End 0x00921fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815decc0 Segment e1882bb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1882bf0 Last contiguous PTE: e1882bf4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81613780 Start 0x00400000 End 0x0040ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816138a8 Start 0x00190000 End 0x0019ffff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815ed3a0 Start 0x00020000 End 0x00020fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815ed3c0 Start 0x00010000 End 0x00010fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815fdc30 Start 0x00080000 End 0x00082fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816489a8 Segment e1a71630
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a71668 Last contiguous PTE: e1a71670
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x815f9840 Start 0x00040000 End 0x0007ffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815ee470 Start 0x00030000 End 0x0003ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816784f8 Start 0x00090000 End 0x0018ffff Tag Vadl
Flags: CommitCharge: 44, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815f9450 Start 0x00220000 End 0x00260fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec338 Segment e1488d68
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec2c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
First prototype PTE: e14ec780 Last contiguous PTE: e14ec880
Flags2: CopyOnWrite: 1

VAD node @ 0x815f94b0 Start 0x001b0000 End 0x001c5fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ecb10 Segment e1486358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816eca98, Name: \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
First prototype PTE: e14ec890 Last contiguous PTE: e14ec8e4
Flags2: CopyOnWrite: 1

VAD node @ 0x81613800 Start 0x001a0000 End 0x001affff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81613850 Segment e1b2e008
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1b2e040 Last contiguous PTE: e1b2e07c
Flags2: 

VAD node @ 0x815f9480 Start 0x001d0000 End 0x00210fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec940 Segment e1488f28
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec8c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
First prototype PTE: e14edef8 Last contiguous PTE: e14edff8
Flags2: CopyOnWrite: 1

VAD node @ 0x815f93f0 Start 0x00280000 End 0x002c0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816c9288 Segment e156c810
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e156c848 Last contiguous PTE: e156c948
Flags2: 

VAD node @ 0x815f9420 Start 0x00270000 End 0x00275fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec730 Segment e1488e48
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec6b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
First prototype PTE: e1350a60 Last contiguous PTE: e1350a74
Flags2: CopyOnWrite: 1

VAD node @ 0x816542f8 Start 0x002d0000 End 0x00397fff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816caf88 Segment e1565730
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1565768 Last contiguous PTE: e1565a84
Flags2: SecNoChange: 1

VAD node @ 0x816f24b8 Start 0x003a0000 End 0x003a0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815daec0 Start 0x003b0000 End 0x003b0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815dadc8 Start 0x003c0000 End 0x003cffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816943e0 Start 0x003d0000 End 0x003d1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81694410 Segment e1a713e8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a71420 Last contiguous PTE: e1a71424
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x815def10 Start 0x003f0000 End 0x003f1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815def40 Segment e1b67488
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1b674c0 Last contiguous PTE: e1b674c4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x815ded48 Start 0x003e0000 End 0x003effff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815da3e0 Start 0x00470000 End 0x00572fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816ce008 Segment e1566008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1566040 Last contiguous PTE: e1566448
Flags2: SecNoChange: 1

VAD node @ 0x81613d40 Start 0x00420000 End 0x00422fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e5d40 Segment e14914c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           3
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816e5cc8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
First prototype PTE: e14ed7e8 Last contiguous PTE: e14ed7f0
Flags2: CopyOnWrite: 1

VAD node @ 0x81613fe8 Start 0x00410000 End 0x0041ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81613d20 Start 0x00430000 End 0x0046ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815deda8 Start 0x00880000 End 0x008bffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8165e9c8 Start 0x00580000 End 0x0087ffff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c1ac8 Segment e17e4008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                9 NumberOfUserReferences:         10
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e17e4040 Last contiguous PTE: e17e4c3c
Flags2: SecNoChange: 1

VAD node @ 0x815de4d8 Start 0x008c0000 End 0x008fffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817781f0 Start 0x00900000 End 0x0090ffff Tag VadS
Flags: CommitCharge: 13, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816510e8 Start 0x00910000 End 0x0091ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815ed8c8 Start 0x01000000 End 0x0100ffff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81657008 Segment e1547dc8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          12
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8166eeb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe
First prototype PTE: e1547e00 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81644d50 Start 0x009f0000 End 0x00a2ffff Tag Vadl
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, ReadOnly: 1

VAD node @ 0x816787f0 Start 0x009b0000 End 0x009effff Tag VadS
Flags: CommitCharge: 17, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81678f58 Start 0x00930000 End 0x0096ffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8169ba88 Start 0x00970000 End 0x009affff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81744378 Start 0x00bb0000 End 0x00beffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816d0398 Start 0x00ab0000 End 0x00baffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81664c58 Start 0x00a70000 End 0x00aaffff Tag VadS
Flags: CommitCharge: 17, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81560db0 Start 0x00a30000 End 0x00a6ffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81646320 Start 0x00cf0000 End 0x00d2ffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817d44b0 Start 0x00bf0000 End 0x00ceffff Tag VadS
Flags: CommitCharge: 256, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81792bc0 Start 0x00d40000 End 0x00d7ffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816949a0 Start 0x00d30000 End 0x00d3ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81602070 Start 0x00d80000 End 0x00dbffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8158d508 Start 0x00e40000 End 0x00e4ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS

VAD node @ 0x8160f880 Start 0x00e50000 End 0x00e8ffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8166d0f0 Start 0x00e90000 End 0x00ecffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815f96c0 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815fd300 Start 0x7c800000 End 0x7c932fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b3008 Segment e1528798
NumberOfSectionReferences:          1 NumberOfPfnReferences:         102
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702818, Name: \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
First prototype PTE: e15287d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815ee298 Start 0x77cf0000 End 0x77d7ffff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745d50 Segment e152ad50
NumberOfSectionReferences:          1 NumberOfPfnReferences:          99
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81745b58, Name: \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
First prototype PTE: e152ad88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x81613418 Start 0x76970000 End 0x76aacfff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e858 Segment e1528230
NumberOfSectionReferences:          1 NumberOfPfnReferences:         155
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702648, Name: \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
First prototype PTE: e1528268 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613478 Start 0x5a620000 End 0x5a645fff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165f008 Segment e1536528
NumberOfSectionReferences:          0 NumberOfPfnReferences:          17
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aff28, Name: \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
First prototype PTE: e1536560 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613ca0 Start 0x567f0000 End 0x569b9fff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fe3d0 Segment e15396b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          28
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81668d00, Name: \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
First prototype PTE: e15396f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161dda8 Start 0x01010000 End 0x0156ffff Tag Vad 
Flags: ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fcd10 Segment e153e000
NumberOfSectionReferences:          0 NumberOfPfnReferences:          36
NumberOfMappedViews:               11 NumberOfUserReferences:         11
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a6f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\xpsp2res.dll
First prototype PTE: e153e038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613298 Start 0x58730000 End 0x58767fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816aea30 Segment e1538678
NumberOfSectionReferences:          0 NumberOfPfnReferences:          49
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81697028, Name: \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
First prototype PTE: e15386b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815fd388 Start 0x59250000 End 0x592a4fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816db1d8 Segment e1534008
NumberOfSectionReferences:          0 NumberOfPfnReferences:          35
NumberOfMappedViews:                9 NumberOfUserReferences:          9
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aa750, Name: \Device\HarddiskVolume1\WINDOWS\system32\netapi32.dll
First prototype PTE: e1534040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815dba88 Start 0x719e0000 End 0x719f6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816bbec8 Segment e13ccc68
NumberOfSectionReferences:          0 NumberOfPfnReferences:          15
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aabd0, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2_32.dll
First prototype PTE: e13ccca0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8165e998 Start 0x60740000 End 0x60748fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163d008 Segment e1532570
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81707920, Name: \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
First prototype PTE: e15325a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815ded68 Start 0x5ab60000 End 0x5abf9fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163ca68 Segment e152aa70
NumberOfSectionReferences:          1 NumberOfPfnReferences:          52
NumberOfMappedViews:               11 NumberOfUserReferences:         12
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705428, Name: \Device\HarddiskVolume1\WINDOWS\system32\comctl32.dll
First prototype PTE: e152aaa8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81782568 Start 0x719d0000 End 0x719d7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ddcd0 Segment e1533550
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aac90, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2help.dll
First prototype PTE: e1533588 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81572418 Start 0x71980000 End 0x719befff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81658f10 Segment e153c4e8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          24
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81659eb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\mswsock.dll
First prototype PTE: e153c520 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161a390 Start 0x762e0000 End 0x762fcfff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f4f30 Segment e151cb60
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aad50, Name: \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
First prototype PTE: e151cb98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81688878 Start 0x73f80000 End 0x73feafff Tag Vad 
Flags: CommitCharge: 16, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e008 Segment e1532350
NumberOfSectionReferences:          0 NumberOfPfnReferences:          43
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81703d28, Name: \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
First prototype PTE: e1532388 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8165e7b8 Start 0x72f50000 End 0x72f75fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81675008 Segment e1541a08
NumberOfSectionReferences:          0 NumberOfPfnReferences:          10
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81675130, Name: \Device\HarddiskVolume1\WINDOWS\system32\winspool.drv
First prototype PTE: e1541a40 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f3310 Start 0x72370000 End 0x7237dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8173b008 Segment e19d32c8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @816f43e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\tcpmon.dll
First prototype PTE: e19d3300 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8163d220 Start 0x72360000 End 0x72366fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d5648 Segment e10436b0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @8158e118, Name: \Device\HarddiskVolume1\WINDOWS\system32\usbmon.dll
First prototype PTE: e10436e8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8156bdf8 Start 0x71bd0000 End 0x71bd6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81637c70 Segment e1a6a5b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f56e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\netrap.dll
First prototype PTE: e1a6a5f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816982a0 Start 0x74220000 End 0x74234fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81603a18 Segment e18fb3b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          20
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @815fbe10, Name: \Device\HarddiskVolume1\WINDOWS\system32\spoolss.dll
First prototype PTE: e18fb3f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81688668 Start 0x741e0000 End 0x741ecfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d5008 Segment e1042280
NumberOfSectionReferences:          0 NumberOfPfnReferences:          12
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @8161e8b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\cnbjmon.dll
First prototype PTE: e10422b8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f32e0 Start 0x741c0000 End 0x741c6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816169d0 Segment e10678b0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @8161f268, Name: \Device\HarddiskVolume1\WINDOWS\system32\pjlmon.dll
First prototype PTE: e10678e8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816fd498 Start 0x74bf0000 End 0x74c44fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d5c98 Segment e1067c20
NumberOfSectionReferences:          0 NumberOfPfnReferences:          45
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @817d3cb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\localspl.dll
First prototype PTE: e1067c58 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8156bfa8 Start 0x74240000 End 0x74254fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816222c8 Segment e1a053c8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          20
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @8161e788, Name: \Device\HarddiskVolume1\WINDOWS\system32\inetpp.dll
First prototype PTE: e1a05400 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815df360 Start 0x757b0000 End 0x757d3fff Tag Vad 
Flags: CommitCharge: 11, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c7008 Segment e1676d20
NumberOfSectionReferences:          0 NumberOfPfnReferences:          20
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @8173b600, Name: \Device\HarddiskVolume1\WINDOWS\system32\win32spl.dll
First prototype PTE: e1676d58 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81591fa8 Start 0x765c0000 End 0x76653fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f008 Segment e152ec80
NumberOfSectionReferences:          0 NumberOfPfnReferences:          52
NumberOfMappedViews:                8 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a85d8, Name: \Device\HarddiskVolume1\WINDOWS\system32\crypt32.dll
First prototype PTE: e152ecb8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8156bdc8 Start 0x76750000 End 0x76762fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b240 Segment e1538008
NumberOfSectionReferences:          0 NumberOfPfnReferences:           7
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ae900, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdsapi.dll
First prototype PTE: e1538040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816134a8 Start 0x77bc0000 End 0x77c17fff Tag Vad 
Flags: CommitCharge: 7, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81672248 Segment e152a648
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               16 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705680, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
First prototype PTE: e152a680 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613c70 Start 0x76af0000 End 0x76b1afff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81697f30 Segment e1539598
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817d9110, Name: \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
First prototype PTE: e15395d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816133b8 Start 0x770d0000 End 0x7715afff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e5c8 Segment e1529008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          64
NumberOfMappedViews:               14 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702478, Name: \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
First prototype PTE: e1529040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81591e58 Start 0x76ed0000 End 0x76ef6fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816bf8a8 Segment e1536398
NumberOfSectionReferences:          0 NumberOfPfnReferences:          24
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816b0f10, Name: \Device\HarddiskVolume1\WINDOWS\system32\dnsapi.dll
First prototype PTE: e15363d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81591f48 Start 0x76c10000 End 0x76c38fff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165a008 Segment e1536b80
NumberOfSectionReferences:          0 NumberOfPfnReferences:          25
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ac7b0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sfc_os.dll
First prototype PTE: e1536bb8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81591f78 Start 0x76be0000 End 0x76c0dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e1528 Segment e15344f8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aab10, Name: \Device\HarddiskVolume1\WINDOWS\system32\wintrust.dll
First prototype PTE: e1534530 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816f5300 Start 0x76c40000 End 0x76c67fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816c8008 Segment e15271c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817029e8, Name: \Device\HarddiskVolume1\WINDOWS\system32\imagehlp.dll
First prototype PTE: e15271f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816d0f10 Start 0x76f70000 End 0x76f75fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166dca0 Segment e1541f78
NumberOfSectionReferences:          0 NumberOfPfnReferences:           3
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8166dc28, Name: \Device\HarddiskVolume1\WINDOWS\system32\rasadhlp.dll
First prototype PTE: e1541fb0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178ccb0 Start 0x76f60000 End 0x76f67fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81696340 Segment e153c068
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816962c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\winrnr.dll
First prototype PTE: e153c0a0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178cc80 Start 0x76f10000 End 0x76f3bfff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779540 Segment e1526248
NumberOfSectionReferences:          1 NumberOfPfnReferences:           7
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705988, Name: \Device\HarddiskVolume1\WINDOWS\system32\wldap32.dll
First prototype PTE: e1526280 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8156bee8 Start 0x76f80000 End 0x76ffefff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164af30 Segment e1540bb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          32
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f5e48, Name: \Device\HarddiskVolume1\WINDOWS\system32\clbcatq.dll
First prototype PTE: e1540bf0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815d43b0 Start 0x77000000 End 0x770aafff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f970 Segment e153c818
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8164f8f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\comres.dll
First prototype PTE: e153c850 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613388 Start 0x77b90000 End 0x77ba4fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ae7d0 Segment e1525d48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f96f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
First prototype PTE: e1525d80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816948b0 Start 0x77160000 End 0x77262fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613358 Start 0x77bb0000 End 0x77bb7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817ad830 Segment e1524358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81704f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\version.dll
First prototype PTE: e1524390 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816f52d0 Start 0x77c40000 End 0x77c51fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168f008 Segment e152eb40
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                8 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a94f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msasn1.dll
First prototype PTE: e152eb78 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613598 Start 0x77d80000 End 0x77e28fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689128 Segment e15272d8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          71
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
First prototype PTE: e1527310 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613568 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613538 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81613508 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816132f8 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8156fd20 Start 0x7ffae000 End 0x7ffaefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816137d0 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x81613328 Start 0x7d5b0000 End 0x7ddaffff Tag Vad 
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816132c8 Start 0x7e8c0000 End 0x7e970fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b008 Segment e1532008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          31
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d5e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
First prototype PTE: e1532040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81647d68 Start 0x7ffac000 End 0x7ffacfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617b28 Start 0x7ffaa000 End 0x7ffaafff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617578 Start 0x7ffa8000 End 0x7ffa8fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816172a0 Start 0x7ffa5000 End 0x7ffa5fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816ee7a8 Start 0x7ffa4000 End 0x7ffa4fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617ac0 Start 0x7ffa9000 End 0x7ffa9fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81678ab8 Start 0x7ffab000 End 0x7ffabfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815d6998 Start 0x7ffad000 End 0x7ffadfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815ed420 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81678538 Start 0x7ffaf000 End 0x7ffaffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815ed3e0 Start 0x7ffdf000 End 0x7ffdffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815fdd50 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815defc8 Start 0x7ffdd000 End 0x7ffddfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81678fc8 Start 0x7ffdc000 End 0x7ffdcfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81678ca0 Start 0x7ffdb000 End 0x7ffdbfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 02000028 Last contiguous PTE: 0100f13d
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617b90 Start 0x7ffda000 End 0x7ffdafff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00001000
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:   1376
VAD node @ 0x815624c8 Start 0x06020000 End 0x06020fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, MultipleSecured: 1

VAD node @ 0x815643d0 Start 0x05f00000 End 0x05f00fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, MultipleSecured: 1

VAD node @ 0x8156c5a0 Start 0x05db0000 End 0x05db0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, MultipleSecured: 1

VAD node @ 0x81737808 Start 0x05c00000 End 0x05c0ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737928 Start 0x05ba0000 End 0x05baffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815647f0 Start 0x05a60000 End 0x05a9ffff Tag VadS
Flags: CommitCharge: 62, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81617308 Start 0x055f0000 End 0x05602fff Tag Vadl
Flags: CommitCharge: 19, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816ac2d8 Start 0x04f80000 End 0x04fbffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8166ea08 Start 0x04ea0000 End 0x04edffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816b0080 Start 0x04db0000 End 0x04dd4fff Tag Vadl
Flags: CommitCharge: 37, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8170e958 Start 0x04b50000 End 0x04b51fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81628d20 Segment e1831008
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1831040 Last contiguous PTE: e1831044
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8160dfc8 Start 0x03f50000 End 0x03f51fff Tag Vadl
Flags: CommitCharge: 2, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815f5cf8 Start 0x03e90000 End 0x03ea5fff Tag Vadl
Flags: CommitCharge: 22, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81675210 Start 0x03d10000 End 0x03d2bfff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816d53f0 Segment e14b2a48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           2
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816d5378, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpcd.dic
First prototype PTE: e14fd3e8 Last contiguous PTE: e14fd454
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x816753b0 Start 0x019a0000 End 0x027a1fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816d6350 Segment e14ad3b0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816d62d8, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpst.dic
First prototype PTE: e1502000 Last contiguous PTE: e1505804
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x815f5e38 Start 0x01000000 End 0x010fcfff Tag Vadl
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166c400 Segment e15475a0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          70
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8166c388, Name: \Device\HarddiskVolume1\WINDOWS\explorer.exe
First prototype PTE: e15475d8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x816c3c40 Start 0x00be0000 End 0x00be1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816c3c70 Segment e1ad19b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1ad19f0 Last contiguous PTE: e1ad19f4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81655e28 Start 0x004e0000 End 0x005e2fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816ce008 Segment e1566008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1566040 Last contiguous PTE: e1566448
Flags2: SecNoChange: 1

VAD node @ 0x8169c8a0 Start 0x002d0000 End 0x002d1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8169c8d0 Segment e1e84470
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1e844a8 Last contiguous PTE: e1e844ac
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816f5330 Start 0x00190000 End 0x0019ffff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81634e80 Start 0x00020000 End 0x00020fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81608a88 Start 0x00010000 End 0x00010fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816084d0 Start 0x00080000 End 0x00082fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816489a8 Segment e1a71630
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a71668 Last contiguous PTE: e1a71670
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8160a9c8 Start 0x00040000 End 0x0007ffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81684e80 Start 0x00030000 End 0x0003ffff Tag VadS
Flags: CommitCharge: 16, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81624258 Start 0x00090000 End 0x0018ffff Tag Vadl
Flags: CommitCharge: 234, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1

VAD node @ 0x81608380 Start 0x00220000 End 0x00260fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec338 Segment e1488d68
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec2c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
First prototype PTE: e14ec780 Last contiguous PTE: e14ec880
Flags2: CopyOnWrite: 1

VAD node @ 0x816083e0 Start 0x001b0000 End 0x001c5fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ecb10 Segment e1486358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816eca98, Name: \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
First prototype PTE: e14ec890 Last contiguous PTE: e14ec8e4
Flags2: CopyOnWrite: 1

VAD node @ 0x81608470 Start 0x001a0000 End 0x001affff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81646fb0 Segment e1a70900
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1a70938 Last contiguous PTE: e1a70974
Flags2: 

VAD node @ 0x816083b0 Start 0x001d0000 End 0x00210fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec940 Segment e1488f28
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec8c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
First prototype PTE: e14edef8 Last contiguous PTE: e14edff8
Flags2: CopyOnWrite: 1

VAD node @ 0x8169cd60 Start 0x00280000 End 0x002c0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816c9288 Segment e156c810
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e156c848 Last contiguous PTE: e156c948
Flags2: 

VAD node @ 0x81608350 Start 0x00270000 End 0x00275fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec730 Segment e1488e48
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec6b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
First prototype PTE: e1350a60 Last contiguous PTE: e1350a74
Flags2: CopyOnWrite: 1

VAD node @ 0x8169c258 Start 0x00400000 End 0x00408fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81681008 Segment e1524118
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817da148, Name: \Device\HarddiskVolume1\WINDOWS\system32\normaliz.dll
First prototype PTE: e1524150 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655e88 Start 0x00300000 End 0x00302fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e5d40 Segment e14914c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           3
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816e5cc8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
First prototype PTE: e14ed7e8 Last contiguous PTE: e14ed7f0
Flags2: CopyOnWrite: 1

VAD node @ 0x81608330 Start 0x002e0000 End 0x002effff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8169cd98 Start 0x002f0000 End 0x002fffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81655bd0 Start 0x00350000 End 0x00350fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8169c208 Start 0x00310000 End 0x0034ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81655b50 Start 0x00360000 End 0x00360fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81655d70 Start 0x00370000 End 0x0037ffff Tag VadS
Flags: CommitCharge: 14, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81655a08 Start 0x00380000 End 0x00381fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8169c2e8 Segment e19a55b0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e19a55e8 Last contiguous PTE: e19a55ec
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816552d0 Start 0x003a0000 End 0x003a1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81655300 Segment e19d44d0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e19d4508 Last contiguous PTE: e19d450c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8169cfa8 Start 0x00390000 End 0x00391fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81655278 Segment e1b67ab0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1b67ae8 Last contiguous PTE: e1b67aec
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8169c418 Start 0x003b0000 End 0x003c0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e8ac0 Segment e148b6c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          17
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, WasPurged: 1
FileObject @816e8e70, Name: \Device\HarddiskVolume1\WINDOWS\system32\c_1252.nls
First prototype PTE: e14e2358 Last contiguous PTE: e14e2398
Flags2: CopyOnWrite: 1

VAD node @ 0x815e53f8 Start 0x003d0000 End 0x003d1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815e5428 Segment e1b01c70
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1b01ca8 Last contiguous PTE: e1b01cac
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816c3d90 Start 0x003e0000 End 0x003e1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816c3dc0 Segment e19c3128
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e19c3160 Last contiguous PTE: e19c3164
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816c3a90 Start 0x003f0000 End 0x003f1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816c3ac0 Segment e1ad1a08
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1ad1a40 Last contiguous PTE: e1ad1a44
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81655f78 Start 0x00410000 End 0x004d7fff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816caf88 Segment e1565730
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1565768 Last contiguous PTE: e1565a84
Flags2: SecNoChange: 1

VAD node @ 0x816556a0 Start 0x00a30000 End 0x00b2ffff Tag VadS
Flags: CommitCharge: 256, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81655af0 Start 0x008f0000 End 0x009effff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81655dc8 Start 0x005f0000 End 0x008effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c1ac8 Segment e17e4008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                9 NumberOfUserReferences:         10
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e17e4040 Last contiguous PTE: e17e4c3c
Flags2: SecNoChange: 1

VAD node @ 0x81655730 Start 0x009f0000 End 0x00a2ffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c3978 Start 0x00b40000 End 0x00b41fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816c3a08 Segment e196e6f8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e196e730 Last contiguous PTE: e196e734
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816c3fe8 Start 0x00b30000 End 0x00b3ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c3a60 Start 0x00b50000 End 0x00b9ffff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @81601550 Segment e146baf0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e146bb28 Last contiguous PTE: e146bc64
Flags2: Inherit: 1

VAD node @ 0x816c39a8 Start 0x00ba0000 End 0x00badfff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @816bf270 Segment e16137a0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                6 NumberOfUserReferences:          7
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e16137d8 Last contiguous PTE: e161380c
Flags2: Inherit: 1

VAD node @ 0x816c3b28 Start 0x00bb0000 End 0x00bbffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c38f8 Start 0x00bc0000 End 0x00bcffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c38b8 Start 0x00bd0000 End 0x00bdffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c37c8 Start 0x00c30000 End 0x00c4ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c3898 Start 0x00c10000 End 0x00c1ffff Tag VadS
Flags: CommitCharge: 16, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c38d8 Start 0x00bf0000 End 0x00c0ffff Tag VadS
Flags: CommitCharge: 23, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c3878 Start 0x00c20000 End 0x00c2ffff Tag VadS
Flags: CommitCharge: 13, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c3f68 Start 0x00d10000 End 0x00d39fff Tag Vadl
Flags: CommitCharge: 42, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81655380 Start 0x00d00000 End 0x00d00fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816553c0 Start 0x00c50000 End 0x00cf5fff Tag Vadl
Flags: CommitCharge: 166, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816c3fa8 Start 0x00ec0000 End 0x00ee9fff Tag Vadl
Flags: CommitCharge: 42, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816c3f28 Start 0x00d40000 End 0x00eb5fff Tag Vadl
Flags: CommitCharge: 374, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815e8938 Start 0x00f50000 End 0x00f51fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815e89c8 Segment e1ad1de0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1ad1e18 Last contiguous PTE: e1ad1e1c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81690e80 Start 0x00ef0000 End 0x00efffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS

VAD node @ 0x815e8410 Start 0x00f00000 End 0x00f01fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815e8440 Segment e160a650
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e160a688 Last contiguous PTE: e160a68c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816c36b8 Start 0x00f10000 End 0x00f4ffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81668a58 Start 0x00fa0000 End 0x00fdffff Tag Vadl
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, ReadOnly: 1

VAD node @ 0x816c3658 Start 0x00f60000 End 0x00f9ffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81675738 Start 0x00fe0000 End 0x00fe0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81675610 Start 0x00ff0000 End 0x00ff2fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @815e8590 Segment e1b01cc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1b01cf8 Last contiguous PTE: e1b01d00
Flags2: Inherit: 1

VAD node @ 0x816755b0 Start 0x017b0000 End 0x017b5fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815e8710 Segment e15ffaf8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          3
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e15ffb30 Last contiguous PTE: e15ffb44
Flags2: Inherit: 1

VAD node @ 0x8163e410 Start 0x01660000 End 0x0169ffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815e8830 Start 0x01100000 End 0x0165ffff Tag Vad 
Flags: ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fcd10 Segment e153e000
NumberOfSectionReferences:          0 NumberOfPfnReferences:          36
NumberOfMappedViews:               11 NumberOfUserReferences:         11
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a6f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\xpsp2res.dll
First prototype PTE: e153e038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81675718 Start 0x01720000 End 0x0179ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8163e210 Start 0x016e0000 End 0x0171ffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81646270 Start 0x016b0000 End 0x016b0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8162bd48 Start 0x016a0000 End 0x016a0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81691c28 Start 0x016c0000 End 0x016c0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815fcc78 Start 0x016d0000 End 0x016d0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81675478 Start 0x017a0000 End 0x017a7fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @816c5438 Segment e14ca930
NumberOfSectionReferences:          1 NumberOfPfnReferences:           1
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816c53c0, Name: \Device\HarddiskVolume1\Documents and Settings\testuser\Application Data\Microsoft\IMJP8_1\imjp81u.dic
First prototype PTE: e150f480 Last contiguous PTE: e150f49c
Flags2: Inherit: 1

VAD node @ 0x816755e0 Start 0x017d0000 End 0x01896fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816d6938 Segment e14af610
NumberOfSectionReferences:          0 NumberOfPfnReferences:          51
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816d68c0, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpgn.grm
First prototype PTE: e14fd7a8 Last contiguous PTE: e14fdac0
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x816754d8 Start 0x017c0000 End 0x017c2fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815e8590 Segment e1b01cc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1b01cf8 Last contiguous PTE: e1b01d00
Flags2: Inherit: 1

VAD node @ 0x816754a8 Start 0x018a0000 End 0x0199ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81675508 Segment e19d4580
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e19d45b8 Last contiguous PTE: e19d49b4
Flags2: Inherit: 1

VAD node @ 0x81675320 Start 0x031b0000 End 0x031bbfff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816d5c10 Segment e14b2dc8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816d5b98, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpch.dic
First prototype PTE: e1501fa8 Last contiguous PTE: e1501fd4
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x81675350 Start 0x030e0000 End 0x031aefff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816d5e20 Segment e14b2ea8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816d5da8, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjptk.dic
First prototype PTE: e14fd460 Last contiguous PTE: e14fd798
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x81675380 Start 0x027b0000 End 0x030d4fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816d5008 Segment e14ad350
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816d5f90, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpzp.dic
First prototype PTE: e1506000 Last contiguous PTE: e1508490
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x81675270 Start 0x03bf0000 End 0x03ce0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816d5830 Segment e14b2c08
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816d57b8, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpln.dic
First prototype PTE: e150c008 Last contiguous PTE: e150c3c8
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x816752f0 Start 0x031c0000 End 0x03be8fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816d5a00 Segment e14b2ce8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816d5988, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpnm.dic
First prototype PTE: e1509000 Last contiguous PTE: e150b8a0
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x81675240 Start 0x03cf0000 End 0x03d0ffff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816d5620 Segment e14b2b28
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816d55a8, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpsb.dic
First prototype PTE: e1501f20 Last contiguous PTE: e1501f9c
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x815f5ec8 Start 0x03d50000 End 0x03d52fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815e8590 Segment e1b01cc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1b01cf8 Last contiguous PTE: e1b01d00
Flags2: Inherit: 1

VAD node @ 0x815f5ef8 Start 0x03d40000 End 0x03d45fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815e8710 Segment e15ffaf8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          3
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e15ffb30 Last contiguous PTE: e15ffb44
Flags2: Inherit: 1

VAD node @ 0x81675778 Start 0x03d30000 End 0x03d30fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815f5fb0 Segment e1b274b8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1b274f0 Last contiguous PTE: e1b274f0
Flags2: Inherit: 1

VAD node @ 0x815f5df8 Start 0x03d80000 End 0x03d80fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815f5e98 Start 0x03d60000 End 0x03d60fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815f5f28 Segment e1805360
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1805398 Last contiguous PTE: e1805398
Flags2: Inherit: 1

VAD node @ 0x8161ff88 Start 0x03d70000 End 0x03d70fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815f5e78 Start 0x03d90000 End 0x03e8ffff Tag VadS
Flags: CommitCharge: 248, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8162be28 Start 0x03f00000 End 0x03f00fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81572950 Segment e17af9b0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17af9e8 Last contiguous PTE: e17af9e8
Flags2: Inherit: 1

VAD node @ 0x8162c798 Start 0x03ef0000 End 0x03ef1fff Tag Vadl
Flags: CommitCharge: 2, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816138c8 Start 0x03eb0000 End 0x03eeffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8162c758 Start 0x03f10000 End 0x03f10fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815f3928 Start 0x03f40000 End 0x03f41fff Tag Vadl
Flags: CommitCharge: 2, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81682ac0 Start 0x03f20000 End 0x03f20fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8161ff48 Start 0x03f30000 End 0x03f30fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816243a8 Start 0x03f90000 End 0x03f93fff Tag Vadl
Flags: CommitCharge: 4, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81624428 Start 0x03f70000 End 0x03f70fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617050 Start 0x03f60000 End 0x03f60fff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81574cb0 Start 0x03f80000 End 0x03f81fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815e3848 Segment e19a01b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e19a01f0 Last contiguous PTE: e19a01f4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81792ed8 Start 0x03fb0000 End 0x040affff Tag VadS
Flags: CommitCharge: 11, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81624368 Start 0x03fa0000 End 0x03fa3fff Tag Vadl
Flags: CommitCharge: 4, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816f6818 Start 0x040b0000 End 0x04b40fff Tag Vad 
Flags: CommitCharge: 841, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689008 Segment e152f000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         894
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d2d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\ieframe.dll
First prototype PTE: e152f038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816a4608 Start 0x04d00000 End 0x04d24fff Tag Vadl
Flags: CommitCharge: 37, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81650758 Start 0x04b60000 End 0x04c82fff Tag Vad 
Flags: CommitCharge: 291, Protection: 5
Protection: PAGE_WRITECOPY
ControlArea @816b61d8 Segment e14e0688
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816b6160, Name: \Device\HarddiskVolume1\WINDOWS\system32\ja-jp\ieframe.dll.mui
First prototype PTE: e15173c0 Last contiguous PTE: e1517848
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x816a8140 Start 0x04cb0000 End 0x04cb0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815fc2c0 Start 0x04c90000 End 0x04c91fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815e4ed8 Segment e18abe88
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e18abec0 Last contiguous PTE: e18abec4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8163abd0 Start 0x04ca0000 End 0x04ca1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8169aef0 Segment e1896e50
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1896e88 Last contiguous PTE: e1896e8c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8164bb48 Start 0x04cc0000 End 0x04cc0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81682828 Start 0x04cd0000 End 0x04cd0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815d32a0 Start 0x04ce0000 End 0x04ce0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816fe008 Start 0x04cf0000 End 0x04cf1fff Tag Vadl
Flags: CommitCharge: 2, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81627f98 Start 0x04d80000 End 0x04da4fff Tag Vadl
Flags: CommitCharge: 37, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816615b8 Start 0x04d30000 End 0x04d54fff Tag Vadl
Flags: CommitCharge: 37, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8162a860 Start 0x04d70000 End 0x04d71fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81678b48 Segment e16059d0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1605a08 Last contiguous PTE: e1605a0c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816065a0 Start 0x04d60000 End 0x04d6ffff Tag VadS
Flags: CommitCharge: 12, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81647dd8 Start 0x04e60000 End 0x04e9cfff Tag Vad 
Flags: CommitCharge: 41, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @815d6a00 Segment e1922d20
NumberOfSectionReferences:          0 NumberOfPfnReferences:          51
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @81590bf8, Name: \Device\HarddiskVolume1\WINDOWS\system32\webcheck.dll
First prototype PTE: e1922d58 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8166a768 Start 0x04e20000 End 0x04e5ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81709110 Segment e15fc008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e15fc040 Last contiguous PTE: e15fc13c
Flags2: Inherit: 1

VAD node @ 0x8169b8c0 Start 0x04df0000 End 0x04df0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816991a0 Start 0x04de0000 End 0x04de7fff Tag Vad 
Flags: CommitCharge: 8, Protection: 5
Protection: PAGE_WRITECOPY
ControlArea @816997e0 Segment e111c530
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1
FileObject @8173e808, Name: \Device\HarddiskVolume1\WINDOWS\system32\ja-jp\urlmon.dll.mui
First prototype PTE: e11aa9c8 Last contiguous PTE: e11aa9e4
Flags2: CopyOnWrite: 1, Inherit: 1

VAD node @ 0x816031d0 Start 0x04e10000 End 0x04e10fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81565288 Start 0x04e00000 End 0x04e0ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815def98 Start 0x04f20000 End 0x04f21fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815de978 Segment e1b67438
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1b67470 Last contiguous PTE: e1b67474
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x817d42f0 Start 0x04ef0000 End 0x04ef7fff Tag Vadl
Flags: CommitCharge: 8, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81698c00 Start 0x04ee0000 End 0x04ee0fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81590b80 Segment e17c0dd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17c0e10 Last contiguous PTE: e17c0e10
Flags2: Inherit: 1

VAD node @ 0x816994e0 Start 0x04f10000 End 0x04f10fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817373c0 Start 0x04f00000 End 0x04f0ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8166ec40 Start 0x04f30000 End 0x04f31fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8161bc48 Segment e13506a0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e13506d8 Last contiguous PTE: e13506dc
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81705258 Start 0x04f40000 End 0x04f7ffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8156fc50 Start 0x055e0000 End 0x055e1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816987a0 Segment e18b0148
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e18b0180 Last contiguous PTE: e18b0184
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81678260 Start 0x05400000 End 0x0543ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815fc3f0 Start 0x05000000 End 0x053fffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @816f6848 Segment e1048000
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1048038 Last contiguous PTE: e1049034
Flags2: Inherit: 1

VAD node @ 0x81613d00 Start 0x04fc0000 End 0x04ffffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81666150 Start 0x05500000 End 0x0557ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815d3008 Segment e1143008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1143040 Last contiguous PTE: e114323c
Flags2: Inherit: 1

VAD node @ 0x816fa0c8 Start 0x05440000 End 0x0547ffff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @81694718 Segment e1a72d20
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a72d58 Last contiguous PTE: e1a72e54
Flags2: Inherit: 1

VAD node @ 0x81682fa0 Start 0x05480000 End 0x054fffff Tag Vadl
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815d3008 Segment e1143008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1143040 Last contiguous PTE: e114323c
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x81699db8 Start 0x055b0000 End 0x055b7fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81699de8 Segment e11a4498
NumberOfSectionReferences:          1 NumberOfPfnReferences:           8
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: File: 1, HadUserReference: 1
FileObject @816118a0, Name: \Device\HarddiskVolume1\Documents and Settings\testuser\Cookies\index.dat
First prototype PTE: e11a53f8 Last contiguous PTE: e11a5414
Flags2: Inherit: 1

VAD node @ 0x815f2ee0 Start 0x055a0000 End 0x055a2fff Tag Vadl
Flags: CommitCharge: 3, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81618718 Start 0x05580000 End 0x05580fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816693c8 Start 0x05590000 End 0x05590fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81699a58 Start 0x055c0000 End 0x055cbfff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81699a88 Segment e11a8fd0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           8
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: File: 1, HadUserReference: 1
FileObject @81783638, Name: \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\History\History.IE5\index.dat
First prototype PTE: e11a6838 Last contiguous PTE: e11a6864
Flags2: Inherit: 1

VAD node @ 0x81564748 Start 0x055d0000 End 0x055d0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815646b8 Start 0x05720000 End 0x05753fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81699f78 Segment e1194560
NumberOfSectionReferences:          1 NumberOfPfnReferences:          16
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: File: 1, HadUserReference: 1
FileObject @81610980, Name: \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\Temporary Internet Files\Content.IE5\index.dat
First prototype PTE: e11a78b0 Last contiguous PTE: e11a797c
Flags2: Inherit: 1

VAD node @ 0x81564410 Start 0x056e0000 End 0x0571ffff Tag Vadl
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1

VAD node @ 0x81560398 Start 0x05640000 End 0x056bffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815d3008 Segment e1143008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1143040 Last contiguous PTE: e114323c
Flags2: Inherit: 1

VAD node @ 0x816ee810 Start 0x05610000 End 0x05610fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81737400 Start 0x05620000 End 0x05620fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8161f8f8 Start 0x05630000 End 0x05630fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8155e5c8 Start 0x056c0000 End 0x056c0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81613b60 Start 0x056d0000 End 0x056d0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81699e80 Start 0x057e0000 End 0x059dffff Tag VadS
Flags: CommitCharge: 121, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81564548 Start 0x05760000 End 0x057dffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815614c8 Segment e11a91f0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          3
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e11a9228 Last contiguous PTE: e11a9424
Flags2: Inherit: 1

VAD node @ 0x81699ed0 Start 0x059e0000 End 0x05a5ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815614c8 Segment e11a91f0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          3
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e11a9228 Last contiguous PTE: e11a9424
Flags2: Inherit: 1

VAD node @ 0x81565810 Start 0x05b30000 End 0x05b3ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815658f8 Start 0x05af0000 End 0x05afbfff Tag VadS
Flags: CommitCharge: 12, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81699220 Start 0x05aa0000 End 0x05adffff Tag VadS
Flags: CommitCharge: 15, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8166a5b8 Start 0x05ae0000 End 0x05ae1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81565a90 Segment e11a8440
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e11a8478 Last contiguous PTE: e11a847c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81565880 Start 0x05b10000 End 0x05b10fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815658a0 Start 0x05b00000 End 0x05b0ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81565830 Start 0x05b20000 End 0x05b2ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737fc8 Start 0x05b60000 End 0x05b6ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737fe8 Start 0x05b50000 End 0x05b5ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815657f0 Start 0x05b40000 End 0x05b4ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737f88 Start 0x05b80000 End 0x05b80fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737fa8 Start 0x05b70000 End 0x05b7ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737980 Start 0x05b90000 End 0x05b9bfff Tag VadS
Flags: CommitCharge: 12, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737868 Start 0x05bd0000 End 0x05bdffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737888 Start 0x05bc0000 End 0x05bcffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737908 Start 0x05bb0000 End 0x05bb0fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737828 Start 0x05bf0000 End 0x05bfffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737848 Start 0x05be0000 End 0x05beffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817373e0 Start 0x05d70000 End 0x05d7ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8155ff98 Start 0x05cf0000 End 0x05d2ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8155ffb8 Start 0x05cb0000 End 0x05ceffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817377b8 Start 0x05c70000 End 0x05caffff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81613ae0 Start 0x05c10000 End 0x05c25fff Tag Vadl
Flags: CommitCharge: 22, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8155ff78 Start 0x05d30000 End 0x05d6ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8158edd8 Start 0x05d90000 End 0x05d90fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, MultipleSecured: 1

VAD node @ 0x81564d88 Start 0x05d80000 End 0x05d8ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817d28a8 Start 0x05da0000 End 0x05da0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, MultipleSecured: 1

VAD node @ 0x817d2158 Start 0x05e00000 End 0x05efffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815d3770 Start 0x05df0000 End 0x05df0fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815922f0 Segment e10f7670
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10f76a8 Last contiguous PTE: e10f76a8
Flags2: Inherit: 1

VAD node @ 0x8179c0d8 Start 0x05f20000 End 0x05f9ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81737068 Segment e11c2d10
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          3
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e11c2d48 Last contiguous PTE: e11c2f44
Flags2: Inherit: 1

VAD node @ 0x815d3740 Start 0x05f10000 End 0x05f10fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @816205e8 Segment e1be0c78
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1be0cb0 Last contiguous PTE: e1be0cb0
Flags2: Inherit: 1

VAD node @ 0x8178a640 Start 0x05fa0000 End 0x0601ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81737068 Segment e11c2d10
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          3
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e11c2d48 Last contiguous PTE: e11c2f44
Flags2: Inherit: 1

VAD node @ 0x8169c228 Start 0x1a400000 End 0x1a531fff Tag Vad 
Flags: CommitCharge: 13, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168d008 Segment e1529ac8
NumberOfSectionReferences:          1 NumberOfPfnReferences:         119
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817048b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\urlmon.dll
First prototype PTE: e1529b00 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81737380 Start 0x06040000 End 0x06040fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, MultipleSecured: 1

VAD node @ 0x815d3710 Start 0x06030000 End 0x06030fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817d4fb0 Segment e1142a68
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1142aa0 Last contiguous PTE: e1142aa0
Flags2: Inherit: 1

VAD node @ 0x8167e758 Start 0x060f0000 End 0x061effff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8156bc40 Start 0x06050000 End 0x06050fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817370c0 Segment e116ffc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e116fff8 Last contiguous PTE: e116fff8
Flags2: Inherit: 1

VAD node @ 0x816139a0 Start 0x06060000 End 0x06060fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8156bbe8 Segment e116fc78
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e116fcb0 Last contiguous PTE: e116fcb0
Flags2: Inherit: 1

VAD node @ 0x817d3c68 Start 0x06070000 End 0x06070fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81613948 Segment e114eeb8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e114eef0 Last contiguous PTE: e114eef0
Flags2: Inherit: 1

VAD node @ 0x817d3be0 Start 0x06080000 End 0x06080fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817d3c10 Segment e103a498
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e103a4d0 Last contiguous PTE: e103a4d0
Flags2: Inherit: 1

VAD node @ 0x817d3b58 Start 0x06090000 End 0x06090fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817d3b88 Segment e11be310
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e11be348 Last contiguous PTE: e11be348
Flags2: Inherit: 1

VAD node @ 0x817d3ad0 Start 0x060a0000 End 0x060a0fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817d3b00 Segment e1187908
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1187940 Last contiguous PTE: e1187940
Flags2: Inherit: 1

VAD node @ 0x817d3a48 Start 0x060b0000 End 0x060b0fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817d3a78 Segment e1bde310
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1bde348 Last contiguous PTE: e1bde348
Flags2: Inherit: 1

VAD node @ 0x8155ed08 Start 0x060c0000 End 0x060c0fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8155ed38 Segment e11756f8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1175730 Last contiguous PTE: e1175730
Flags2: Inherit: 1

VAD node @ 0x8155ec80 Start 0x060d0000 End 0x060d0fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8155ecb0 Segment e17d7310
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17d7348 Last contiguous PTE: e17d7348
Flags2: Inherit: 1

VAD node @ 0x8155ebf8 Start 0x060e0000 End 0x060e0fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8155ec28 Segment e17ae868
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17ae8a0 Last contiguous PTE: e17ae8a0
Flags2: Inherit: 1

VAD node @ 0x816e7318 Start 0x061f0000 End 0x06248fff Tag Vadl
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @81737700 Segment e1172200
NumberOfSectionReferences:          0 NumberOfPfnReferences:          48
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @8173e028, Name: \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna\Shell\NormalColor\shellstyle.dll
First prototype PTE: e1174008 Last contiguous PTE: e1174168
Flags2: CopyOnWrite: 1, Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x815f5d68 Start 0x06250000 End 0x06250fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, MultipleSecured: 1

VAD node @ 0x816135d8 Start 0x06260000 End 0x06260fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, MultipleSecured: 1

VAD node @ 0x8169c288 Start 0x59250000 End 0x592a4fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816db1d8 Segment e1534008
NumberOfSectionReferences:          0 NumberOfPfnReferences:          35
NumberOfMappedViews:                9 NumberOfUserReferences:          9
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aa750, Name: \Device\HarddiskVolume1\WINDOWS\system32\netapi32.dll
First prototype PTE: e1534040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655c70 Start 0x58730000 End 0x58767fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816aea30 Segment e1538678
NumberOfSectionReferences:          0 NumberOfPfnReferences:          49
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81697028, Name: \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
First prototype PTE: e15386b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655f48 Start 0x567f0000 End 0x569b9fff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fe3d0 Segment e15396b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          28
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81668d00, Name: \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
First prototype PTE: e15396f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816c3bc8 Start 0x4edc0000 End 0x4ee15fff Tag Vadl
Flags: CommitCharge: 29, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166c1d8 Segment e1535c28
NumberOfSectionReferences:          0 NumberOfPfnReferences:          70
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab338, Name: \Device\HarddiskVolume1\WINDOWS\system32\imjp81.ime
First prototype PTE: e1535c60 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x816751e0 Start 0x3b100000 End 0x3b11afff Tag Vad 
Flags: CommitCharge: 21, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f5ec0 Segment e1540ea8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816728d8, Name: \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpcd.dic
First prototype PTE: e1540ee0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8155ff48 Start 0x1f840000 End 0x1f856fff Tag Vad 
Flags: ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816abf50 Segment e15350f8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           3
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab6f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\odbcint.dll
First prototype PTE: e1535130 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f5f80 Start 0x42e00000 End 0x42e09fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81652008 Segment e1543d60
NumberOfSectionReferences:          0 NumberOfPfnReferences:           7
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81671130, Name: \Device\HarddiskVolume1\WINDOWS\system32\dot3api.dll
First prototype PTE: e1543d98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81615f30 Start 0x4d550000 End 0x4d577fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816d69a8 Segment e1545548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           7
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81640138, Name: \Device\HarddiskVolume1\WINDOWS\system32\onex.dll
First prototype PTE: e1545580 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8160df98 Start 0x4a830000 End 0x4a851fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81634008 Segment e15453c8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          12
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81634148, Name: \Device\HarddiskVolume1\WINDOWS\system32\eappcfg.dll
First prototype PTE: e1545400 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81639ac8 Start 0x46110000 End 0x4611dfff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816d8ef0 Segment e1545298
NumberOfSectionReferences:          0 NumberOfPfnReferences:          10
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816d8e78, Name: \Device\HarddiskVolume1\WINDOWS\system32\eappprxy.dll
First prototype PTE: e15452d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e8968 Start 0x59020000 End 0x5908efff Tag Vad 
Flags: CommitCharge: 19, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167b850 Segment e15487a0
NumberOfSectionReferences:          0 NumberOfPfnReferences:          38
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167b7d8, Name: \Device\HarddiskVolume1\WINDOWS\system32\themeui.dll
First prototype PTE: e15487d8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81608440 Start 0x7c800000 End 0x7c932fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b3008 Segment e1528798
NumberOfSectionReferences:          1 NumberOfPfnReferences:         102
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702818, Name: \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
First prototype PTE: e15287d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169ce28 Start 0x75410000 End 0x75484fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81676008 Segment e1544008
NumberOfSectionReferences:          0 NumberOfPfnReferences:          11
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81684130, Name: \Device\HarddiskVolume1\WINDOWS\system32\cryptui.dll
First prototype PTE: e1544040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81615f00 Start 0x71b40000 End 0x71b52fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816be978 Segment e1536258
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816b1848, Name: \Device\HarddiskVolume1\WINDOWS\system32\samlib.dll
First prototype PTE: e1536290 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169cb88 Start 0x63000000 End 0x630e5fff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f7080 Segment e15296b8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          50
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81708340, Name: \Device\HarddiskVolume1\WINDOWS\system32\wininet.dll
First prototype PTE: e15296f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655fd8 Start 0x5dca0000 End 0x5de87fff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f42c0 Segment e152e008
NumberOfSectionReferences:          1 NumberOfPfnReferences:         118
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170bce8, Name: \Device\HarddiskVolume1\WINDOWS\system32\iertutil.dll
First prototype PTE: e152e040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655fa8 Start 0x5a620000 End 0x5a645fff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165f008 Segment e1536528
NumberOfSectionReferences:          0 NumberOfPfnReferences:          17
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aff28, Name: \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
First prototype PTE: e1536560 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e5298 Start 0x5ab60000 End 0x5abf9fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163ca68 Segment e152aa70
NumberOfSectionReferences:          1 NumberOfPfnReferences:          52
NumberOfMappedViews:               11 NumberOfUserReferences:         12
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705428, Name: \Device\HarddiskVolume1\WINDOWS\system32\comctl32.dll
First prototype PTE: e152aaa8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8162c868 Start 0x5d960000 End 0x5d992fff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167e008 Segment e154d600
NumberOfSectionReferences:          0 NumberOfPfnReferences:          39
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167e118, Name: \Device\HarddiskVolume1\WINDOWS\system32\msutb.dll
First prototype PTE: e154d638 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x81655c40 Start 0x60740000 End 0x60748fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163d008 Segment e1532570
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81707920, Name: \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
First prototype PTE: e15325a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816c3918 Start 0x648f0000 End 0x649bffff Tag Vad 
Flags: CommitCharge: 21, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fedc8 Segment e153a008
NumberOfSectionReferences:          0 NumberOfPfnReferences:          84
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816d6d68, Name: \Device\HarddiskVolume1\WINDOWS\system32\imjp81k.dll
First prototype PTE: e153a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81661120 Start 0x719e0000 End 0x719f6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816bbec8 Segment e13ccc68
NumberOfSectionReferences:          0 NumberOfPfnReferences:          15
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aabd0, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2_32.dll
First prototype PTE: e13ccca0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81642270 Start 0x719d0000 End 0x719d7fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ddcd0 Segment e1533550
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aac90, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2help.dll
First prototype PTE: e1533588 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169ceb8 Start 0x71600000 End 0x7160ffff Tag Vad 
Flags: ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81611b78 Segment e118ae10
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @815e3518, Name: \Device\HarddiskVolume1\WINDOWS\system32\browselc.dll
First prototype PTE: e118ae48 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81699530 Start 0x6c330000 End 0x6c37cfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166d7e0 Segment e153d008
NumberOfSectionReferences:          0 NumberOfPfnReferences:          51
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8168ef90, Name: \Device\HarddiskVolume1\WINDOWS\system32\duser.dll
First prototype PTE: e153d040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8163bc88 Start 0x6cdf0000 End 0x6cf61fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81739cb8 Segment e11759c8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          10
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @81675c08, Name: \Device\HarddiskVolume1\WINDOWS\system32\diskcopy.dll
First prototype PTE: e1175a00 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81608dd0 Start 0x71a50000 End 0x71a61fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81651008 Segment e1525f48
NumberOfSectionReferences:          1 NumberOfPfnReferences:          13
NumberOfMappedViews:                3 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170abe8, Name: \Device\HarddiskVolume1\WINDOWS\system32\mpr.dll
First prototype PTE: e1525f80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655c10 Start 0x73f80000 End 0x73feafff Tag Vad 
Flags: CommitCharge: 17, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e008 Segment e1532350
NumberOfSectionReferences:          0 NumberOfPfnReferences:          43
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81703d28, Name: \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
First prototype PTE: e1532388 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816c39d8 Start 0x73620000 End 0x7364dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81653290 Segment e1538338
NumberOfSectionReferences:          0 NumberOfPfnReferences:          19
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816d6e00, Name: \Device\HarddiskVolume1\WINDOWS\system32\msctfime.ime
First prototype PTE: e1538370 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81577e10 Start 0x71c90000 End 0x71caafff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b1978 Segment e154c810
NumberOfSectionReferences:          0 NumberOfPfnReferences:          21
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816b1a90, Name: \Device\HarddiskVolume1\WINDOWS\system32\actxprxy.dll
First prototype PTE: e154c848 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815dee70 Start 0x71b60000 End 0x71b6dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f7590 Segment e15a08a0
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @816167c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntlanman.dll
First prototype PTE: e15a08d8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815de948 Start 0x71c20000 End 0x71c34fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81698410 Segment e1ad0da8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          20
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @8162bef8, Name: \Device\HarddiskVolume1\WINDOWS\system32\netui0.dll
First prototype PTE: e1ad0de0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816ad720 Start 0x71be0000 End 0x71c1ffff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f76c8 Segment e1a096d0
NumberOfSectionReferences:          0 NumberOfPfnReferences:          35
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @815ddae0, Name: \Device\HarddiskVolume1\WINDOWS\system32\netui1.dll
First prototype PTE: e1a09708 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8165b578 Start 0x71bd0000 End 0x71bd6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81637c70 Segment e1a6a5b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f56e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\netrap.dll
First prototype PTE: e1a6a5f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8155f008 Start 0x73520000 End 0x7355cfff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168ed78 Segment e1535578
NumberOfSectionReferences:          0 NumberOfPfnReferences:          23
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab4b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\odbc32.dll
First prototype PTE: e15355b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81646dc0 Start 0x74660000 End 0x746abfff Tag Vadl
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b4008 Segment e1538110
NumberOfSectionReferences:          0 NumberOfPfnReferences:          71
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81784480, Name: \Device\HarddiskVolume1\WINDOWS\system32\msctf.dll
First prototype PTE: e1538148 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x816593f8 Start 0x74cd0000 End 0x74d60fff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81678958 Segment e10236d0
NumberOfSectionReferences:          0 NumberOfPfnReferences:          33
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @815d6900, Name: \Device\HarddiskVolume1\WINDOWS\system32\mlang.dll
First prototype PTE: e1023708 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8158fbd8 Start 0x74a30000 End 0x74a39fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81791d98 Segment e19efec8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @815d4f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\batmeter.dll
First prototype PTE: e19eff00 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81685fd8 Start 0x74a10000 End 0x74a17fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81637008 Segment e15435f8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81637130, Name: \Device\HarddiskVolume1\WINDOWS\system32\powrprof.dll
First prototype PTE: e1543630 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169cca0 Start 0x75ed0000 End 0x75fccfff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816744a8 Segment e1548008
NumberOfSectionReferences:          0 NumberOfPfnReferences:         130
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81674430, Name: \Device\HarddiskVolume1\WINDOWS\system32\browseui.dll
First prototype PTE: e1548040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815ddcc8 Start 0x75aa0000 End 0x75abffff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f6a40 Segment e1023390
NumberOfSectionReferences:          0 NumberOfPfnReferences:          22
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @817839b0, Name: \Device\HarddiskVolume1\WINDOWS\system32\stobject.dll
First prototype PTE: e10233c8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x817375e0 Start 0x758b0000 End 0x759a3fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81647008 Segment e1535760
NumberOfSectionReferences:          0 NumberOfPfnReferences:          59
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab3f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msgina.dll
First prototype PTE: e1535798 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815ded18 Start 0x75eb0000 End 0x75eb6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165cbb8 Segment e17af070
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @8158c710, Name: \Device\HarddiskVolume1\WINDOWS\system32\drprov.dll
First prototype PTE: e17af0a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81634928 Start 0x75ec0000 End 0x75ec9fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81604ab0 Segment e19efe28
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @81694be8, Name: \Device\HarddiskVolume1\WINDOWS\system32\davclnt.dll
First prototype PTE: e19efe60 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169cd30 Start 0x77d80000 End 0x77e28fff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689128 Segment e15272d8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          71
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
First prototype PTE: e1527310 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655b90 Start 0x77cf0000 End 0x77d7ffff Tag Vadl
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745d50 Segment e152ad50
NumberOfSectionReferences:          1 NumberOfPfnReferences:          99
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81745b58, Name: \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
First prototype PTE: e152ad88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x8169cf78 Start 0x77bc0000 End 0x77c17fff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81672248 Segment e152a648
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               16 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705680, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
First prototype PTE: e152a680 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169cf48 Start 0x76970000 End 0x76aacfff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e858 Segment e1528230
NumberOfSectionReferences:          1 NumberOfPfnReferences:         155
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702648, Name: \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
First prototype PTE: e1528268 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169ce88 Start 0x765c0000 End 0x76653fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f008 Segment e152ec80
NumberOfSectionReferences:          0 NumberOfPfnReferences:          52
NumberOfMappedViews:                8 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a85d8, Name: \Device\HarddiskVolume1\WINDOWS\system32\crypt32.dll
First prototype PTE: e152ecb8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655e58 Start 0x762e0000 End 0x762fcfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f4f30 Segment e151cb60
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aad50, Name: \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
First prototype PTE: e151cb98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e8560 Start 0x762d0000 End 0x762d4fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168ee98 Segment e153b0b0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           3
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8168ed00, Name: \Device\HarddiskVolume1\WINDOWS\system32\msimg32.dll
First prototype PTE: e153b0e8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81624588 Start 0x76040000 End 0x76198fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f2008 Segment e15347e0
NumberOfSectionReferences:          0 NumberOfPfnReferences:          31
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aa990, Name: \Device\HarddiskVolume1\WINDOWS\system32\setupapi.dll
First prototype PTE: e1534818 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81573938 Start 0x75fd0000 End 0x76034fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168eae8 Segment e1537560
NumberOfSectionReferences:          0 NumberOfPfnReferences:          23
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ae538, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcp60.dll
First prototype PTE: e1537598 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815fc2f0 Start 0x762b0000 End 0x762bffff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816db880 Segment e15346a8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aaa50, Name: \Device\HarddiskVolume1\WINDOWS\system32\winsta.dll
First prototype PTE: e15346e0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e8b18 Start 0x76570000 End 0x765bffff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81677008 Segment e1543710
NumberOfSectionReferences:          0 NumberOfPfnReferences:           7
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8163a130, Name: \Device\HarddiskVolume1\WINDOWS\system32\cscui.dll
First prototype PTE: e1543748 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e8ae8 Start 0x76550000 End 0x7656bfff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167f008 Segment e1541e10
NumberOfSectionReferences:          0 NumberOfPfnReferences:           7
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81641eb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\cscdll.dll
First prototype PTE: e1541e48 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8155ffd8 Start 0x76300000 End 0x76347fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816de008 Segment e1528e70
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:                2 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702d88, Name: \Device\HarddiskVolume1\WINDOWS\system32\comdlg32.dll
First prototype PTE: e1528ea8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e02b8 Start 0x76940000 End 0x76963fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ec3f8 Segment e154ef00
NumberOfSectionReferences:          0 NumberOfPfnReferences:          17
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81701688, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntshrui.dll
First prototype PTE: e154ef38 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169cee8 Start 0x770d0000 End 0x7715afff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e5c8 Segment e1529008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          64
NumberOfMappedViews:               14 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702478, Name: \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
First prototype PTE: e1529040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655d30 Start 0x76be0000 End 0x76c0dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e1528 Segment e15344f8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aab10, Name: \Device\HarddiskVolume1\WINDOWS\system32\wintrust.dll
First prototype PTE: e1534530 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655f18 Start 0x76af0000 End 0x76b1afff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81697f30 Segment e1539598
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817d9110, Name: \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
First prototype PTE: e15395d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8158fef0 Start 0x76ad0000 End 0x76ae0fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81649008 Segment e1543f50
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81649130, Name: \Device\HarddiskVolume1\WINDOWS\system32\atl.dll
First prototype PTE: e1543f88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e9e50 Start 0x76bb0000 End 0x76bddfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81640008 Segment e1545770
NumberOfSectionReferences:          0 NumberOfPfnReferences:          12
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81695140, Name: \Device\HarddiskVolume1\WINDOWS\system32\credui.dll
First prototype PTE: e15457a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655d00 Start 0x76c40000 End 0x76c67fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816c8008 Segment e15271c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817029e8, Name: \Device\HarddiskVolume1\WINDOWS\system32\imagehlp.dll
First prototype PTE: e15271f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655cd0 Start 0x76f10000 End 0x76f3bfff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779540 Segment e1526248
NumberOfSectionReferences:          1 NumberOfPfnReferences:           7
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705988, Name: \Device\HarddiskVolume1\WINDOWS\system32\wldap32.dll
First prototype PTE: e1526280 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169c4e0 Start 0x76d90000 End 0x76db1fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168a008 Segment e15294b8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          14
NumberOfMappedViews:                4 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81706cb0, Name: \Device\HarddiskVolume1\WINDOWS\system32\apphelp.dll
First prototype PTE: e15294f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81689560 Start 0x76d10000 End 0x76d28fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166ae98 Segment e13cc880
NumberOfSectionReferences:          0 NumberOfPfnReferences:          16
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167ef90, Name: \Device\HarddiskVolume1\WINDOWS\system32\iphlpapi.dll
First prototype PTE: e13cc8b8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816f4178 Start 0x76f00000 End 0x76f07fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163de98 Segment e153a6c0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           7
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81671f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\wtsapi32.dll
First prototype PTE: e153a6f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8168a900 Start 0x76e30000 End 0x76e3dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f6008 Segment e1541200
NumberOfSectionReferences:          0 NumberOfPfnReferences:           7
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f6130, Name: \Device\HarddiskVolume1\WINDOWS\system32\rtutils.dll
First prototype PTE: e1541238 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816c3948 Start 0x76f80000 End 0x76ffefff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164af30 Segment e1540bb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          32
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f5e48, Name: \Device\HarddiskVolume1\WINDOWS\system32\clbcatq.dll
First prototype PTE: e1540bf0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816c3eb8 Start 0x77000000 End 0x770aafff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f970 Segment e153c818
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8164f8f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\comres.dll
First prototype PTE: e153c850 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169c2b8 Start 0x77bb0000 End 0x77bb7fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817ad830 Segment e1524358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81704f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\version.dll
First prototype PTE: e1524390 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655ee8 Start 0x77b90000 End 0x77ba4fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ae7d0 Segment e1525d48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f96f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
First prototype PTE: e1525d80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816c37e8 Start 0x77160000 End 0x77262fff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x8169ce58 Start 0x77c40000 End 0x77c51fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168f008 Segment e152eb40
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                8 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a94f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msasn1.dll
First prototype PTE: e152eb78 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169cd00 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169ccd0 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169cfd8 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169cf18 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81608258 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816757a8 Start 0x7ffad000 End 0x7ffadfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 81675620 Last contiguous PTE: 81779ab8
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816084a0 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x81566878 Start 0x7e740000 End 0x7e8b0fff Tag Vadl
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816704f8 Segment e15489d0
NumberOfSectionReferences:          0 NumberOfPfnReferences:         149
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81670480, Name: \Device\HarddiskVolume1\WINDOWS\system32\shdocvw.dll
First prototype PTE: e1548a08 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x8169ac38 Start 0x7d5b0000 End 0x7ddaffff Tag Vadl
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x816fc3f0 Start 0x7d1d0000 End 0x7d1d5fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816d6a80 Segment e1545660
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81680130, Name: \Device\HarddiskVolume1\WINDOWS\system32\dot3dlg.dll
First prototype PTE: e1545698 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8165b680 Start 0x7e1e0000 End 0x7e37bfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81695008 Segment e1545920
NumberOfSectionReferences:          0 NumberOfPfnReferences:          62
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81638138, Name: \Device\HarddiskVolume1\WINDOWS\system32\netshell.dll
First prototype PTE: e1545958 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81655eb8 Start 0x7e8c0000 End 0x7e970fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b008 Segment e1532008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          31
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d5e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
First prototype PTE: e1532040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f5950 Start 0x7ffac000 End 0x7ffacfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 006e0061 Last contiguous PTE: 00200064
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815d4e18 Start 0x7ffa8000 End 0x7ffa8fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000a00
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8164dd48 Start 0x7ffa7000 End 0x7ffa7fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x817d6670 Start 0x7ffa5000 End 0x7ffa5fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00001000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8178a998 Start 0x7ffab000 End 0x7ffabfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 01000010 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81608228 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8163e310 Start 0x7ffaf000 End 0x7ffaffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: e152f164 Last contiguous PTE: e152f168
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816001b0 Start 0x7ffae000 End 0x7ffaefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81694278 Start 0x7ffdb000 End 0x7ffdbfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816467b8 Start 0x7ffda000 End 0x7ffdafff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 20000010 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8161a7c8 Start 0x7ffdf000 End 0x7ffdffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81655b10 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 01000010 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815e8880 Start 0x7ffdd000 End 0x7ffddfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816c3678 Start 0x7ffdc000 End 0x7ffdcfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:    196
VAD node @ 0x81694940 Start 0x5a620000 End 0x5a645fff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165f008 Segment e1536528
NumberOfSectionReferences:          0 NumberOfPfnReferences:          17
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aff28, Name: \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
First prototype PTE: e1536560 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816886c8 Start 0x00400000 End 0x00405fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d4850 Segment e10279b0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817d2c00, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctfmon.exe
First prototype PTE: e10279e8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816fded0 Start 0x000a0000 End 0x0019ffff Tag VadS
Flags: CommitCharge: 16, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815dab30 Start 0x00020000 End 0x00020fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815da708 Start 0x00010000 End 0x00010fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815daf00 Start 0x00080000 End 0x00082fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816489a8 Segment e1a71630
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a71668 Last contiguous PTE: e1a71670
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8161e0b8 Start 0x00040000 End 0x0007ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161e418 Start 0x00030000 End 0x0003ffff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816a4b20 Start 0x00090000 End 0x00091fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815dedc8 Segment e1041e60
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1041e98 Last contiguous PTE: e1041e9c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81791eb0 Start 0x001e0000 End 0x00220fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec940 Segment e1488f28
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec8c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
First prototype PTE: e14edef8 Last contiguous PTE: e14edff8
Flags2: CopyOnWrite: 1

VAD node @ 0x8156c5e0 Start 0x001b0000 End 0x001bffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815f3288 Segment e168c368
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e168c3a0 Last contiguous PTE: e168c3dc
Flags2: 

VAD node @ 0x8179c410 Start 0x001a0000 End 0x001affff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81791ee0 Start 0x001c0000 End 0x001d5fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ecb10 Segment e1486358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816eca98, Name: \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
First prototype PTE: e14ec890 Last contiguous PTE: e14ec8e4
Flags2: CopyOnWrite: 1

VAD node @ 0x816636d0 Start 0x00290000 End 0x002d0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816c9288 Segment e156c810
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e156c848 Last contiguous PTE: e156c948
Flags2: 

VAD node @ 0x81646e68 Start 0x00280000 End 0x00285fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec730 Segment e1488e48
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec6b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
First prototype PTE: e1350a60 Last contiguous PTE: e1350a74
Flags2: CopyOnWrite: 1

VAD node @ 0x81646e98 Start 0x00230000 End 0x00270fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec338 Segment e1488d68
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec2c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
First prototype PTE: e14ec780 Last contiguous PTE: e14ec880
Flags2: CopyOnWrite: 1

VAD node @ 0x81703690 Start 0x002f0000 End 0x002fffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8167be68 Start 0x002e0000 End 0x002effff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815ed380 Start 0x00310000 End 0x0034ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8173c1c8 Start 0x00300000 End 0x00302fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e5d40 Segment e14914c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           3
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816e5cc8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
First prototype PTE: e14ed7e8 Last contiguous PTE: e14ed7f0
Flags2: CopyOnWrite: 1

VAD node @ 0x81615d48 Start 0x00360000 End 0x00360fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816fe370 Start 0x00350000 End 0x0035ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8163c5d0 Start 0x00370000 End 0x00370fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x817d46a0 Start 0x00380000 End 0x00380fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81572950 Segment e17af9b0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17af9e8 Last contiguous PTE: e17af9e8
Flags2: Inherit: 1

VAD node @ 0x8156c638 Start 0x00390000 End 0x00391fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815f2218 Segment e1067190
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10671c8 Last contiguous PTE: e10671cc
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8156c728 Start 0x003b0000 End 0x003b1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81620988 Segment e14959e8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1495a20 Last contiguous PTE: e1495a24
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8173e438 Start 0x003a0000 End 0x003a1fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8173e468 Segment e17d64c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17d6500 Last contiguous PTE: e17d6504
Flags2: Inherit: 1

VAD node @ 0x8161d098 Start 0x003c0000 End 0x003fffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81709110 Segment e15fc008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e15fc040 Last contiguous PTE: e15fc13c
Flags2: Inherit: 1

VAD node @ 0x81739980 Start 0x00980000 End 0x0098dfff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @816bf270 Segment e16137a0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                6 NumberOfUserReferences:          7
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e16137d8 Last contiguous PTE: e161380c
Flags2: Inherit: 1

VAD node @ 0x8164ac90 Start 0x005f0000 End 0x008effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c1ac8 Segment e17e4008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                9 NumberOfUserReferences:         10
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e17e4040 Last contiguous PTE: e17e4c3c
Flags2: SecNoChange: 1

VAD node @ 0x81646e08 Start 0x00410000 End 0x004d7fff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816caf88 Segment e1565730
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1565768 Last contiguous PTE: e1565a84
Flags2: SecNoChange: 1

VAD node @ 0x8163a540 Start 0x004e0000 End 0x005e2fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816ce008 Segment e1566008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1566040 Last contiguous PTE: e1566448
Flags2: SecNoChange: 1

VAD node @ 0x816105d0 Start 0x00940000 End 0x0097ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81610a88 Segment e1ac1008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1ac1040 Last contiguous PTE: e1ac113c
Flags2: Inherit: 1

VAD node @ 0x815dabd0 Start 0x008f0000 End 0x0093ffff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @81601550 Segment e146baf0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e146bb28 Last contiguous PTE: e146bc64
Flags2: Inherit: 1

VAD node @ 0x81647d38 Start 0x567f0000 End 0x569b9fff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fe3d0 Segment e15396b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          28
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81668d00, Name: \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
First prototype PTE: e15396f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161e440 Start 0x009b0000 End 0x009cffff Tag VadS
Flags: CommitCharge: 23, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81616590 Start 0x00990000 End 0x0099ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81653de0 Start 0x009a0000 End 0x009affff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8163e230 Start 0x4edc0000 End 0x4ee15fff Tag Vadl
Flags: CommitCharge: 29, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166c1d8 Segment e1535c28
NumberOfSectionReferences:          0 NumberOfPfnReferences:          70
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab338, Name: \Device\HarddiskVolume1\WINDOWS\system32\imjp81.ime
First prototype PTE: e1535c60 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x8173e1c0 Start 0x009e0000 End 0x009effff Tag VadS
Flags: CommitCharge: 16, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817c87e8 Start 0x009d0000 End 0x009dffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816277b0 Start 0x009f0000 End 0x009fffff Tag VadS
Flags: CommitCharge: 7, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815daf68 Start 0x00a00000 End 0x00a00fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8156b2f0 Start 0x00a10000 End 0x00a20fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e8ac0 Segment e148b6c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          17
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, WasPurged: 1
FileObject @816e8e70, Name: \Device\HarddiskVolume1\WINDOWS\system32\c_1252.nls
First prototype PTE: e14e2358 Last contiguous PTE: e14e2398
Flags2: CopyOnWrite: 1

VAD node @ 0x81601040 Start 0x00a30000 End 0x00a4ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816174a8 Start 0x00a50000 End 0x00a50fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815d43e0 Start 0x00a60000 End 0x00a60fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816943b0 Start 0x58730000 End 0x58767fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816aea30 Segment e1538678
NumberOfSectionReferences:          0 NumberOfPfnReferences:          49
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81697028, Name: \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
First prototype PTE: e15386b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815d6558 Start 0x7c800000 End 0x7c932fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b3008 Segment e1528798
NumberOfSectionReferences:          1 NumberOfPfnReferences:         102
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702818, Name: \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
First prototype PTE: e15287d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81591bb8 Start 0x74660000 End 0x746abfff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b4008 Segment e1538110
NumberOfSectionReferences:          0 NumberOfPfnReferences:          71
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81784480, Name: \Device\HarddiskVolume1\WINDOWS\system32\msctf.dll
First prototype PTE: e1538148 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817822b0 Start 0x5d960000 End 0x5d992fff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167e008 Segment e154d600
NumberOfSectionReferences:          0 NumberOfPfnReferences:          39
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167e118, Name: \Device\HarddiskVolume1\WINDOWS\system32\msutb.dll
First prototype PTE: e154d638 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x81641d88 Start 0x60740000 End 0x60748fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163d008 Segment e1532570
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81707920, Name: \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
First prototype PTE: e15325a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8163ab20 Start 0x73f80000 End 0x73feafff Tag Vad 
Flags: CommitCharge: 16, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e008 Segment e1532350
NumberOfSectionReferences:          0 NumberOfPfnReferences:          43
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81703d28, Name: \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
First prototype PTE: e1532388 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817399b0 Start 0x73620000 End 0x7364dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81653290 Segment e1538338
NumberOfSectionReferences:          0 NumberOfPfnReferences:          19
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816d6e00, Name: \Device\HarddiskVolume1\WINDOWS\system32\msctfime.ime
First prototype PTE: e1538370 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816a7a18 Start 0x648f0000 End 0x649bffff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fedc8 Segment e153a008
NumberOfSectionReferences:          0 NumberOfPfnReferences:          84
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816d6d68, Name: \Device\HarddiskVolume1\WINDOWS\system32\imjp81k.dll
First prototype PTE: e153a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8156ca18 Start 0x77bc0000 End 0x77c17fff Tag Vad 
Flags: CommitCharge: 7, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81672248 Segment e152a648
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               16 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705680, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
First prototype PTE: e152a680 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161d368 Start 0x76af0000 End 0x76b1afff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81697f30 Segment e1539598
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817d9110, Name: \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
First prototype PTE: e15395d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81591dc8 Start 0x76970000 End 0x76aacfff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e858 Segment e1528230
NumberOfSectionReferences:          1 NumberOfPfnReferences:         155
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702648, Name: \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
First prototype PTE: e1528268 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d92e8 Start 0x762e0000 End 0x762fcfff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f4f30 Segment e151cb60
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aad50, Name: \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
First prototype PTE: e151cb98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815dbb18 Start 0x770d0000 End 0x7715afff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e5c8 Segment e1529008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          64
NumberOfMappedViews:               14 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702478, Name: \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
First prototype PTE: e1529040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815da4a0 Start 0x77b90000 End 0x77ba4fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ae7d0 Segment e1525d48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f96f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
First prototype PTE: e1525d80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8163aaf0 Start 0x77160000 End 0x77262fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8158fc38 Start 0x77bb0000 End 0x77bb7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817ad830 Segment e1524358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81704f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\version.dll
First prototype PTE: e1524390 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81569318 Start 0x77d80000 End 0x77e28fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689128 Segment e15272d8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          71
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
First prototype PTE: e1527310 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816c3ee8 Start 0x77cf0000 End 0x77d7ffff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745d50 Segment e152ad50
NumberOfSectionReferences:          1 NumberOfPfnReferences:          99
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81745b58, Name: \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
First prototype PTE: e152ad88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x815692e8 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815692b8 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8156c3a8 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81692770 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815fd3b8 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815fd598 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81604740 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x816661b0 Start 0x7d5b0000 End 0x7ddaffff Tag Vad 
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81704c78 Start 0x7e8c0000 End 0x7e970fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b008 Segment e1532008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          31
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d5e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
First prototype PTE: e1532040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161fec8 Start 0x7ffdd000 End 0x7ffddfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81663c60 Start 0x7ffdf000 End 0x7ffdffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000001 Last contiguous PTE: 81619da8
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:    212
VAD node @ 0x81611428 Start 0x01960000 End 0x0196ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x817383b0 Start 0x018d0000 End 0x018dffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x8156bf78 Start 0x017a0000 End 0x0189ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81789148 Segment e1110bc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1110bf8 Last contiguous PTE: e1110ff4
Flags2: Inherit: 1

VAD node @ 0x8160f298 Start 0x01610000 End 0x0161ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x816f3690 Start 0x015c0000 End 0x015cffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x81792c28 Start 0x00b80000 End 0x00b8ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81604438 Start 0x00b00000 End 0x00b17fff Tag VadS
Flags: CommitCharge: 24, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81604820 Start 0x00a90000 End 0x00a9ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81682b70 Start 0x008b0000 End 0x008effff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81688848 Start 0x00400000 End 0x0041cfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @815e39f0 Segment e1884e28
NumberOfSectionReferences:          2 NumberOfPfnReferences:          25
NumberOfMappedViews:                2 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167ea50, Name: \Device\HarddiskVolume1\WINDOWS\system32\wuauclt.exe
First prototype PTE: e1884e60 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81646388 Start 0x00020000 End 0x00020fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81617350 Start 0x00010000 End 0x00010fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81603698 Start 0x00080000 End 0x00082fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816489a8 Segment e1a71630
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a71668 Last contiguous PTE: e1a71670
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81617488 Start 0x00040000 End 0x0007ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817d2138 Start 0x00030000 End 0x0003ffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81617a58 Start 0x000a0000 End 0x0019ffff Tag Vadl
Flags: CommitCharge: 49, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, ReadOnly: 1

VAD node @ 0x81646e38 Start 0x00090000 End 0x00091fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8163c4e0 Segment e1466648
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1466680 Last contiguous PTE: e1466684
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81604280 Start 0x001b0000 End 0x001bffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815ddd38 Segment e181f158
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e181f190 Last contiguous PTE: e181f1cc
Flags2: 

VAD node @ 0x8161e9d0 Start 0x001a0000 End 0x001affff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8178c128 Start 0x001e0000 End 0x00220fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec940 Segment e1488f28
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec8c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
First prototype PTE: e14edef8 Last contiguous PTE: e14edff8
Flags2: CopyOnWrite: 1

VAD node @ 0x8161d428 Start 0x001c0000 End 0x001d5fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ecb10 Segment e1486358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816eca98, Name: \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
First prototype PTE: e14ec890 Last contiguous PTE: e14ec8e4
Flags2: CopyOnWrite: 1

VAD node @ 0x8178c0c8 Start 0x00280000 End 0x00285fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec730 Segment e1488e48
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec6b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
First prototype PTE: e1350a60 Last contiguous PTE: e1350a74
Flags2: CopyOnWrite: 1

VAD node @ 0x8178c0f8 Start 0x00230000 End 0x00270fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec338 Segment e1488d68
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec2c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
First prototype PTE: e14ec780 Last contiguous PTE: e14ec880
Flags2: CopyOnWrite: 1

VAD node @ 0x81641e48 Start 0x00290000 End 0x002d0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816c9288 Segment e156c810
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e156c848 Last contiguous PTE: e156c948
Flags2: 

VAD node @ 0x81569288 Start 0x002e0000 End 0x002e1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81668428 Segment e18637a8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e18637e0 Last contiguous PTE: e18637e4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8169b8a0 Start 0x002f0000 End 0x002fffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815dafa8 Start 0x00300000 End 0x0030ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161d3c8 Start 0x00310000 End 0x00312fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e5d40 Segment e14914c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           3
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816e5cc8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
First prototype PTE: e14ed7e8 Last contiguous PTE: e14ed7f0
Flags2: CopyOnWrite: 1

VAD node @ 0x816042e8 Start 0x00320000 End 0x0035ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817da5b8 Start 0x00370000 End 0x003effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @8165a9d8 Segment e1564910
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1564948 Last contiguous PTE: e1564b44
Flags2: SecNoChange: 1

VAD node @ 0x815d3380 Start 0x00360000 End 0x0036ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816178b8 Start 0x003f0000 End 0x003f0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816177e8 Start 0x00600000 End 0x00600fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81789040 Start 0x00420000 End 0x004e7fff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816caf88 Segment e1565730
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1565768 Last contiguous PTE: e1565a84
Flags2: SecNoChange: 1

VAD node @ 0x817d55e8 Start 0x004f0000 End 0x005f2fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816ce008 Segment e1566008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1566040 Last contiguous PTE: e1566448
Flags2: SecNoChange: 1

VAD node @ 0x8169bc70 Start 0x00630000 End 0x0082ffff Tag VadS
Flags: CommitCharge: 512, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81610848 Start 0x00620000 End 0x00621fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817d7f70 Segment e15e7fb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e15e7ff0 Last contiguous PTE: e15e7ff4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81603e70 Start 0x00610000 End 0x00611fff Tag VadS
Flags: CommitCharge: 2, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81682870 Start 0x00870000 End 0x008affff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816827a0 Start 0x00830000 End 0x0086ffff Tag VadS
Flags: CommitCharge: 54, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81604ed8 Start 0x00a50000 End 0x00a67fff Tag VadS
Flags: CommitCharge: 24, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81682c40 Start 0x00930000 End 0x00a2ffff Tag VadS
Flags: CommitCharge: 256, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81682b08 Start 0x008f0000 End 0x0092ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81604f40 Start 0x00a30000 End 0x00a47fff Tag VadS
Flags: CommitCharge: 24, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81604920 Start 0x00a80000 End 0x00a80fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81604988 Start 0x00a70000 End 0x00a7ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8179c1e8 Start 0x00ad0000 End 0x00adffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81618678 Start 0x00ab0000 End 0x00abffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816047b8 Start 0x00aa0000 End 0x00aaffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81618610 Start 0x00ac0000 End 0x00acffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816044a0 Start 0x00af0000 End 0x00af1fff Tag VadS
Flags: CommitCharge: 2, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8179c180 Start 0x00ae0000 End 0x00aeffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81791f58 Start 0x00b50000 End 0x00b5ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81603b98 Start 0x00b30000 End 0x00b30fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81603c00 Start 0x00b20000 End 0x00b2ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81791fc0 Start 0x00b40000 End 0x00b4ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81792f40 Start 0x00b70000 End 0x00b7ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81792fa8 Start 0x00b60000 End 0x00b6ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815da500 Start 0x01580000 End 0x0158ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x8158ec88 Start 0x014f0000 End 0x014fffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS

VAD node @ 0x815dfcc8 Start 0x00b90000 End 0x00f8ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817c7f10 Segment e1102000
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1102038 Last contiguous PTE: e1103034
Flags2: Inherit: 1

VAD node @ 0x815f2fa8 Start 0x00f90000 End 0x014effff Tag Vad 
Flags: ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fcd10 Segment e153e000
NumberOfSectionReferences:          0 NumberOfPfnReferences:          36
NumberOfMappedViews:               11 NumberOfUserReferences:         11
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a6f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\xpsp2res.dll
First prototype PTE: e153e038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8163dce8 Start 0x01540000 End 0x0157ffff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816a7c18 Start 0x01500000 End 0x0153ffff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8167d7d0 Start 0x015a0000 End 0x015affff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x81591f18 Start 0x01590000 End 0x0159ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x81627b68 Start 0x015b0000 End 0x015bffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x815f2748 Start 0x015f0000 End 0x015fffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x816b0c68 Start 0x015e0000 End 0x015effff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x8166f008 Start 0x015d0000 End 0x015dffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x816b1b10 Start 0x01600000 End 0x0160ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x815df288 Start 0x01790000 End 0x01791fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8160f908 Segment e146fc10
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e146fc48 Last contiguous PTE: e146fc4c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x817439e8 Start 0x01650000 End 0x0165ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x8160f2f8 Start 0x01630000 End 0x0163ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x8160f2c8 Start 0x01620000 End 0x0162ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x815da2e0 Start 0x01640000 End 0x0164ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x816543e0 Start 0x01670000 End 0x0167ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x817d7a40 Start 0x01660000 End 0x0166ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8167beb8 Segment e1104708
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1104740 Last contiguous PTE: e110477c
Flags2: Inherit: 1

VAD node @ 0x816f8e40 Start 0x01690000 End 0x01690fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8163e270 Start 0x01680000 End 0x0168ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816bc4f8 Start 0x016e0000 End 0x0171ffff Tag VadS
Flags: CommitCharge: 17, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817d4830 Start 0x016a0000 End 0x016dffff Tag VadS
Flags: CommitCharge: 17, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8156b840 Start 0x01720000 End 0x01720fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81613f40 Segment e111b808
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e111b840 Last contiguous PTE: e111b840
Flags2: Inherit: 1

VAD node @ 0x8163d8c8 Start 0x01730000 End 0x0176ffff Tag VadS
Flags: CommitCharge: 17, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8164ac70 Start 0x01770000 End 0x01771fff Tag VadS
Flags: CommitCharge: 2, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8173ba20 Start 0x01780000 End 0x01780fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817384a0 Start 0x018b0000 End 0x018bffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81738440 Start 0x018a0000 End 0x018affff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x817383e0 Start 0x018c0000 End 0x018cffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81738cd0 Start 0x01910000 End 0x0191ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81738d30 Start 0x018f0000 End 0x018fffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81738d60 Start 0x018e0000 End 0x018effff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81738d00 Start 0x01900000 End 0x0190ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81738c40 Start 0x01940000 End 0x0194ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81738c70 Start 0x01930000 End 0x0193ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81738ca0 Start 0x01920000 End 0x0192ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81738c10 Start 0x01950000 End 0x0195ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81646250 Start 0x02aa0000 End 0x02b9ffff Tag VadS
Flags: PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8168b860 Start 0x019a0000 End 0x019dffff Tag VadS
Flags: CommitCharge: 64, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816113c8 Start 0x01980000 End 0x0198ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x816113f8 Start 0x01970000 End 0x0197ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x81611398 Start 0x01990000 End 0x0199ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815df508 Segment e110a548
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e110a580 Last contiguous PTE: e110a5bc
Flags2: Inherit: 1

VAD node @ 0x815d3590 Start 0x029e0000 End 0x02a5ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815d35c0 Segment e10fcdc0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e10fcdf8 Last contiguous PTE: e10fcff4
Flags2: Inherit: 1

VAD node @ 0x81611fd8 Start 0x019e0000 End 0x029dffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815d3618 Segment e112a000
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e112a038 Last contiguous PTE: e112e034
Flags2: Inherit: 1

VAD node @ 0x816430f0 Start 0x02a60000 End 0x02a9ffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81789c78 Start 0x4a5a0000 End 0x4a5f8fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81691100 Segment e154cbf8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          35
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8163c028, Name: \Device\HarddiskVolume1\WINDOWS\system32\winhttp.dll
First prototype PTE: e154cc30 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815629d0 Start 0x02ba0000 End 0x02baffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817d23f0 Segment e114b7e0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e114b818 Last contiguous PTE: e114b854
Flags2: Inherit: 1

VAD node @ 0x815e45d8 Start 0x02bb0000 End 0x02bbffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817d23f0 Segment e114b7e0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e114b818 Last contiguous PTE: e114b854
Flags2: Inherit: 1

VAD node @ 0x8165c560 Start 0x02bc0000 End 0x02bc2fff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815db668 Start 0x02bd0000 End 0x02be8fff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8162c638 Start 0x02bf0000 End 0x02bfefff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81668968 Start 0x02c00000 End 0x02c17fff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816038b0 Start 0x02c20000 End 0x02c22fff Tag VadS
Flags: PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8163b688 Start 0x02c30000 End 0x02c73fff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815df580 Start 0x02c80000 End 0x02c80fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816a42f8 Start 0x02c90000 End 0x02c90fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81561ad8 Start 0x02ca0000 End 0x02cdffff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8178ca78 Start 0x75090000 End 0x750a2fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816900f8 Segment e154b0e8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167d028, Name: \Device\HarddiskVolume1\WINDOWS\system32\cabinet.dll
First prototype PTE: e154b120 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816dc6c0 Start 0x50040000 End 0x50158fff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816940d8 Segment e154b3d8
NumberOfSectionReferences:          0 NumberOfPfnReferences:         133
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81694028, Name: \Device\HarddiskVolume1\WINDOWS\system32\wuaueng.dll
First prototype PTE: e154b410 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d4700 Start 0x50940000 End 0x50969fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f7800 Segment e1a656d8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          16
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8173b7c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\wuaucpl.cpl
First prototype PTE: e1a65710 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81682550 Start 0x50640000 End 0x5064bfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b0708 Segment e1b7c568
NumberOfSectionReferences:          0 NumberOfPfnReferences:          11
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81628e00, Name: \Device\HarddiskVolume1\WINDOWS\system32\wups.dll
First prototype PTE: e1b7c5a0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816dc690 Start 0x65000000 End 0x6502dfff Tag Vad 
Flags: CommitCharge: 15, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816790f8 Segment e154b228
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81690028, Name: \Device\HarddiskVolume1\WINDOWS\system32\advpack.dll
First prototype PTE: e154b260 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178c9b8 Start 0x5ddf0000 End 0x5ddfafff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167d100 Segment e154cf68
NumberOfSectionReferences:          0 NumberOfPfnReferences:          10
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8166a028, Name: \Device\HarddiskVolume1\WINDOWS\system32\mspatcha.dll
First prototype PTE: e154cfa0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789be8 Start 0x59250000 End 0x592a4fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816db1d8 Segment e1534008
NumberOfSectionReferences:          0 NumberOfPfnReferences:          35
NumberOfMappedViews:                9 NumberOfUserReferences:          9
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aa750, Name: \Device\HarddiskVolume1\WINDOWS\system32\netapi32.dll
First prototype PTE: e1534040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817895a0 Start 0x567f0000 End 0x569b9fff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fe3d0 Segment e15396b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          28
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81668d00, Name: \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
First prototype PTE: e15396f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789510 Start 0x58730000 End 0x58767fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816aea30 Segment e1538678
NumberOfSectionReferences:          0 NumberOfPfnReferences:          49
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81697028, Name: \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
First prototype PTE: e15386b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817899b0 Start 0x5a620000 End 0x5a645fff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165f008 Segment e1536528
NumberOfSectionReferences:          0 NumberOfPfnReferences:          17
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aff28, Name: \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
First prototype PTE: e1536560 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789600 Start 0x60740000 End 0x60748fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163d008 Segment e1532570
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81707920, Name: \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
First prototype PTE: e15325a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789aa0 Start 0x719e0000 End 0x719f6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816bbec8 Segment e13ccc68
NumberOfSectionReferences:          0 NumberOfPfnReferences:          15
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aabd0, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2_32.dll
First prototype PTE: e13ccca0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178c9e8 Start 0x6f850000 End 0x6f958fff Tag Vad 
Flags: CommitCharge: 10, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163a008 Segment e15438c8
NumberOfSectionReferences:          0 NumberOfPfnReferences:         163
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81677130, Name: \Device\HarddiskVolume1\WINDOWS\system32\esent.dll
First prototype PTE: e1543900 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d46d0 Start 0x719d0000 End 0x719d7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ddcd0 Segment e1533550
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aac90, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2help.dll
First prototype PTE: e1533588 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789c48 Start 0x72f50000 End 0x72f75fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81675008 Segment e1541a08
NumberOfSectionReferences:          0 NumberOfPfnReferences:          10
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81675130, Name: \Device\HarddiskVolume1\WINDOWS\system32\winspool.drv
First prototype PTE: e1541a40 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815fcb90 Start 0x73f80000 End 0x73feafff Tag Vad 
Flags: CommitCharge: 16, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e008 Segment e1532350
NumberOfSectionReferences:          0 NumberOfPfnReferences:          43
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81703d28, Name: \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
First prototype PTE: e1532388 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816042b0 Start 0x7c800000 End 0x7c932fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b3008 Segment e1528798
NumberOfSectionReferences:          1 NumberOfPfnReferences:         102
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702818, Name: \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
First prototype PTE: e15287d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f30d8 Start 0x76ad0000 End 0x76ae0fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81649008 Segment e1543f50
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81649130, Name: \Device\HarddiskVolume1\WINDOWS\system32\atl.dll
First prototype PTE: e1543f88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d4760 Start 0x76970000 End 0x76aacfff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e858 Segment e1528230
NumberOfSectionReferences:          1 NumberOfPfnReferences:         155
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702648, Name: \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
First prototype PTE: e1528268 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178cb98 Start 0x76730000 End 0x76738fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166a100 Segment e154ce50
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81691028, Name: \Device\HarddiskVolume1\WINDOWS\system32\shfolder.dll
First prototype PTE: e154ce88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816dc630 Start 0x76040000 End 0x76198fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f2008 Segment e15347e0
NumberOfSectionReferences:          0 NumberOfPfnReferences:          31
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aa990, Name: \Device\HarddiskVolume1\WINDOWS\system32\setupapi.dll
First prototype PTE: e1534818 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178ca48 Start 0x765c0000 End 0x76653fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f008 Segment e152ec80
NumberOfSectionReferences:          0 NumberOfPfnReferences:          52
NumberOfMappedViews:                8 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a85d8, Name: \Device\HarddiskVolume1\WINDOWS\system32\crypt32.dll
First prototype PTE: e152ecb8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789c18 Start 0x762b0000 End 0x762bffff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816db880 Segment e15346a8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aaa50, Name: \Device\HarddiskVolume1\WINDOWS\system32\winsta.dll
First prototype PTE: e15346e0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789a40 Start 0x762d0000 End 0x762d4fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168ee98 Segment e153b0b0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           3
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8168ed00, Name: \Device\HarddiskVolume1\WINDOWS\system32\msimg32.dll
First prototype PTE: e153b0e8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d5618 Start 0x762e0000 End 0x762fcfff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f4f30 Segment e151cb60
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aad50, Name: \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
First prototype PTE: e151cb98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81641e18 Start 0x77bc0000 End 0x77c17fff Tag Vad 
Flags: CommitCharge: 7, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81672248 Segment e152a648
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               16 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705680, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
First prototype PTE: e152a680 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81620a90 Start 0x77160000 End 0x77262fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d4730 Start 0x770d0000 End 0x7715afff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e5c8 Segment e1529008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          64
NumberOfMappedViews:               14 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702478, Name: \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
First prototype PTE: e1529040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178c988 Start 0x76b60000 End 0x76b64fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165b008 Segment e1536d18
NumberOfSectionReferences:          0 NumberOfPfnReferences:           3
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ac1c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sfc.dll
First prototype PTE: e1536d50 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789570 Start 0x76af0000 End 0x76b1afff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81697f30 Segment e1539598
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817d9110, Name: \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
First prototype PTE: e15395d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178c958 Start 0x76c10000 End 0x76c38fff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165a008 Segment e1536b80
NumberOfSectionReferences:          0 NumberOfPfnReferences:          25
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ac7b0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sfc_os.dll
First prototype PTE: e1536bb8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81643fd8 Start 0x76be0000 End 0x76c0dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e1528 Segment e15344f8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aab10, Name: \Device\HarddiskVolume1\WINDOWS\system32\wintrust.dll
First prototype PTE: e1534530 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789cd8 Start 0x76c40000 End 0x76c67fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816c8008 Segment e15271c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817029e8, Name: \Device\HarddiskVolume1\WINDOWS\system32\imagehlp.dll
First prototype PTE: e15271f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789a10 Start 0x76f00000 End 0x76f07fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163de98 Segment e153a6c0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           7
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81671f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\wtsapi32.dll
First prototype PTE: e153a6f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f2fd8 Start 0x76f80000 End 0x76ffefff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164af30 Segment e1540bb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          32
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f5e48, Name: \Device\HarddiskVolume1\WINDOWS\system32\clbcatq.dll
First prototype PTE: e1540bf0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81739a10 Start 0x77000000 End 0x770aafff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f970 Segment e153c818
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8164f8f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\comres.dll
First prototype PTE: e153c850 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816dc660 Start 0x77bb0000 End 0x77bb7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817ad830 Segment e1524358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81704f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\version.dll
First prototype PTE: e1524390 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789540 Start 0x77b90000 End 0x77ba4fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ae7d0 Segment e1525d48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f96f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
First prototype PTE: e1525d80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81617850 Start 0x77cf0000 End 0x77d7ffff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745d50 Segment e152ad50
NumberOfSectionReferences:          1 NumberOfPfnReferences:          99
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81745b58, Name: \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
First prototype PTE: e152ad88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x8178ca18 Start 0x77c40000 End 0x77c51fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168f008 Segment e152eb40
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                8 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a94f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msasn1.dll
First prototype PTE: e152eb78 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816ac488 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816022a0 Start 0x77d80000 End 0x77e28fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689128 Segment e15272d8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          71
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
First prototype PTE: e1527310 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816034d8 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161d760 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81620a60 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f2778 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f2610 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81604658 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x81789ca8 Start 0x7e8c0000 End 0x7e970fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b008 Segment e1532008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          31
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d5e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
First prototype PTE: e1532040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81789a70 Start 0x7d5b0000 End 0x7ddaffff Tag Vad 
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169ba40 Start 0x7ffaf000 End 0x7ffaffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816a4830 Start 0x7ffae000 End 0x7ffaefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816827c0 Start 0x7ffad000 End 0x7ffadfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00001000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81566e00 Start 0x7ffac000 End 0x7ffacfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00730069 Last contiguous PTE: 0056006b
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8163c550 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816ee5b0 Start 0x7ffdd000 End 0x7ffddfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617718 Start 0x7ffdc000 End 0x7ffdcfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81646340 Start 0x7ffdb000 End 0x7ffdbfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816f67d8 Start 0x7ffda000 End 0x7ffdafff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:    372
VAD node @ 0x817d42d0 Start 0x00190000 End 0x0019ffff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8164ae78 Start 0x00020000 End 0x00020fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81640ce0 Start 0x00010000 End 0x00010fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815d3148 Start 0x00080000 End 0x00082fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816489a8 Segment e1a71630
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a71668 Last contiguous PTE: e1a71670
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816fe518 Start 0x00040000 End 0x0007ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816468c8 Start 0x00030000 End 0x0003ffff Tag VadS
Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816172e8 Start 0x00090000 End 0x0018ffff Tag VadS
Flags: CommitCharge: 31, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8165c5b0 Start 0x01000000 End 0x0100cfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8160fd00 Segment e15fc2b0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          13
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816e32b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\alg.exe
First prototype PTE: e15fc2e8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8158ed38 Start 0x00220000 End 0x00260fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec338 Segment e1488d68
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec2c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
First prototype PTE: e14ec780 Last contiguous PTE: e14ec880
Flags2: CopyOnWrite: 1

VAD node @ 0x8163aac0 Start 0x001b0000 End 0x001c5fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ecb10 Segment e1486358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816eca98, Name: \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
First prototype PTE: e14ec890 Last contiguous PTE: e14ec8e4
Flags2: CopyOnWrite: 1

VAD node @ 0x815db788 Start 0x001a0000 End 0x001affff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817c7f68 Segment e1a4ea28
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1a4ea60 Last contiguous PTE: e1a4ea9c
Flags2: 

VAD node @ 0x8161a3f0 Start 0x001d0000 End 0x00210fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec940 Segment e1488f28
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec8c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
First prototype PTE: e14edef8 Last contiguous PTE: e14edff8
Flags2: CopyOnWrite: 1

VAD node @ 0x81654678 Start 0x00400000 End 0x0040ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8158ecd8 Start 0x00280000 End 0x002c0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816c9288 Segment e156c810
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e156c848 Last contiguous PTE: e156c948
Flags2: 

VAD node @ 0x8158ed08 Start 0x00270000 End 0x00275fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec730 Segment e1488e48
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec6b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
First prototype PTE: e1350a60 Last contiguous PTE: e1350a74
Flags2: CopyOnWrite: 1

VAD node @ 0x815f2b20 Start 0x002d0000 End 0x00397fff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816caf88 Segment e1565730
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1565768 Last contiguous PTE: e1565a84
Flags2: SecNoChange: 1

VAD node @ 0x815f5d38 Start 0x003a0000 End 0x003affff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81669a28 Start 0x003b0000 End 0x003b0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617440 Start 0x003c0000 End 0x003c0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8161de08 Start 0x003d0000 End 0x003d1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8173e3b0 Segment e1062d18
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1062d50 Last contiguous PTE: e1062d54
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x815e0060 Start 0x003f0000 End 0x003f1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81568008 Segment e10ec9c8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10eca00 Last contiguous PTE: e10eca04
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816171b0 Start 0x003e0000 End 0x003effff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815df390 Start 0x00420000 End 0x00422fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e5d40 Segment e14914c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           3
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816e5cc8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
First prototype PTE: e14ed7e8 Last contiguous PTE: e14ed7f0
Flags2: CopyOnWrite: 1

VAD node @ 0x8179c778 Start 0x00410000 End 0x0041ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815df1c8 Start 0x00470000 End 0x00572fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816ce008 Segment e1566008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1566040 Last contiguous PTE: e1566448
Flags2: SecNoChange: 1

VAD node @ 0x8179c960 Start 0x00430000 End 0x0046ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81691e30 Start 0x00600000 End 0x0063ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815df168 Start 0x00580000 End 0x005fffff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @8160d4e0 Segment e17acb60
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                4 NumberOfUserReferences:          5
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e17acb98 Last contiguous PTE: e17acd94
Flags2: SecNoChange: 1

VAD node @ 0x8173ecf0 Start 0x006a0000 End 0x006a1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815f2f20 Segment e1101ef8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1101f30 Last contiguous PTE: e1101f34
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816bdb48 Start 0x00640000 End 0x0064ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS

VAD node @ 0x816120a8 Start 0x00650000 End 0x0068ffff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8173e320 Start 0x006b0000 End 0x00c0ffff Tag Vad 
Flags: ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fcd10 Segment e153e000
NumberOfSectionReferences:          0 NumberOfPfnReferences:          36
NumberOfMappedViews:               11 NumberOfUserReferences:         11
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a6f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\xpsp2res.dll
First prototype PTE: e153e038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161c038 Start 0x00c10000 End 0x00c4ffff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8165c580 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8168b420 Start 0x7c800000 End 0x7c932fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b3008 Segment e1528798
NumberOfSectionReferences:          1 NumberOfPfnReferences:         102
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702818, Name: \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
First prototype PTE: e15287d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173e380 Start 0x77bc0000 End 0x77c17fff Tag Vad 
Flags: CommitCharge: 7, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81672248 Segment e152a648
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               16 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705680, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
First prototype PTE: e152a680 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173e350 Start 0x76ad0000 End 0x76ae0fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81649008 Segment e1543f50
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81649130, Name: \Device\HarddiskVolume1\WINDOWS\system32\atl.dll
First prototype PTE: e1543f88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815db9c8 Start 0x76970000 End 0x76aacfff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e858 Segment e1528230
NumberOfSectionReferences:          1 NumberOfPfnReferences:         155
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702648, Name: \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
First prototype PTE: e1528268 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815db968 Start 0x71a00000 End 0x71a0afff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164b360 Segment e154e410
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167c398, Name: \Device\HarddiskVolume1\WINDOWS\system32\wsock32.dll
First prototype PTE: e154e448 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815db938 Start 0x719e0000 End 0x719f6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816bbec8 Segment e13ccc68
NumberOfSectionReferences:          0 NumberOfPfnReferences:          15
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aabd0, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2_32.dll
First prototype PTE: e13ccca0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815db908 Start 0x719d0000 End 0x719d7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ddcd0 Segment e1533550
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aac90, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2help.dll
First prototype PTE: e1533588 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815db8d8 Start 0x71980000 End 0x719befff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81658f10 Segment e153c4e8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          24
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81659eb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\mswsock.dll
First prototype PTE: e153c520 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f2b50 Start 0x5a620000 End 0x5a645fff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165f008 Segment e1536528
NumberOfSectionReferences:          0 NumberOfPfnReferences:          17
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aff28, Name: \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
First prototype PTE: e1536560 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173ebb0 Start 0x567f0000 End 0x569b9fff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fe3d0 Segment e15396b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          28
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81668d00, Name: \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
First prototype PTE: e15396f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f2d30 Start 0x58730000 End 0x58767fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816aea30 Segment e1538678
NumberOfSectionReferences:          0 NumberOfPfnReferences:          49
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81697028, Name: \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
First prototype PTE: e15386b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815df1f8 Start 0x60740000 End 0x60748fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163d008 Segment e1532570
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81707920, Name: \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
First prototype PTE: e15325a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815d65b8 Start 0x5ab60000 End 0x5abf9fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163ca68 Segment e152aa70
NumberOfSectionReferences:          1 NumberOfPfnReferences:          52
NumberOfMappedViews:               11 NumberOfUserReferences:         12
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705428, Name: \Device\HarddiskVolume1\WINDOWS\system32\comctl32.dll
First prototype PTE: e152aaa8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8156bd68 Start 0x762e0000 End 0x762fcfff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f4f30 Segment e151cb60
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aad50, Name: \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
First prototype PTE: e151cb98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8156bf18 Start 0x73f80000 End 0x73feafff Tag Vad 
Flags: CommitCharge: 16, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e008 Segment e1532350
NumberOfSectionReferences:          0 NumberOfPfnReferences:          43
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81703d28, Name: \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
First prototype PTE: e1532388 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815db998 Start 0x770d0000 End 0x7715afff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e5c8 Segment e1529008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          64
NumberOfMappedViews:               14 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702478, Name: \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
First prototype PTE: e1529040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173eb80 Start 0x76af0000 End 0x76b1afff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81697f30 Segment e1539598
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817d9110, Name: \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
First prototype PTE: e15395d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81688788 Start 0x76f80000 End 0x76ffefff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164af30 Segment e1540bb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          32
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f5e48, Name: \Device\HarddiskVolume1\WINDOWS\system32\clbcatq.dll
First prototype PTE: e1540bf0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81688728 Start 0x77000000 End 0x770aafff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f970 Segment e153c818
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8164f8f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\comres.dll
First prototype PTE: e153c850 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173eb50 Start 0x77b90000 End 0x77ba4fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ae7d0 Segment e1525d48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f96f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
First prototype PTE: e1525d80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d3568 Start 0x77160000 End 0x77262fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173eb20 Start 0x77bb0000 End 0x77bb7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817ad830 Segment e1524358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81704f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\version.dll
First prototype PTE: e1524390 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81654258 Start 0x77cf0000 End 0x77d7ffff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745d50 Segment e152ad50
NumberOfSectionReferences:          1 NumberOfPfnReferences:          99
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81745b58, Name: \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
First prototype PTE: e152ad88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x8173e2f0 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173e2c0 Start 0x77d80000 End 0x77e28fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689128 Segment e15272d8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          71
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
First prototype PTE: e1527310 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173e290 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173e260 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173eac0 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815d3178 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81625868 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x8173eaf0 Start 0x7d5b0000 End 0x7ddaffff Tag Vad 
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815f2d60 Start 0x7e8c0000 End 0x7e970fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b008 Segment e1532008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          31
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d5e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
First prototype PTE: e1532040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81617920 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617780 Start 0x7ffdd000 End 0x7ffddfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000001 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816ee9e0 Start 0x7ffdc000 End 0x7ffdcfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8164bb08 Start 0x7ffdb000 End 0x7ffdbfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617510 Start 0x7ffda000 End 0x7ffdafff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:    424
VAD node @ 0x815d6d58 Start 0x002d0000 End 0x002dffff Tag VadS
Flags: CommitCharge: 5, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8162cd30 Start 0x00190000 End 0x0019ffff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815f10a0 Start 0x00030000 End 0x0006ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816d89d8 Start 0x00010000 End 0x00010fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815f20a8 Start 0x00020000 End 0x00020fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8160f328 Start 0x00080000 End 0x00081fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8158eb68 Segment e110ce98
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e110ced0 Last contiguous PTE: e110ced4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x815d6400 Start 0x00070000 End 0x00072fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816489a8 Segment e1a71630
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a71668 Last contiguous PTE: e1a71670
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81613ce0 Start 0x00090000 End 0x0018ffff Tag VadS
Flags: CommitCharge: 10, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8165e878 Start 0x00220000 End 0x00260fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec338 Segment e1488d68
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec2c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
First prototype PTE: e14ec780 Last contiguous PTE: e14ec880
Flags2: CopyOnWrite: 1

VAD node @ 0x815df100 Start 0x001b0000 End 0x001c5fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ecb10 Segment e1486358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816eca98, Name: \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
First prototype PTE: e14ec890 Last contiguous PTE: e14ec8e4
Flags2: CopyOnWrite: 1

VAD node @ 0x81739500 Start 0x001a0000 End 0x001affff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8161f158 Segment e1109098
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e11090d0 Last contiguous PTE: e110910c
Flags2: 

VAD node @ 0x815faed8 Start 0x001d0000 End 0x00210fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec940 Segment e1488f28
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec8c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
First prototype PTE: e14edef8 Last contiguous PTE: e14edff8
Flags2: CopyOnWrite: 1

VAD node @ 0x8161ddd8 Start 0x00280000 End 0x002c0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816c9288 Segment e156c810
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e156c848 Last contiguous PTE: e156c948
Flags2: 

VAD node @ 0x815d63c8 Start 0x00270000 End 0x00275fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec730 Segment e1488e48
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec6b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
First prototype PTE: e1350a60 Last contiguous PTE: e1350a74
Flags2: CopyOnWrite: 1

VAD node @ 0x816277d0 Start 0x01000000 End 0x01005fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @815f3e40 Segment e1a50a60
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8173b438, Name: \Device\HarddiskVolume1\WINDOWS\system32\wscntfy.exe
First prototype PTE: e1a50a98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e4668 Start 0x004e0000 End 0x007dffff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c1ac8 Segment e17e4008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                9 NumberOfUserReferences:         10
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e17e4040 Last contiguous PTE: e17e4c3c
Flags2: SecNoChange: 1

VAD node @ 0x81611368 Start 0x002f0000 End 0x003b7fff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816caf88 Segment e1565730
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1565768 Last contiguous PTE: e1565a84
Flags2: SecNoChange: 1

VAD node @ 0x81738410 Start 0x002e0000 End 0x002e2fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e5d40 Segment e14914c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           3
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816e5cc8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
First prototype PTE: e14ed7e8 Last contiguous PTE: e14ed7f0
Flags2: CopyOnWrite: 1

VAD node @ 0x815e46c8 Start 0x003c0000 End 0x004c2fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816ce008 Segment e1566008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1566040 Last contiguous PTE: e1566448
Flags2: SecNoChange: 1

VAD node @ 0x81612248 Start 0x004d0000 End 0x004dffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81738a08 Start 0x00810000 End 0x00811fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81567618 Segment e10ef5f8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10ef630 Last contiguous PTE: e10ef634
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81682890 Start 0x007f0000 End 0x007f0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8169bc28 Start 0x007e0000 End 0x007e0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81561978 Start 0x00800000 End 0x00800fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81572950 Segment e17af9b0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17af9e8 Last contiguous PTE: e17af9e8
Flags2: Inherit: 1

VAD node @ 0x81561408 Start 0x00d80000 End 0x00dcffff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @81601550 Segment e146baf0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e146bb28 Last contiguous PTE: e146bc64
Flags2: Inherit: 1

VAD node @ 0x81682b28 Start 0x00820000 End 0x00d7ffff Tag Vadl
Flags: ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fcd10 Segment e153e000
NumberOfSectionReferences:          0 NumberOfPfnReferences:          36
NumberOfMappedViews:               11 NumberOfUserReferences:         11
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a6f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\xpsp2res.dll
First prototype PTE: e153e038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x81561638 Start 0x00e10000 End 0x00e1dfff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @816bf270 Segment e16137a0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                6 NumberOfUserReferences:          7
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e16137d8 Last contiguous PTE: e161380c
Flags2: Inherit: 1

VAD node @ 0x81561948 Start 0x00dd0000 End 0x00e0ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81709110 Segment e15fc008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e15fc040 Last contiguous PTE: e15fc13c
Flags2: Inherit: 1

VAD node @ 0x81560f68 Start 0x00e30000 End 0x00e3ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815602c8 Start 0x00e20000 End 0x00e2ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81560f48 Start 0x00e40000 End 0x00e5ffff Tag VadS
Flags: CommitCharge: 23, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81560f28 Start 0x00e60000 End 0x00e6ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81560f08 Start 0x00e70000 End 0x00e7ffff Tag VadS
Flags: CommitCharge: 16, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81560ee8 Start 0x00e80000 End 0x00e8ffff Tag VadS
Flags: CommitCharge: 7, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161d008 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81695b50 Start 0x7c800000 End 0x7c932fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b3008 Segment e1528798
NumberOfSectionReferences:          1 NumberOfPfnReferences:         102
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702818, Name: \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
First prototype PTE: e15287d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81738898 Start 0x77bc0000 End 0x77c17fff Tag Vad 
Flags: CommitCharge: 7, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81672248 Segment e152a648
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               16 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705680, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
First prototype PTE: e152a680 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81611338 Start 0x762e0000 End 0x762fcfff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f4f30 Segment e151cb60
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aad50, Name: \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
First prototype PTE: e151cb98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815d3500 Start 0x60740000 End 0x60748fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163d008 Segment e1532570
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81707920, Name: \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
First prototype PTE: e15325a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81562d30 Start 0x01010000 End 0x01011fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81561fb0 Segment e1063538
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1063570 Last contiguous PTE: e1063574
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81562d00 Start 0x58730000 End 0x58767fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816aea30 Segment e1538678
NumberOfSectionReferences:          0 NumberOfPfnReferences:          49
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81697028, Name: \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
First prototype PTE: e15386b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81682bf8 Start 0x4edc0000 End 0x4ee15fff Tag Vadl
Flags: CommitCharge: 29, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166c1d8 Segment e1535c28
NumberOfSectionReferences:          0 NumberOfPfnReferences:          70
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab338, Name: \Device\HarddiskVolume1\WINDOWS\system32\imjp81.ime
First prototype PTE: e1535c60 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x815d34d0 Start 0x73f80000 End 0x73feafff Tag Vad 
Flags: CommitCharge: 16, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e008 Segment e1532350
NumberOfSectionReferences:          0 NumberOfPfnReferences:          43
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81703d28, Name: \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
First prototype PTE: e1532388 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81561608 Start 0x73620000 End 0x7364dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81653290 Segment e1538338
NumberOfSectionReferences:          0 NumberOfPfnReferences:          19
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816d6e00, Name: \Device\HarddiskVolume1\WINDOWS\system32\msctfime.ime
First prototype PTE: e1538370 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81560318 Start 0x648f0000 End 0x649bffff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fedc8 Segment e153a008
NumberOfSectionReferences:          0 NumberOfPfnReferences:          84
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816d6d68, Name: \Device\HarddiskVolume1\WINDOWS\system32\imjp81k.dll
First prototype PTE: e153a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815619a8 Start 0x74660000 End 0x746abfff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b4008 Segment e1538110
NumberOfSectionReferences:          0 NumberOfPfnReferences:          71
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81784480, Name: \Device\HarddiskVolume1\WINDOWS\system32\msctf.dll
First prototype PTE: e1538148 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81562570 Start 0x77160000 End 0x77262fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815615d8 Start 0x76970000 End 0x76aacfff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e858 Segment e1528230
NumberOfSectionReferences:          1 NumberOfPfnReferences:         155
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702648, Name: \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
First prototype PTE: e1528268 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8169bc90 Start 0x77cf0000 End 0x77d7ffff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745d50 Segment e152ad50
NumberOfSectionReferences:          1 NumberOfPfnReferences:          99
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81745b58, Name: \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
First prototype PTE: e152ad88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x81611700 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81612268 Start 0x77d80000 End 0x77e28fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689128 Segment e15272d8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          71
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
First prototype PTE: e1527310 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817392a8 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81739278 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81739248 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161d068 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8178c5a8 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x81612298 Start 0x7d5b0000 End 0x7ddaffff Tag Vad 
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81617238 Start 0x7ffdf000 End 0x7ffdffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81617648 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000001 Last contiguous PTE: 81617668
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:    520
VAD node @ 0x815d17b0 Start 0x00190000 End 0x0019ffff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816546d8 Start 0x00020000 End 0x00020fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81626e08 Start 0x00010000 End 0x00010fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815711c0 Start 0x00080000 End 0x00082fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816489a8 Segment e1a71630
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a71668 Last contiguous PTE: e1a71670
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x816ef248 Start 0x00040000 End 0x0007ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81739228 Start 0x00030000 End 0x0003ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81603098 Start 0x00090000 End 0x0018ffff Tag Vadl
Flags: CommitCharge: 26, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, ReadOnly: 1

VAD node @ 0x81590b40 Start 0x01000000 End 0x0100afff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81568db8 Segment e19fe598
NumberOfSectionReferences:          1 NumberOfPfnReferences:          10
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8178cef8, Name: \Device\HarddiskVolume1\WINDOWS\system32\wpabaln.exe
First prototype PTE: e19fe5d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x81611f18 Start 0x00220000 End 0x00260fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec338 Segment e1488d68
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec2c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
First prototype PTE: e14ec780 Last contiguous PTE: e14ec880
Flags2: CopyOnWrite: 1

VAD node @ 0x81611f78 Start 0x001b0000 End 0x001c5fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ecb10 Segment e1486358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816eca98, Name: \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
First prototype PTE: e14ec890 Last contiguous PTE: e14ec8e4
Flags2: CopyOnWrite: 1

VAD node @ 0x8156bae8 Start 0x001a0000 End 0x001affff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @8165a958 Segment e1110af8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1110b30 Last contiguous PTE: e1110b6c
Flags2: 

VAD node @ 0x81611f48 Start 0x001d0000 End 0x00210fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec940 Segment e1488f28
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec8c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
First prototype PTE: e14edef8 Last contiguous PTE: e14edff8
Flags2: CopyOnWrite: 1

VAD node @ 0x81611c18 Start 0x00400000 End 0x0040ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81611eb8 Start 0x00280000 End 0x002c0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816c9288 Segment e156c810
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e156c848 Last contiguous PTE: e156c948
Flags2: 

VAD node @ 0x81611ee8 Start 0x00270000 End 0x00275fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec730 Segment e1488e48
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec6b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
First prototype PTE: e1350a60 Last contiguous PTE: e1350a74
Flags2: CopyOnWrite: 1

VAD node @ 0x815d34a0 Start 0x002d0000 End 0x00397fff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816caf88 Segment e1565730
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1565768 Last contiguous PTE: e1565a84
Flags2: SecNoChange: 1

VAD node @ 0x81604608 Start 0x003a0000 End 0x003affff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161ff08 Start 0x003b0000 End 0x003b0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816829f0 Start 0x003c0000 End 0x003c0fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81738a40 Start 0x003d0000 End 0x003d1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81738a70 Segment e1054e90
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1054ec8 Last contiguous PTE: e1054ecc
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81561350 Start 0x003f0000 End 0x003f1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @81561380 Segment e10565b0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10565e8 Last contiguous PTE: e10565ec
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81627700 Start 0x003e0000 End 0x003effff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81562f48 Start 0x00420000 End 0x00422fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e5d40 Segment e14914c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           3
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816e5cc8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
First prototype PTE: e14ed7e8 Last contiguous PTE: e14ed7f0
Flags2: CopyOnWrite: 1

VAD node @ 0x8179c7e0 Start 0x00410000 End 0x0041ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815d3440 Start 0x00470000 End 0x00572fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816ce008 Segment e1566008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1566040 Last contiguous PTE: e1566448
Flags2: SecNoChange: 1

VAD node @ 0x816116e0 Start 0x00430000 End 0x0046ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81561438 Start 0x00880000 End 0x008cffff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @81601550 Segment e146baf0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e146bb28 Last contiguous PTE: e146bc64
Flags2: Inherit: 1

VAD node @ 0x81562dc0 Start 0x00580000 End 0x0087ffff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c1ac8 Segment e17e4008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                9 NumberOfUserReferences:         10
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e17e4040 Last contiguous PTE: e17e4c3c
Flags2: SecNoChange: 1

VAD node @ 0x815613d8 Start 0x00920000 End 0x00921fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @815612f8 Segment e110fb88
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e110fbc0 Last contiguous PTE: e110fbc4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81561a18 Start 0x008d0000 End 0x008d0fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81572950 Segment e17af9b0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17af9e8 Last contiguous PTE: e17af9e8
Flags2: Inherit: 1

VAD node @ 0x81561918 Start 0x008e0000 End 0x0091ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81709110 Segment e15fc008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e15fc040 Last contiguous PTE: e15fc13c
Flags2: Inherit: 1

VAD node @ 0x81560378 Start 0x00930000 End 0x0093ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS

VAD node @ 0x815e5778 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815fae48 Start 0x7c800000 End 0x7c932fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b3008 Segment e1528798
NumberOfSectionReferences:          1 NumberOfPfnReferences:         102
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702818, Name: \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
First prototype PTE: e15287d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815906b0 Start 0x77bc0000 End 0x77c17fff Tag Vad 
Flags: CommitCharge: 7, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81672248 Segment e152a648
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               16 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705680, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
First prototype PTE: e152a680 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81590590 Start 0x76970000 End 0x76aacfff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e858 Segment e1528230
NumberOfSectionReferences:          1 NumberOfPfnReferences:         155
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702648, Name: \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
First prototype PTE: e1528268 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8168a968 Start 0x5a620000 End 0x5a645fff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165f008 Segment e1536528
NumberOfSectionReferences:          0 NumberOfPfnReferences:          17
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aff28, Name: \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
First prototype PTE: e1536560 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e47a0 Start 0x567f0000 End 0x569b9fff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fe3d0 Segment e15396b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          28
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81668d00, Name: \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
First prototype PTE: e15396f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81562f78 Start 0x58730000 End 0x58767fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816aea30 Segment e1538678
NumberOfSectionReferences:          0 NumberOfPfnReferences:          49
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81697028, Name: \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
First prototype PTE: e15386b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161d730 Start 0x762e0000 End 0x762fcfff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f4f30 Segment e151cb60
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aad50, Name: \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
First prototype PTE: e151cb98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815629a0 Start 0x60740000 End 0x60748fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163d008 Segment e1532570
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81707920, Name: \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
First prototype PTE: e15325a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81620f08 Start 0x5ab60000 End 0x5abf9fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163ca68 Segment e152aa70
NumberOfSectionReferences:          1 NumberOfPfnReferences:          52
NumberOfMappedViews:               11 NumberOfUserReferences:         12
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705428, Name: \Device\HarddiskVolume1\WINDOWS\system32\comctl32.dll
First prototype PTE: e152aaa8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815d3530 Start 0x73f80000 End 0x73feafff Tag Vad 
Flags: CommitCharge: 16, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e008 Segment e1532350
NumberOfSectionReferences:          0 NumberOfPfnReferences:          43
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81703d28, Name: \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
First prototype PTE: e1532388 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81561aa0 Start 0x74660000 End 0x746abfff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b4008 Segment e1538110
NumberOfSectionReferences:          0 NumberOfPfnReferences:          71
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81784480, Name: \Device\HarddiskVolume1\WINDOWS\system32\msctf.dll
First prototype PTE: e1538148 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e4770 Start 0x76af0000 End 0x76b1afff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81697f30 Segment e1539598
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817d9110, Name: \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
First prototype PTE: e15395d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e4740 Start 0x770d0000 End 0x7715afff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e5c8 Segment e1529008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          64
NumberOfMappedViews:               14 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702478, Name: \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
First prototype PTE: e1529040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815618b8 Start 0x76f80000 End 0x76ffefff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164af30 Segment e1540bb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          32
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f5e48, Name: \Device\HarddiskVolume1\WINDOWS\system32\clbcatq.dll
First prototype PTE: e1540bf0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81561768 Start 0x77000000 End 0x770aafff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f970 Segment e153c818
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8164f8f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\comres.dll
First prototype PTE: e153c850 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e45a8 Start 0x77b90000 End 0x77ba4fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ae7d0 Segment e1525d48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f96f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
First prototype PTE: e1525d80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81620f38 Start 0x77160000 End 0x77262fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e4578 Start 0x77bb0000 End 0x77bb7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817ad830 Segment e1524358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81704f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\version.dll
First prototype PTE: e1524390 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81590680 Start 0x77d80000 End 0x77e28fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689128 Segment e15272d8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          71
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
First prototype PTE: e1527310 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81682988 Start 0x77cf0000 End 0x77d7ffff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745d50 Segment e152ad50
NumberOfSectionReferences:          1 NumberOfPfnReferences:          99
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81745b58, Name: \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
First prototype PTE: e152ad88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x81590650 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81590620 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815905c0 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817384d0 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816a7a48 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x815f2f78 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x81562fd8 Start 0x7d5b0000 End 0x7ddaffff Tag Vad 
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81562fa8 Start 0x7e8c0000 End 0x7e970fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b008 Segment e1532008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          31
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d5e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
First prototype PTE: e1532040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8170b388 Start 0x7ffdf000 End 0x7ffdffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x816462d8 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:   1144
VAD node @ 0x8161f858 Start 0x00db0000 End 0x00db0fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81612e70 Start 0x00d30000 End 0x00d3ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816698c8 Start 0x00b80000 End 0x00bbffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816c3098 Start 0x00400000 End 0x0041cfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @815e39f0 Segment e1884e28
NumberOfSectionReferences:          2 NumberOfPfnReferences:          25
NumberOfMappedViews:                2 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167ea50, Name: \Device\HarddiskVolume1\WINDOWS\system32\wuauclt.exe
First prototype PTE: e1884e60 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81737360 Start 0x000a0000 End 0x0019ffff Tag VadS
Flags: CommitCharge: 39, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81566f88 Start 0x00020000 End 0x00020fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81566f00 Start 0x00010000 End 0x00010fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81566070 Start 0x00080000 End 0x00082fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816489a8 Segment e1a71630
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                8 NumberOfUserReferences:          9
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1a71668 Last contiguous PTE: e1a71670
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81566e78 Start 0x00040000 End 0x0007ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815d4540 Start 0x00030000 End 0x0003ffff Tag VadS
Flags: CommitCharge: 10, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81616008 Start 0x00090000 End 0x00091fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8178a2b8 Segment e1892978
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e18929b0 Last contiguous PTE: e18929b4
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x8156c6f8 Start 0x001e0000 End 0x00220fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec940 Segment e1488f28
NumberOfSectionReferences:          1 NumberOfPfnReferences:           5
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec8c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
First prototype PTE: e14edef8 Last contiguous PTE: e14edff8
Flags2: CopyOnWrite: 1

VAD node @ 0x816993a8 Start 0x001b0000 End 0x001bffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @817dfeb0 Segment e117de78
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e117deb0 Last contiguous PTE: e117deec
Flags2: 

VAD node @ 0x81641978 Start 0x001a0000 End 0x001affff Tag VadS
Flags: CommitCharge: 6, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81560e50 Start 0x001c0000 End 0x001d5fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ecb10 Segment e1486358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816eca98, Name: \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
First prototype PTE: e14ec890 Last contiguous PTE: e14ec8e4
Flags2: CopyOnWrite: 1

VAD node @ 0x81699658 Start 0x00290000 End 0x002d0fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816c9288 Segment e156c810
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e156c848 Last contiguous PTE: e156c948
Flags2: 

VAD node @ 0x817376d0 Start 0x00280000 End 0x00285fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec730 Segment e1488e48
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec6b8, Name: \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
First prototype PTE: e1350a60 Last contiguous PTE: e1350a74
Flags2: CopyOnWrite: 1

VAD node @ 0x8169ac08 Start 0x00230000 End 0x00270fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816ec338 Segment e1488d68
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816ec2c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
First prototype PTE: e14ec780 Last contiguous PTE: e14ec880
Flags2: CopyOnWrite: 1

VAD node @ 0x8178a348 Start 0x002f0000 End 0x002fffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8178a530 Start 0x002e0000 End 0x002e1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817372b0 Segment e1b6b6c0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1b6b6f8 Last contiguous PTE: e1b6b6fc
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x817d57c0 Start 0x00310000 End 0x00312fff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @816e5d40 Segment e14914c8
NumberOfSectionReferences:          1 NumberOfPfnReferences:           3
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1
FileObject @816e5cc8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
First prototype PTE: e14ed7e8 Last contiguous PTE: e14ed7f0
Flags2: CopyOnWrite: 1

VAD node @ 0x8178a458 Start 0x00300000 End 0x0030ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81675c88 Start 0x00360000 End 0x0036ffff Tag VadS
Flags: CommitCharge: 8, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8178a3d0 Start 0x00320000 End 0x0035ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8173c208 Start 0x00370000 End 0x00370fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81564da8 Start 0x00380000 End 0x00380fff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x817d2b80 Start 0x003a0000 End 0x003a1fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8178a5e8 Segment e11c1a10
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e11c1a48 Last contiguous PTE: e11c1a4c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81560df0 Start 0x00390000 End 0x00391fff Tag VadS
Flags: CommitCharge: 2, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737500 Start 0x003b0000 End 0x003effff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816999d8 Start 0x003f0000 End 0x003fffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81737560 Start 0x00900000 End 0x00afffff Tag VadS
Flags: CommitCharge: 512, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81691cd8 Start 0x004f0000 End 0x005f2fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @816ce008 Segment e1566008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e1566040 Last contiguous PTE: e1566448
Flags2: SecNoChange: 1

VAD node @ 0x8173ec10 Start 0x00420000 End 0x004e7fff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816caf88 Segment e1565730
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               18 NumberOfUserReferences:         19
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e1565768 Last contiguous PTE: e1565a84
Flags2: SecNoChange: 1

VAD node @ 0x81691c78 Start 0x00600000 End 0x008fffff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c1ac8 Segment e17e4008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                9 NumberOfUserReferences:         10
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e17e4040 Last contiguous PTE: e17e4c3c
Flags2: SecNoChange: 1

VAD node @ 0x81737440 Start 0x00b40000 End 0x00b7ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817374a0 Start 0x00b00000 End 0x00b3ffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815668c0 Start 0x00d00000 End 0x00d00fff Tag VadS
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81564638 Start 0x00cc0000 End 0x00cd7fff Tag VadS
Flags: CommitCharge: 24, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81560900 Start 0x00bc0000 End 0x00cbffff Tag VadS
Flags: CommitCharge: 256, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815648c8 Start 0x00ce0000 End 0x00cf7fff Tag VadS
Flags: CommitCharge: 24, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8162c7e8 Start 0x00d20000 End 0x00d2ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81564f88 Start 0x00d10000 End 0x00d1ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161f8b8 Start 0x00d70000 End 0x00d71fff Tag VadS
Flags: CommitCharge: 2, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8173ebf0 Start 0x00d50000 End 0x00d5ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161f728 Start 0x00d40000 End 0x00d4ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161f8d8 Start 0x00d60000 End 0x00d6ffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161f878 Start 0x00da0000 End 0x00daffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161f898 Start 0x00d80000 End 0x00d97fff Tag VadS
Flags: CommitCharge: 24, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x815668e0 Start 0x4a5a0000 End 0x4a5f8fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81691100 Segment e154cbf8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          35
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8163c028, Name: \Device\HarddiskVolume1\WINDOWS\system32\winhttp.dll
First prototype PTE: e154cc30 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816202f0 Start 0x00df0000 End 0x00dfffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81620330 Start 0x00dd0000 End 0x00ddffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8161f838 Start 0x00dc0000 End 0x00dcffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81620310 Start 0x00de0000 End 0x00deffff Tag VadS
Flags: CommitCharge: 16, MemCommit: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x816996a8 Start 0x01260000 End 0x01260fff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81572950 Segment e17af9b0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17af9e8 Last contiguous PTE: e17af9e8
Flags2: Inherit: 1

VAD node @ 0x815d4e68 Start 0x00e10000 End 0x0120ffff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @815d3d68 Segment e115c000
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e115c038 Last contiguous PTE: e115d034
Flags2: Inherit: 1

VAD node @ 0x816202d0 Start 0x00e00000 End 0x00e0ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8178a478 Start 0x01210000 End 0x0125ffff Tag Vad 
Flags: Protection: 1
Protection: PAGE_READONLY
ControlArea @81601550 Segment e146baf0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e146bb28 Last contiguous PTE: e146bc64
Flags2: Inherit: 1

VAD node @ 0x8178a8f0 Start 0x01a10000 End 0x01a11fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @8178b318 Segment e17e6650
NumberOfSectionReferences:          0 NumberOfPfnReferences:           0
NumberOfMappedViews:                1 NumberOfUserReferences:          1
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e17e6688 Last contiguous PTE: e17e668c
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x817d3a28 Start 0x012b0000 End 0x012bffff Tag VadS
Flags: CommitCharge: 1, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS

VAD node @ 0x81641998 Start 0x01270000 End 0x012affff Tag Vad 
Flags: Protection: 4
Protection: PAGE_READWRITE
ControlArea @81709110 Segment e15fc008
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                5 NumberOfUserReferences:          6
Control Flags: HadUserReference: 1, Reserve: 1
First prototype PTE: e15fc040 Last contiguous PTE: e15fc13c
Flags2: Inherit: 1

VAD node @ 0x8155e668 Start 0x01820000 End 0x0185ffff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x817d4a30 Start 0x012c0000 End 0x0181ffff Tag Vad 
Flags: ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fcd10 Segment e153e000
NumberOfSectionReferences:          0 NumberOfPfnReferences:          36
NumberOfMappedViews:               11 NumberOfUserReferences:         11
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a6f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\xpsp2res.dll
First prototype PTE: e153e038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8155e648 Start 0x01860000 End 0x0189ffff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8155e608 Start 0x018a0000 End 0x018dffff Tag VadS
Flags: CommitCharge: 2, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x81736880 Start 0x018e0000 End 0x0191ffff Tag VadS
Flags: CommitCharge: 3, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE

VAD node @ 0x8178a4a8 Start 0x76ad0000 End 0x76ae0fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81649008 Segment e1543f50
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81649130, Name: \Device\HarddiskVolume1\WINDOWS\system32\atl.dll
First prototype PTE: e1543f88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81736800 Start 0x50940000 End 0x50969fff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f7800 Segment e1a656d8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          16
NumberOfMappedViews:                2 NumberOfUserReferences:          2
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8173b7c8, Name: \Device\HarddiskVolume1\WINDOWS\system32\wuaucpl.cpl
First prototype PTE: e1a65710 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x8179c0a8 Start 0x50040000 End 0x50158fff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816940d8 Segment e154b3d8
NumberOfSectionReferences:          0 NumberOfPfnReferences:         133
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81694028, Name: \Device\HarddiskVolume1\WINDOWS\system32\wuaueng.dll
First prototype PTE: e154b410 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d2bb0 Start 0x50640000 End 0x5064bfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b0708 Segment e1b7c568
NumberOfSectionReferences:          0 NumberOfPfnReferences:          11
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81628e00, Name: \Device\HarddiskVolume1\WINDOWS\system32\wups.dll
First prototype PTE: e1b7c5a0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161e158 Start 0x75090000 End 0x750a2fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816900f8 Segment e154b0e8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8167d028, Name: \Device\HarddiskVolume1\WINDOWS\system32\cabinet.dll
First prototype PTE: e154b120 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81699148 Start 0x65000000 End 0x6502dfff Tag Vad 
Flags: CommitCharge: 15, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816790f8 Segment e154b228
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81690028, Name: \Device\HarddiskVolume1\WINDOWS\system32\advpack.dll
First prototype PTE: e154b260 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816872f8 Start 0x5ddf0000 End 0x5ddfafff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167d100 Segment e154cf68
NumberOfSectionReferences:          0 NumberOfPfnReferences:          10
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8166a028, Name: \Device\HarddiskVolume1\WINDOWS\system32\mspatcha.dll
First prototype PTE: e154cfa0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8162c838 Start 0x59250000 End 0x592a4fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816db1d8 Segment e1534008
NumberOfSectionReferences:          0 NumberOfPfnReferences:          35
NumberOfMappedViews:                9 NumberOfUserReferences:          9
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aa750, Name: \Device\HarddiskVolume1\WINDOWS\system32\netapi32.dll
First prototype PTE: e1534040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81564008 Start 0x567f0000 End 0x569b9fff Tag Vad 
Flags: CommitCharge: 9, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816fe3d0 Segment e15396b8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          28
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81668d00, Name: \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
First prototype PTE: e15396f0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d57f0 Start 0x58730000 End 0x58767fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816aea30 Segment e1538678
NumberOfSectionReferences:          0 NumberOfPfnReferences:          49
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81697028, Name: \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
First prototype PTE: e15386b0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8173ec40 Start 0x5a620000 End 0x5a645fff Tag Vad 
Flags: CommitCharge: 20, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165f008 Segment e1536528
NumberOfSectionReferences:          0 NumberOfPfnReferences:          17
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aff28, Name: \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
First prototype PTE: e1536560 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81612620 Start 0x60740000 End 0x60748fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163d008 Segment e1532570
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81707920, Name: \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
First prototype PTE: e15325a8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8162c808 Start 0x719e0000 End 0x719f6fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816bbec8 Segment e13ccc68
NumberOfSectionReferences:          0 NumberOfPfnReferences:          15
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aabd0, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2_32.dll
First prototype PTE: e13ccca0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81687328 Start 0x6f850000 End 0x6f958fff Tag Vad 
Flags: CommitCharge: 10, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163a008 Segment e15438c8
NumberOfSectionReferences:          0 NumberOfPfnReferences:         163
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81677130, Name: \Device\HarddiskVolume1\WINDOWS\system32\esent.dll
First prototype PTE: e1543900 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81612ec0 Start 0x719d0000 End 0x719d7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ddcd0 Segment e1533550
NumberOfSectionReferences:          0 NumberOfPfnReferences:           6
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aac90, Name: \Device\HarddiskVolume1\WINDOWS\system32\ws2help.dll
First prototype PTE: e1533588 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81564fd8 Start 0x72f50000 End 0x72f75fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81675008 Segment e1541a08
NumberOfSectionReferences:          0 NumberOfPfnReferences:          10
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81675130, Name: \Device\HarddiskVolume1\WINDOWS\system32\winspool.drv
First prototype PTE: e1541a40 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816125f0 Start 0x73f80000 End 0x73feafff Tag Vad 
Flags: CommitCharge: 16, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e008 Segment e1532350
NumberOfSectionReferences:          0 NumberOfPfnReferences:          43
NumberOfMappedViews:               17 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81703d28, Name: \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
First prototype PTE: e1532388 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178a500 Start 0x74660000 End 0x746abfff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b4008 Segment e1538110
NumberOfSectionReferences:          0 NumberOfPfnReferences:          71
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81784480, Name: \Device\HarddiskVolume1\WINDOWS\system32\msctf.dll
First prototype PTE: e1538148 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81737610 Start 0x76970000 End 0x76aacfff Tag Vad 
Flags: CommitCharge: 8, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e858 Segment e1528230
NumberOfSectionReferences:          1 NumberOfPfnReferences:         155
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702648, Name: \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
First prototype PTE: e1528268 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815dffd8 Start 0x76730000 End 0x76738fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8166a100 Segment e154ce50
NumberOfSectionReferences:          0 NumberOfPfnReferences:           4
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81691028, Name: \Device\HarddiskVolume1\WINDOWS\system32\shfolder.dll
First prototype PTE: e154ce88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161e188 Start 0x76040000 End 0x76198fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f2008 Segment e15347e0
NumberOfSectionReferences:          0 NumberOfPfnReferences:          31
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aa990, Name: \Device\HarddiskVolume1\WINDOWS\system32\setupapi.dll
First prototype PTE: e1534818 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81564688 Start 0x765c0000 End 0x76653fff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f008 Segment e152ec80
NumberOfSectionReferences:          0 NumberOfPfnReferences:          52
NumberOfMappedViews:                8 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a85d8, Name: \Device\HarddiskVolume1\WINDOWS\system32\crypt32.dll
First prototype PTE: e152ecb8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81564fa8 Start 0x762b0000 End 0x762bffff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816db880 Segment e15346a8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aaa50, Name: \Device\HarddiskVolume1\WINDOWS\system32\winsta.dll
First prototype PTE: e15346e0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161f778 Start 0x762d0000 End 0x762d4fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168ee98 Segment e153b0b0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           3
NumberOfMappedViews:                3 NumberOfUserReferences:          3
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8168ed00, Name: \Device\HarddiskVolume1\WINDOWS\system32\msimg32.dll
First prototype PTE: e153b0e8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815e4a78 Start 0x762e0000 End 0x762fcfff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816f4f30 Segment e151cb60
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               16 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aad50, Name: \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
First prototype PTE: e151cb98 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161dfd8 Start 0x7c800000 End 0x7c932fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816b3008 Segment e1528798
NumberOfSectionReferences:          1 NumberOfPfnReferences:         102
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702818, Name: \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
First prototype PTE: e15287d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178a720 Start 0x77bc0000 End 0x77c17fff Tag Vad 
Flags: CommitCharge: 7, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81672248 Segment e152a648
NumberOfSectionReferences:          1 NumberOfPfnReferences:          65
NumberOfMappedViews:               16 NumberOfUserReferences:         17
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81705680, Name: \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
First prototype PTE: e152a680 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81627de8 Start 0x77160000 End 0x77262fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81779380 Segment e1537b88
NumberOfSectionReferences:          0 NumberOfPfnReferences:         144
NumberOfMappedViews:               15 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ab638, Name: \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
First prototype PTE: e1537bc0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81566e40 Start 0x770d0000 End 0x7715afff Tag Vad 
Flags: CommitCharge: 4, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e5c8 Segment e1529008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          64
NumberOfMappedViews:               14 NumberOfUserReferences:         15
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702478, Name: \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
First prototype PTE: e1529040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81564918 Start 0x76b60000 End 0x76b64fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165b008 Segment e1536d18
NumberOfSectionReferences:          0 NumberOfPfnReferences:           3
NumberOfMappedViews:                4 NumberOfUserReferences:          4
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ac1c0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sfc.dll
First prototype PTE: e1536d50 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81564070 Start 0x76af0000 End 0x76b1afff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81697f30 Segment e1539598
NumberOfSectionReferences:          0 NumberOfPfnReferences:          13
NumberOfMappedViews:               14 NumberOfUserReferences:         14
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817d9110, Name: \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
First prototype PTE: e15395d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x815648e8 Start 0x76c10000 End 0x76c38fff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8165a008 Segment e1536b80
NumberOfSectionReferences:          0 NumberOfPfnReferences:          25
NumberOfMappedViews:                5 NumberOfUserReferences:          5
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816ac7b0, Name: \Device\HarddiskVolume1\WINDOWS\system32\sfc_os.dll
First prototype PTE: e1536bb8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81699a28 Start 0x76be0000 End 0x76c0dfff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e1528 Segment e15344f8
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          7
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816aab10, Name: \Device\HarddiskVolume1\WINDOWS\system32\wintrust.dll
First prototype PTE: e1534530 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816999f8 Start 0x76c40000 End 0x76c67fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816c8008 Segment e15271c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           9
NumberOfMappedViews:                7 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817029e8, Name: \Device\HarddiskVolume1\WINDOWS\system32\imagehlp.dll
First prototype PTE: e15271f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81612e90 Start 0x76f00000 End 0x76f07fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163de98 Segment e153a6c0
NumberOfSectionReferences:          0 NumberOfPfnReferences:           7
NumberOfMappedViews:                6 NumberOfUserReferences:          6
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81671f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\wtsapi32.dll
First prototype PTE: e153a6f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161d218 Start 0x76f80000 End 0x76ffefff Tag Vad 
Flags: CommitCharge: 6, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164af30 Segment e1540bb8
NumberOfSectionReferences:          0 NumberOfPfnReferences:          32
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f5e48, Name: \Device\HarddiskVolume1\WINDOWS\system32\clbcatq.dll
First prototype PTE: e1540bf0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x817d4a00 Start 0x77000000 End 0x770aafff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8164f970 Segment e153c818
NumberOfSectionReferences:          0 NumberOfPfnReferences:           5
NumberOfMappedViews:               10 NumberOfUserReferences:         10
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8164f8f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\comres.dll
First prototype PTE: e153c850 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8155f548 Start 0x77bb0000 End 0x77bb7fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817ad830 Segment e1524358
NumberOfSectionReferences:          1 NumberOfPfnReferences:           6
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81704f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\version.dll
First prototype PTE: e1524390 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81564040 Start 0x77b90000 End 0x77ba4fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816ae7d0 Segment e1525d48
NumberOfSectionReferences:          0 NumberOfPfnReferences:           8
NumberOfMappedViews:               13 NumberOfUserReferences:         13
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816f96f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
First prototype PTE: e1525d80 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81670008 Start 0x77cf0000 End 0x77d7ffff Tag Vadl
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745d50 Segment e152ad50
NumberOfSectionReferences:          1 NumberOfPfnReferences:          99
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81745b58, Name: \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
First prototype PTE: e152ad88 Last contiguous PTE: fffffffc
Flags2: Inherit: 1, LongVad: 1, ReadOnly: 1

VAD node @ 0x81564658 Start 0x77c40000 End 0x77c51fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168f008 Segment e152eb40
NumberOfSectionReferences:          0 NumberOfPfnReferences:           9
NumberOfMappedViews:                8 NumberOfUserReferences:          8
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @816a94f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\msasn1.dll
First prototype PTE: e152eb78 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178a398 Start 0x77ed0000 End 0x77f18fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @816e2e38 Segment e1528cd8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          42
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702bb8, Name: \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
First prototype PTE: e1528d10 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178a310 Start 0x77d80000 End 0x77e28fff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81689128 Segment e15272d8
NumberOfSectionReferences:          1 NumberOfPfnReferences:          71
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702f90, Name: \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
First prototype PTE: e1527310 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178a288 Start 0x77e30000 End 0x77ec1fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8168e338 Segment e152a008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          95
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @81702240, Name: \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
First prototype PTE: e152a040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81566f50 Start 0x77fa0000 End 0x77fb0fff Tag Vad 
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8167c008 Segment e15258d0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          11
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c5d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
First prototype PTE: e1525908 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8165e8d8 Start 0x77f20000 End 0x77f95fff Tag Vad 
Flags: CommitCharge: 2, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @81745648 Segment e152a820
NumberOfSectionReferences:          1 NumberOfPfnReferences:          97
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817051d0, Name: \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
First prototype PTE: e152a858 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81566fd8 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8178a5b8 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81565ae8 Start 0x7f6f0000 End 0x7f7effff Tag Vad 
Flags: NoChange: 1, Protection: 3
Protection: PAGE_EXECUTE_READ
ControlArea @816c9910 Segment e156bbc0
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               17 NumberOfUserReferences:         18
Control Flags: Based: 1, HadUserReference: 1, Reserve: 1
First prototype PTE: e156bbf8 Last contiguous PTE: e156bff4
Flags2: SecNoChange: 1

VAD node @ 0x81566910 Start 0x7e8c0000 End 0x7e970fff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @8163b008 Segment e1532008
NumberOfSectionReferences:          1 NumberOfPfnReferences:          31
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170d5e0, Name: \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
First prototype PTE: e1532040 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x8161f748 Start 0x7d5b0000 End 0x7ddaffff Tag Vad 
Flags: CommitCharge: 30, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d9500 Segment e152b000
NumberOfSectionReferences:          1 NumberOfPfnReferences:         642
NumberOfMappedViews:               15 NumberOfUserReferences:         16
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8170c270, Name: \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
First prototype PTE: e152b038 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81663560 Start 0x7ffdf000 End 0x7ffdffff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x8178a578 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81652558 Start 0x7ffdd000 End 0x7ffddfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x815623a0 Start 0x7ffdc000 End 0x7ffdcfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81613b20 Start 0x7ffdb000 End 0x7ffdbfff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

VAD node @ 0x81736840 Start 0x7ffda000 End 0x7ffdafff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

************************************************************************
Pid:   1284
VAD node @ 0x81566f20 Start 0x00400000 End 0x0040efff Tag Vad 
Flags: CommitCharge: 3, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817d5be0 Segment e1c9e498
NumberOfSectionReferences:          1 NumberOfPfnReferences:           4
NumberOfMappedViews:                1 NumberOfUserReferences:          2
Control Flags: File: 1, HadUserReference: 1, Image: 1
FileObject @815e33e8, Name: \Device\HarddiskVolume1\temp.exe
First prototype PTE: e1c9e4d0 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x81566e98 Start 0x7c940000 End 0x7c9dbfff Tag Vad 
Flags: CommitCharge: 5, ImageMap: 1, Protection: 7
Protection: PAGE_EXECUTE_WRITECOPY
ControlArea @817c52d8 Segment e13d15c0
NumberOfSectionReferences:          1 NumberOfPfnReferences:          78
NumberOfMappedViews:               20 NumberOfUserReferences:         21
Control Flags: Accessed: 1, DebugSymbolsLoaded: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @817442f8, Name: \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
First prototype PTE: e13d15f8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1

VAD node @ 0x816205b8 Start 0x7ffb0000 End 0x7ffd9fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
ControlArea @817c2258 Segment e1007698
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               21 NumberOfUserReferences:         21
Control Flags: Commit: 1, HadUserReference: 1
First prototype PTE: e10076d0 Last contiguous PTE: e1007774
Flags2: Inherit: 1, SecNoChange: 1

VAD node @ 0x81651898 Start 0x7ffde000 End 0x7ffdefff Tag Vadl
Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
First prototype PTE: 00000000 Last contiguous PTE: 00000000
Flags2: LongVad: 1, OneSecured: 1

vadwalk

************************************************************************
Pid:   1144
Address    Parent     Left       Right      Start      End        Tag 
---------- ---------- ---------- ---------- ---------- ---------- ----
0x8161f858 0x00000000 0x81612e70 0x815668e0 0x00db0000 0x00db0fff VadS
0x81612e70 0x8161f858 0x816698c8 0x8161f8b8 0x00d30000 0x00d3ffff VadS
0x816698c8 0x81612e70 0x816c3098 0x815668c0 0x00b80000 0x00bbffff VadS
0x816c3098 0x816698c8 0x81737360 0x81737560 0x00400000 0x0041cfff Vad 
0x81737360 0x816c3098 0x81566f88 0x8156c6f8 0x000a0000 0x0019ffff VadS
0x81566f88 0x81737360 0x81566f00 0x81566070 0x00020000 0x00020fff VadS
0x81566f00 0x81566f88 0x00000000 0x00000000 0x00010000 0x00010fff VadS
0x81566070 0x81566f88 0x81566e78 0x81616008 0x00080000 0x00082fff Vad 
0x81566e78 0x81566070 0x815d4540 0x00000000 0x00040000 0x0007ffff VadS
0x815d4540 0x81566e78 0x00000000 0x00000000 0x00030000 0x0003ffff VadS
0x81616008 0x81566070 0x00000000 0x00000000 0x00090000 0x00091fff Vad 
0x8156c6f8 0x81737360 0x816993a8 0x81699658 0x001e0000 0x00220fff Vad 
0x816993a8 0x8156c6f8 0x81641978 0x81560e50 0x001b0000 0x001bffff Vad 
0x81641978 0x816993a8 0x00000000 0x00000000 0x001a0000 0x001affff VadS
0x81560e50 0x816993a8 0x00000000 0x00000000 0x001c0000 0x001d5fff Vad 
0x81699658 0x8156c6f8 0x817376d0 0x8178a348 0x00290000 0x002d0fff Vad 
0x817376d0 0x81699658 0x8169ac08 0x00000000 0x00280000 0x00285fff Vad 
0x8169ac08 0x817376d0 0x00000000 0x00000000 0x00230000 0x00270fff Vad 
0x8178a348 0x81699658 0x8178a530 0x817d57c0 0x002f0000 0x002fffff VadS
0x8178a530 0x8178a348 0x00000000 0x00000000 0x002e0000 0x002e1fff Vad 
0x817d57c0 0x8178a348 0x8178a458 0x81675c88 0x00310000 0x00312fff Vad 
0x8178a458 0x817d57c0 0x00000000 0x00000000 0x00300000 0x0030ffff VadS
0x81675c88 0x817d57c0 0x8178a3d0 0x8173c208 0x00360000 0x0036ffff VadS
0x8178a3d0 0x81675c88 0x00000000 0x00000000 0x00320000 0x0035ffff VadS
0x8173c208 0x81675c88 0x00000000 0x81564da8 0x00370000 0x00370fff Vadl
0x81564da8 0x8173c208 0x00000000 0x817d2b80 0x00380000 0x00380fff Vadl
0x817d2b80 0x81564da8 0x81560df0 0x81737500 0x003a0000 0x003a1fff Vad 
0x81560df0 0x817d2b80 0x00000000 0x00000000 0x00390000 0x00391fff VadS
0x81737500 0x817d2b80 0x00000000 0x816999d8 0x003b0000 0x003effff VadS
0x816999d8 0x81737500 0x00000000 0x00000000 0x003f0000 0x003fffff VadS
0x81737560 0x816c3098 0x81691cd8 0x81737440 0x00900000 0x00afffff VadS
0x81691cd8 0x81737560 0x8173ec10 0x81691c78 0x004f0000 0x005f2fff Vad 
0x8173ec10 0x81691cd8 0x00000000 0x00000000 0x00420000 0x004e7fff Vad 
0x81691c78 0x81691cd8 0x00000000 0x00000000 0x00600000 0x008fffff Vad 
0x81737440 0x81737560 0x817374a0 0x00000000 0x00b40000 0x00b7ffff VadS
0x817374a0 0x81737440 0x00000000 0x00000000 0x00b00000 0x00b3ffff VadS
0x815668c0 0x816698c8 0x81564638 0x8162c7e8 0x00d00000 0x00d00fff VadS
0x81564638 0x815668c0 0x81560900 0x815648c8 0x00cc0000 0x00cd7fff VadS
0x81560900 0x81564638 0x00000000 0x00000000 0x00bc0000 0x00cbffff VadS
0x815648c8 0x81564638 0x00000000 0x00000000 0x00ce0000 0x00cf7fff VadS
0x8162c7e8 0x815668c0 0x81564f88 0x00000000 0x00d20000 0x00d2ffff VadS
0x81564f88 0x8162c7e8 0x00000000 0x00000000 0x00d10000 0x00d1ffff VadS
0x8161f8b8 0x81612e70 0x8173ebf0 0x8161f878 0x00d70000 0x00d71fff VadS
0x8173ebf0 0x8161f8b8 0x8161f728 0x8161f8d8 0x00d50000 0x00d5ffff VadS
0x8161f728 0x8173ebf0 0x00000000 0x00000000 0x00d40000 0x00d4ffff VadS
0x8161f8d8 0x8173ebf0 0x00000000 0x00000000 0x00d60000 0x00d6ffff VadS
0x8161f878 0x8161f8b8 0x8161f898 0x00000000 0x00da0000 0x00daffff VadS
0x8161f898 0x8161f878 0x00000000 0x00000000 0x00d80000 0x00d97fff VadS
0x815668e0 0x8161f858 0x816202f0 0x8178a4a8 0x4a5a0000 0x4a5f8fff Vad 
0x816202f0 0x815668e0 0x81620330 0x816996a8 0x00df0000 0x00dfffff VadS
0x81620330 0x816202f0 0x8161f838 0x81620310 0x00dd0000 0x00ddffff VadS
0x8161f838 0x81620330 0x00000000 0x00000000 0x00dc0000 0x00dcffff VadS
0x81620310 0x81620330 0x00000000 0x00000000 0x00de0000 0x00deffff VadS
0x816996a8 0x816202f0 0x815d4e68 0x8178a8f0 0x01260000 0x01260fff Vad 
0x815d4e68 0x816996a8 0x816202d0 0x8178a478 0x00e10000 0x0120ffff Vad 
0x816202d0 0x815d4e68 0x00000000 0x00000000 0x00e00000 0x00e0ffff VadS
0x8178a478 0x815d4e68 0x00000000 0x00000000 0x01210000 0x0125ffff Vad 
0x8178a8f0 0x816996a8 0x817d3a28 0x00000000 0x01a10000 0x01a11fff Vad 
0x817d3a28 0x8178a8f0 0x81641998 0x8155e668 0x012b0000 0x012bffff VadS
0x81641998 0x817d3a28 0x00000000 0x00000000 0x01270000 0x012affff Vad 
0x8155e668 0x817d3a28 0x817d4a30 0x8155e648 0x01820000 0x0185ffff VadS
0x817d4a30 0x8155e668 0x00000000 0x00000000 0x012c0000 0x0181ffff Vad 
0x8155e648 0x8155e668 0x00000000 0x8155e608 0x01860000 0x0189ffff VadS
0x8155e608 0x8155e648 0x00000000 0x81736880 0x018a0000 0x018dffff VadS
0x81736880 0x8155e608 0x00000000 0x00000000 0x018e0000 0x0191ffff VadS
0x8178a4a8 0x815668e0 0x81736800 0x8161dfd8 0x76ad0000 0x76ae0fff Vad 
0x81736800 0x8178a4a8 0x8179c0a8 0x8161e158 0x50940000 0x50969fff Vadl
0x8179c0a8 0x81736800 0x00000000 0x817d2bb0 0x50040000 0x50158fff Vad 
0x817d2bb0 0x8179c0a8 0x00000000 0x00000000 0x50640000 0x5064bfff Vad 
0x8161e158 0x81736800 0x81699148 0x81737610 0x75090000 0x750a2fff Vad 
0x81699148 0x8161e158 0x816872f8 0x8162c808 0x65000000 0x6502dfff Vad 
0x816872f8 0x81699148 0x8162c838 0x81612620 0x5ddf0000 0x5ddfafff Vad 
0x8162c838 0x816872f8 0x81564008 0x8173ec40 0x59250000 0x592a4fff Vad 
0x81564008 0x8162c838 0x00000000 0x817d57f0 0x567f0000 0x569b9fff Vad 
0x817d57f0 0x81564008 0x00000000 0x00000000 0x58730000 0x58767fff Vad 
0x8173ec40 0x8162c838 0x00000000 0x00000000 0x5a620000 0x5a645fff Vad 
0x81612620 0x816872f8 0x00000000 0x00000000 0x60740000 0x60748fff Vad 
0x8162c808 0x81699148 0x81687328 0x81564fd8 0x719e0000 0x719f6fff Vad 
0x81687328 0x8162c808 0x00000000 0x81612ec0 0x6f850000 0x6f958fff Vad 
0x81612ec0 0x81687328 0x00000000 0x00000000 0x719d0000 0x719d7fff Vad 
0x81564fd8 0x8162c808 0x00000000 0x816125f0 0x72f50000 0x72f75fff Vad 
0x816125f0 0x81564fd8 0x00000000 0x8178a500 0x73f80000 0x73feafff Vad 
0x8178a500 0x816125f0 0x00000000 0x00000000 0x74660000 0x746abfff Vad 
0x81737610 0x8161e158 0x815dffd8 0x00000000 0x76970000 0x76aacfff Vad 
0x815dffd8 0x81737610 0x8161e188 0x00000000 0x76730000 0x76738fff Vad 
0x8161e188 0x815dffd8 0x00000000 0x81564688 0x76040000 0x76198fff Vad 
0x81564688 0x8161e188 0x81564fa8 0x00000000 0x765c0000 0x76653fff Vad 
0x81564fa8 0x81564688 0x00000000 0x8161f778 0x762b0000 0x762bffff Vad 
0x8161f778 0x81564fa8 0x00000000 0x815e4a78 0x762d0000 0x762d4fff Vad 
0x815e4a78 0x8161f778 0x00000000 0x00000000 0x762e0000 0x762fcfff Vad 
0x8161dfd8 0x8178a4a8 0x8178a720 0x81566fd8 0x7c800000 0x7c932fff Vad 
0x8178a720 0x8161dfd8 0x81627de8 0x81670008 0x77bc0000 0x77c17fff Vad 
0x81627de8 0x8178a720 0x81566e40 0x8155f548 0x77160000 0x77262fff Vad 
0x81566e40 0x81627de8 0x81564918 0x00000000 0x770d0000 0x7715afff Vad 
0x81564918 0x81566e40 0x81564070 0x815648e8 0x76b60000 0x76b64fff Vad 
0x81564070 0x81564918 0x00000000 0x00000000 0x76af0000 0x76b1afff Vad 
0x815648e8 0x81564918 0x81699a28 0x816999f8 0x76c10000 0x76c38fff Vad 
0x81699a28 0x815648e8 0x00000000 0x00000000 0x76be0000 0x76c0dfff Vad 
0x816999f8 0x815648e8 0x00000000 0x81612e90 0x76c40000 0x76c67fff Vad 
0x81612e90 0x816999f8 0x00000000 0x8161d218 0x76f00000 0x76f07fff Vad 
0x8161d218 0x81612e90 0x00000000 0x817d4a00 0x76f80000 0x76ffefff Vad 
0x817d4a00 0x8161d218 0x00000000 0x00000000 0x77000000 0x770aafff Vad 
0x8155f548 0x81627de8 0x81564040 0x00000000 0x77bb0000 0x77bb7fff Vad 
0x81564040 0x8155f548 0x00000000 0x00000000 0x77b90000 0x77ba4fff Vad 
0x81670008 0x8178a720 0x81564658 0x8178a398 0x77cf0000 0x77d7ffff Vadl
0x81564658 0x81670008 0x00000000 0x00000000 0x77c40000 0x77c51fff Vad 
0x8178a398 0x81670008 0x8178a310 0x81566f50 0x77ed0000 0x77f18fff Vad 
0x8178a310 0x8178a398 0x00000000 0x8178a288 0x77d80000 0x77e28fff Vad 
0x8178a288 0x8178a310 0x00000000 0x00000000 0x77e30000 0x77ec1fff Vad 
0x81566f50 0x8178a398 0x8165e8d8 0x00000000 0x77fa0000 0x77fb0fff Vad 
0x8165e8d8 0x81566f50 0x00000000 0x00000000 0x77f20000 0x77f95fff Vad 
0x81566fd8 0x8161dfd8 0x00000000 0x8178a5b8 0x7c940000 0x7c9dbfff Vad 
0x8178a5b8 0x81566fd8 0x81565ae8 0x81663560 0x7ffb0000 0x7ffd9fff Vad 
0x81565ae8 0x8178a5b8 0x81566910 0x00000000 0x7f6f0000 0x7f7effff Vad 
0x81566910 0x81565ae8 0x8161f748 0x00000000 0x7e8c0000 0x7e970fff Vad 
0x8161f748 0x81566910 0x00000000 0x00000000 0x7d5b0000 0x7ddaffff Vad 
0x81663560 0x8178a5b8 0x8178a578 0x00000000 0x7ffdf000 0x7ffdffff Vadl
0x8178a578 0x81663560 0x81652558 0x00000000 0x7ffde000 0x7ffdefff Vadl
0x81652558 0x8178a578 0x815623a0 0x00000000 0x7ffdd000 0x7ffddfff Vadl
0x815623a0 0x81652558 0x81613b20 0x00000000 0x7ffdc000 0x7ffdcfff Vadl
0x81613b20 0x815623a0 0x81736840 0x00000000 0x7ffdb000 0x7ffdbfff Vadl
0x81736840 0x81613b20 0x00000000 0x00000000 0x7ffda000 0x7ffdafff Vadl
************************************************************************
Pid:   1284
Address    Parent     Left       Right      Start      End        Tag 
---------- ---------- ---------- ---------- ---------- ---------- ----
0x81566f20 0x00000000 0x00000000 0x81566e98 0x00400000 0x0040efff Vad 
0x81566e98 0x81566f20 0x00000000 0x816205b8 0x7c940000 0x7c9dbfff Vad 
0x816205b8 0x81566e98 0x00000000 0x81651898 0x7ffb0000 0x7ffd9fff Vad 
0x81651898 0x816205b8 0x00000000 0x00000000 0x7ffde000 0x7ffdefff Vadl

vadtree

************************************************************************
Pid:   1144
 0x00db0000 - 0x00db0fff
  0x00d30000 - 0x00d3ffff
   0x00b80000 - 0x00bbffff
    0x00400000 - 0x0041cfff
     0x000a0000 - 0x0019ffff
      0x00020000 - 0x00020fff
       0x00010000 - 0x00010fff
       0x00080000 - 0x00082fff
        0x00040000 - 0x0007ffff
         0x00030000 - 0x0003ffff
        0x00090000 - 0x00091fff
      0x001e0000 - 0x00220fff
       0x001b0000 - 0x001bffff
        0x001a0000 - 0x001affff
        0x001c0000 - 0x001d5fff
       0x00290000 - 0x002d0fff
        0x00280000 - 0x00285fff
         0x00230000 - 0x00270fff
        0x002f0000 - 0x002fffff
         0x002e0000 - 0x002e1fff
         0x00310000 - 0x00312fff
          0x00300000 - 0x0030ffff
          0x00360000 - 0x0036ffff
           0x00320000 - 0x0035ffff
           0x00370000 - 0x00370fff
            0x00380000 - 0x00380fff
             0x003a0000 - 0x003a1fff
              0x00390000 - 0x00391fff
              0x003b0000 - 0x003effff
               0x003f0000 - 0x003fffff
     0x00900000 - 0x00afffff
      0x004f0000 - 0x005f2fff
       0x00420000 - 0x004e7fff
       0x00600000 - 0x008fffff
      0x00b40000 - 0x00b7ffff
       0x00b00000 - 0x00b3ffff
    0x00d00000 - 0x00d00fff
     0x00cc0000 - 0x00cd7fff
      0x00bc0000 - 0x00cbffff
      0x00ce0000 - 0x00cf7fff
     0x00d20000 - 0x00d2ffff
      0x00d10000 - 0x00d1ffff
   0x00d70000 - 0x00d71fff
    0x00d50000 - 0x00d5ffff
     0x00d40000 - 0x00d4ffff
     0x00d60000 - 0x00d6ffff
    0x00da0000 - 0x00daffff
     0x00d80000 - 0x00d97fff
  0x4a5a0000 - 0x4a5f8fff
   0x00df0000 - 0x00dfffff
    0x00dd0000 - 0x00ddffff
     0x00dc0000 - 0x00dcffff
     0x00de0000 - 0x00deffff
    0x01260000 - 0x01260fff
     0x00e10000 - 0x0120ffff
      0x00e00000 - 0x00e0ffff
      0x01210000 - 0x0125ffff
     0x01a10000 - 0x01a11fff
      0x012b0000 - 0x012bffff
       0x01270000 - 0x012affff
       0x01820000 - 0x0185ffff
        0x012c0000 - 0x0181ffff
        0x01860000 - 0x0189ffff
         0x018a0000 - 0x018dffff
          0x018e0000 - 0x0191ffff
   0x76ad0000 - 0x76ae0fff
    0x50940000 - 0x50969fff
     0x50040000 - 0x50158fff
      0x50640000 - 0x5064bfff
     0x75090000 - 0x750a2fff
      0x65000000 - 0x6502dfff
       0x5ddf0000 - 0x5ddfafff
        0x59250000 - 0x592a4fff
         0x567f0000 - 0x569b9fff
          0x58730000 - 0x58767fff
         0x5a620000 - 0x5a645fff
        0x60740000 - 0x60748fff
       0x719e0000 - 0x719f6fff
        0x6f850000 - 0x6f958fff
         0x719d0000 - 0x719d7fff
        0x72f50000 - 0x72f75fff
         0x73f80000 - 0x73feafff
          0x74660000 - 0x746abfff
      0x76970000 - 0x76aacfff
       0x76730000 - 0x76738fff
        0x76040000 - 0x76198fff
         0x765c0000 - 0x76653fff
          0x762b0000 - 0x762bffff
           0x762d0000 - 0x762d4fff
            0x762e0000 - 0x762fcfff
    0x7c800000 - 0x7c932fff
     0x77bc0000 - 0x77c17fff
      0x77160000 - 0x77262fff
       0x770d0000 - 0x7715afff
        0x76b60000 - 0x76b64fff
         0x76af0000 - 0x76b1afff
         0x76c10000 - 0x76c38fff
          0x76be0000 - 0x76c0dfff
          0x76c40000 - 0x76c67fff
           0x76f00000 - 0x76f07fff
            0x76f80000 - 0x76ffefff
             0x77000000 - 0x770aafff
       0x77bb0000 - 0x77bb7fff
        0x77b90000 - 0x77ba4fff
      0x77cf0000 - 0x77d7ffff
       0x77c40000 - 0x77c51fff
       0x77ed0000 - 0x77f18fff
        0x77d80000 - 0x77e28fff
         0x77e30000 - 0x77ec1fff
        0x77fa0000 - 0x77fb0fff
         0x77f20000 - 0x77f95fff
     0x7c940000 - 0x7c9dbfff
      0x7ffb0000 - 0x7ffd9fff
       0x7f6f0000 - 0x7f7effff
        0x7e8c0000 - 0x7e970fff
         0x7d5b0000 - 0x7ddaffff
       0x7ffdf000 - 0x7ffdffff
        0x7ffde000 - 0x7ffdefff
         0x7ffdd000 - 0x7ffddfff
          0x7ffdc000 - 0x7ffdcfff
           0x7ffdb000 - 0x7ffdbfff
            0x7ffda000 - 0x7ffdafff
************************************************************************
Pid:   1284
 0x00400000 - 0x0040efff
  0x7c940000 - 0x7c9dbfff
   0x7ffb0000 - 0x7ffd9fff
    0x7ffde000 - 0x7ffdefff

vadとは

仮想アドレス記述子(Virtual Address Descriptor:VAD)
メモリ ロケーションの読み取りまたは書き込みを行うときに、プロセッサは仮想アドレスを使います。
読み取りまたは書き込み操作の一環としてプロセッサは、仮想アドレスから物理アドレスへの変換を行います。
仮想アドレスを介したメモリ アクセスには次の 3 つの利点があります。
- プログラムでは、物理メモリでは連続していない大規模なメモリ バッファーに対し、仮想アドレスの連続した範囲を利用してアクセスできます。
- プログラムでは、仮想アドレスの範囲を利用して、実際に物理メモリで提供されるサイズを超えるメモリ バッファーにアクセスすることができます。 物理メモリの容量が少なくなってくると、メモリ マネージャーが物理メモリのページ (サイズは通常 4 KB) をディスク ファイルに保存します。 データまたはコードのページが、必要に応じて物理メモリとディスクの間を移動します。
- 個々のプロセスが使う仮想アドレスはそれぞれ独立しています。 あるプロセス中のコードが、別のプロセスまたはオペレーティング システムで使われている物理メモリを変更することはできません。

以上。