IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Pending Orders Statement -40064778.doc
Rich Text Format data, version 1, unknown character set
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\boobov[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
downloaded
 malicious
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2658F6C0-C679-4D43-96D3-E7E6CC77C67B}.tmp
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D19B7C91-551E-40AF-9919-E039C2A6E74E}.tmp
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\Cab232D.tmp
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\Tar232E.tmp
data
modified
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Pending Orders Statement -40064778.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:15 2020, mtime=Wed Aug 26 14:08:15 2020, atime=Thu Jan 28 02:29:36 2021, length=354788, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Little-endian UTF-16 Unicode text, with no line terminators
dropped
 clean
C:\Users\user\Desktop\~$nding Orders Statement -40064778.doc
data
dropped
 clean
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
 malicious
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
 malicious
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
 malicious
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
 malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 clean

URLs

Name
IP
Malicious
http://cy.kl-re.com//power/bo/boobov.exe
172.111.202.41
 malicious
https://xWUrFiDn0aBmFXBFM.net
malicious
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
unknown
 clean
http://127.0.0.1:HTTP/1.1
unknown
 clean
http://DynDns.comDynDNS
unknown
 clean
http://crl.oces.certifikat.dk/oces.crl0
unknown
 clean
http://fedir.comsign.co.il/crl/ComSignCA.crl0
unknown
 clean
https://sectigo.com/CPS0
unknown
 clean
http://crl.chambersign.org/chambersroot.crl0
unknown
 clean
http://crl.entrust.net/server1.crl0
unknown
 clean
http://ocsp.sectigo.com0
unknown
 clean
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
unknown
 clean
http://ocsp.entrust.net03
unknown
 clean
http://ca.sia.it/seccli/repository/CRL.der0J
unknown
 clean
http://www.certicamara.com/dpc/0Z
unknown
 clean
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
unknown
 clean
http://cps.chambersign.org/cps/chambersroot.html0
unknown
 clean
http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.cr
unknown
 clean
http://www.chambersign.org1
unknown
 clean
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
 clean
http://www.diginotar.nl/cps/pkioverheid0
unknown
 clean
https://ca.sia.it/seccli/repository/CPS/
unknown
 clean
http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
unknown
 clean
http://mail.privateemail.com
unknown
 clean
http://crl.chambersign.org/publicnotaryroot.crl0
unknown
 clean
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://www.sk.ee/juur/crl/0
unknown
 clean
http://crl.xrampsecurity.com/XGCA.crl0
unknown
 clean
http://www.e-certchile.cl/html/productos/download/CPSv1
unknown
 clean
http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
unknown
 clean
http://193.239.147.103/base/9158412CBF14FB744AFA9F0D01F6CDF2.html
193.239.147.103
 clean
http://duylfM.com
unknown
 clean
http://www.sk.ee/cps/0
unknown
 clean
http://www.valicert.com/1
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://193.239.147.103
unknown
 clean
http://ocsp.entrust.net0D
unknown
 clean
http://www.wellsfargo.com/certpolicy0
unknown
 clean
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
 clean
https://secure.comodo.com/CPS0
unknown
 clean
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
unknown
 clean
http://servername/isapibackend.dll
unknown
 clean
http://crl.entrust.net/2048ca.crl0
unknown
 clean
http://www.comsign.co.il/cps0
unknown
 clean
http://cps.chambersign.org/cps/publicnotaryroot.html0
unknown
 clean
There are 36 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
cybersng.duckdns.org
172.111.202.41
 malicious
mail.privateemail.com
198.54.122.60
 clean
cy.kl-re.com
unknown
 clean

IPs

IP
Domain
Country
Active
Malicious
172.111.202.41
unknown
United States
unknown
 malicious
193.239.147.103
unknown
Brunei Darussalam
unknown
 clean
198.54.122.60
unknown
United States
unknown
 clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
4<7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
==7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
$>7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ED6EE
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F454A
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F454A
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EquationEditorFilesIntl_1033
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
SavedLegacySettings
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
EnableFileTracing
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
EnableConsoleTracing
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
FileTracingMask
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
ConsoleTracingMask
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
MaxFileSize
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
FileDirectory
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
EnableFileTracing
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
EnableConsoleTracing
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
FileTracingMask
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
ConsoleTracingMask
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
MaxFileSize
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
FileDirectory
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
C:\Users\user\AppData\Roaming\poiuytrewsdfghjklmnbvcx.exe
Blob
 clean
There are 335 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2631000
unkown
page read and write
 malicious
3C6A000
unkown
page read and write
 malicious
2A53000
unkown
page read and write
 malicious
402000
unkown
page execute and read and write
 malicious
26EE000
unkown
page read and write
 malicious
2A84000
unkown
page read and write
 malicious
C2F000
unkown
page read and write
 clean
6B82000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
26E6000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
7510000
unkown
page read and write
 clean
78D000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
2889000
unkown
page read and write
 clean
4A62000
heap private
page read and write
 clean
3F0000
unkown
page read and write
 clean
5F0000
unkown
page read and write
 clean
64CD000
unkown
page read and write
 clean
3EB000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
649C000
unkown
page read and write
 clean
D1C000
unkown
page read and write
 clean
220000
unkown
page execute and read and write
 clean
477000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
FE0000
heap private
page execute and read and write
 clean
490000
unkown
page read and write
 clean
121E000
unkown image
page readonly
 clean
3E5000
unkown
page read and write
 clean
4E0000
unkown
page readonly
 clean
121E000
unkown image
page readonly
 clean
720000
unkown
page readonly
 clean
610000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
546A000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
910000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
3719000
unkown
page read and write
 clean
7A0000
unkown
page read and write
 clean
146000
unkown
page execute and read and write
 clean
610000
unkown
page read and write
 clean
3F0000
unkown
page read and write
 clean
7A0000
unkown
page read and write
 clean
91A000
unkown
page read and write
 clean
4D5000
unkown
page read and write
 clean
6990000
unkown
page read and write
 clean
7A0000
unkown
page read and write
 clean
D70000
unkown
page readonly
 clean
7A0000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
545E000
unkown
page read and write
 clean
697000
heap default
page read and write
 clean
740000
unkown
page read and write
 clean
CB4000
unkown
page read and write
 clean
5C50000
unkown
page readonly
 clean
3E5000
unkown
page read and write
 clean
2686000
unkown
page read and write
 clean
121E000
unkown image
page readonly
 clean
572D000
unkown
page read and write
 clean
2692000
unkown
page read and write
 clean
592E000
unkown
page read and write
 clean
26AD000
unkown
page read and write
 clean
549E000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
990000
unkown
page readonly
 clean
4B0000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
64AC000
unkown
page read and write
 clean
48E000
unkown
page read and write
 clean
79D000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
11E2000
unkown image
page execute read
 clean
11E0000
unkown image
page readonly
 clean
497000
unkown
page read and write
 clean
720000
unkown
page read and write
 clean
CC0000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
920000
unkown
page read and write
 clean
2B15000
unkown
page read and write
 clean
37D9000
unkown
page read and write
 clean
7F0000
heap private
page read and write
 clean
810000
unkown
page read and write
 clean
36D9000
unkown
page read and write
 clean
3819000
unkown
page read and write
 clean
5F0000
unkown
page read and write
 clean
E30000
heap private
page read and write
 clean
610000
unkown
page read and write
 clean
4C1E000
unkown
page read and write
 clean
5FDE000
stack
page read and write
 clean
720000
unkown
page read and write
 clean
76A000
heap default
page read and write
 clean
740000
unkown
page read and write
 clean
56EC000
unkown
page read and write
 clean
7552000
unkown
page read and write
 clean
27AA000
unkown
page read and write
 clean
56C0000
unkown
page readonly
 clean
910000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
2B0D000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
6445000
unkown
page read and write
 clean
548A000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
7A10000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
410000
unkown
page read and write
 clean
4C60000
heap private
page read and write
 clean
5AB0000
unkown
page read and write
 clean
6498000
unkown
page read and write
 clean
272B000
unkown
page read and write
 clean
124000
unkown
page read and write
 clean
11E0000
unkown image
page readonly
 clean
1FE000
unkown
page read and write
 clean
121E000
unkown image
page readonly
 clean
7A0000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
740000
unkown
page execute and read and write
 clean
6B4000
heap default
page read and write
 clean
65C0000
heap private
page read and write
 clean
CC0000
unkown
page read and write
 clean
3699000
unkown
page read and write
 clean
80000
unkown
page readonly
 clean
430000
heap private
page read and write
 clean
5120000
heap private
page read and write
 clean
490000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
13D000
unkown
page execute and read and write
 clean
420000
unkown
page read and write
 clean
720000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
8426000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
3E8000
unkown
page read and write
 clean
7A0000
unkown
page read and write
 clean
770000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
7A0000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
613000
unkown
page read and write
 clean
292C000
unkown
page read and write
 clean
64B1000
unkown
page read and write
 clean
2727000
unkown
page read and write
 clean
110E000
stack
page read and write
 clean
3E0000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
3E8000
unkown
page read and write
 clean
288E000
unkown
page read and write
 clean
4A0000
heap private
page read and write
 clean
37F9000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
83DA000
unkown
page read and write
 clean
3631000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
FBE000
unkown
page read and write
 clean
56BE000
stack
page read and write
 clean
4A40000
heap private
page read and write
 clean
3E0000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
2B13000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
547F000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
118F000
unkown
page read and write
 clean
5098000
heap private
page read and write
 clean
5AB0000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
875D000
unkown
page read and write
 clean
930000
unkown
page read and write
 clean
CB0000
unkown
page read and write
 clean
83FE000
unkown
page read and write
 clean
B9E000
unkown
page read and write
 clean
2B3F000
unkown
page read and write
 clean
2895000
unkown
page read and write
 clean
470000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
152000
unkown
page read and write
 clean
4C0000
heap default
page read and write
 clean
5AB0000
unkown
page read and write
 clean
652E000
unkown
page read and write
 clean
620B000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
230000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
683C000
unkown
page read and write
 clean
8391000
unkown
page read and write
 clean
6493000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
5489000
unkown
page read and write
 clean
A560000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
7F7000
heap private
page read and write
 clean
3D51000
unkown
page read and write
 clean
8760000
unkown
page read and write
 clean
698E000
unkown
page read and write
 clean
368000
stack
page read and write
 clean
5499000
unkown
page read and write
 clean
910000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
CE0000
unkown
page write copy
 clean
36B9000
unkown
page read and write
 clean
64B1000
unkown
page read and write
 clean
3BF2000
unkown
page read and write
 clean
20000
unkown
page read and write
 clean
2B0F000
unkown
page read and write
 clean
F6E000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
268E000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
B1E0000
unkown
page read and write
 clean
800000
unkown
page read and write
 clean
470000
unkown
page read and write
 clean
800000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
3659000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
4C8B000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
66D0000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
930000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
610000
heap private
page read and write
 clean
810000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
15B000
unkown
page execute and read and write
 clean
611000
unkown
page read and write
 clean
1D0000
unkown
page execute and read and write
 clean
580000
unkown
page execute and read and write
 clean
64A9000
unkown
page read and write
 clean
549B000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
11E2000
unkown image
page execute read
 clean
610000
unkown
page read and write
 clean
14A000
unkown
page execute and read and write
 clean
260000
unkown
page readonly
 clean
497000
unkown
page read and write
 clean
509E000
stack
page read and write
 clean
610000
unkown
page read and write
 clean
644000
heap default
page read and write
 clean
121E000
unkown image
page readonly
 clean
611000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
CB0000
unkown
page read and write
 clean
36F9000
unkown
page read and write
 clean
11E0000
unkown image
page readonly
 clean
490000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
4FC0000
unkown
page write copy
 clean
79C2000
unkown
page read and write
 clean
420000
unkown
page read and write
 clean
920000
unkown
page read and write
 clean
8426000
unkown
page read and write
 clean
910000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
910000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
11E0000
unkown image
page readonly
 clean
497000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
4AEF000
stack
page read and write
 clean
3E0000
unkown
page read and write
 clean
FB0000
heap private
page read and write
 clean
6495000
unkown
page read and write
 clean
525E000
stack
page read and write
 clean
11E2000
unkown image
page execute read
 clean
CE70000
unkown
page read and write
 clean
5090000
heap private
page read and write
 clean
490000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
AF60000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
2683000
unkown
page read and write
 clean
3631000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
65CB000
heap private
page read and write
 clean
515E000
unkown
page read and write | page guard
 clean
813000
unkown
page read and write
 clean
14A000
unkown
page execute and read and write
 clean
11E0000
unkown image
page readonly
 clean
940000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
940000
unkown
page read and write
 clean
2656000
unkown
page read and write
 clean
12D000
unkown
page execute and read and write
 clean
4A44000
heap private
page read and write
 clean
5F5000
unkown
page read and write
 clean
4CD000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
130000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
378000
unkown
page read and write
 clean
9B60000
unkown
page read and write
 clean
730000
unkown
page read and write
 clean
830000
unkown
page readonly
 clean
20000
unkown
page read and write
 clean
BDD000
unkown
page read and write
 clean
114E000
unkown
page read and write
 clean
576C000
unkown
page read and write
 clean
108C000
unkown
page read and write
 clean
616000
unkown
page read and write
 clean
3637000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
C9E000
unkown
page read and write
 clean
150000
heap private
page execute and read and write
 clean
74D0000
heap private
page read and write
 clean
490000
unkown
page read and write
 clean
4B0000
unkown
page read and write
 clean
7A1000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
5DE000
unkown
page read and write
 clean
3639000
unkown
page read and write
 clean
790000
unkown
page read and write
 clean
525D000
unkown
page read and write
 clean
7510000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
600000
unkown
page read and write
 clean
123000
unkown
page execute and read and write
 clean
490000
unkown
page read and write
 clean
549E000
unkown
page read and write
 clean
515F000
unkown
page read and write
 clean
C970000
unkown
page read and write
 clean
910000
unkown
page read and write
 clean
66D000
heap default
page read and write
 clean
610000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
26EA000
unkown
page read and write
 clean
B10000
unkown
page readonly
 clean
800000
unkown
page readonly
 clean
3E5000
unkown
page read and write
 clean
620000
heap default
page read and write
 clean
276D000
unkown
page read and write
 clean
54E0000
heap private
page execute and read and write
 clean
4CE0000
unkown
page readonly
 clean
910000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
649C000
unkown
page read and write
 clean
4C65000
heap private
page read and write
 clean
3E5000
unkown
page read and write
 clean
267E000
unkown
page read and write
 clean
600000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
11E2000
unkown image
page execute read
 clean
612000
unkown
page read and write
 clean
110000
unkown
page read and write
 clean
820000
heap private
page read and write
 clean
63F0000
unkown
page read and write
 clean
4BAF000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
3739000
unkown
page read and write
 clean
6F3000
heap default
page read and write
 clean
624D000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
495E000
unkown
page read and write
 clean
130000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
930000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
3F0000
unkown
page read and write
 clean
910000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
7A0000
unkown
page read and write
 clean
5463000
unkown
page read and write
 clean
810000
unkown
page read and write
 clean
4C60000
unkown
page readonly
 clean
790000
unkown
page readonly
 clean
3E5000
unkown
page read and write
 clean
920000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
6DC000
heap default
page read and write
 clean
F0000
unkown
page read and write
 clean
284B000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
910000
unkown
page read and write
 clean
147000
unkown
page execute and read and write
 clean
EAF000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
3779000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
121E000
unkown image
page readonly
 clean
3E0000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
11E2000
unkown image
page execute read
 clean
497000
unkown
page read and write
 clean
5F0000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
950000
heap private
page execute and read and write
 clean
CA0000
heap private
page execute and read and write
 clean
815000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
5460000
unkown
page read and write
 clean
6498000
unkown
page read and write
 clean
2735000
unkown
page read and write
 clean
5260000
unkown
page read and write
 clean
64CD000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
480000
heap private
page read and write
 clean
610000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
87A2000
unkown
page read and write
 clean
4C82000
heap private
page read and write
 clean
327000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
487000
heap private
page read and write
 clean
71C0000
heap private
page read and write
 clean
19B000
unkown
page execute and read and write
 clean
4C5E000
stack
page read and write
 clean
74A000
heap default
page read and write
 clean
470000
unkown
page read and write
 clean
8424000
unkown
page read and write
 clean
800000
unkown
page read and write
 clean
804C000
unkown
page read and write
 clean
910000
unkown
page readonly
 clean
5490000
unkown
page read and write
 clean
4C5C000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
4630000
unkown
page readonly
 clean
5F0000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
660000
heap default
page read and write
 clean
123000
unkown
page execute and read and write
 clean
610000
unkown
page read and write
 clean
11E0000
unkown image
page readonly
 clean
155000
unkown
page execute and read and write
 clean
828000
heap private
page read and write
 clean
590000
unkown
page read and write
 clean
110000
unkown
page read and write
 clean
2696000
unkown
page read and write
 clean
3759000
unkown
page read and write
 clean
124000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
936000
unkown
page read and write
 clean
66CE000
unkown
page read and write
 clean
4CA0000
heap private
page execute and read and write
 clean
AEE000
unkown
page read and write
 clean
272D000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
64A9000
unkown
page read and write
 clean
627000
heap default
page read and write
 clean
490000
unkown
page read and write
 clean
914000
unkown
page read and write
 clean
BBE0000
unkown
page read and write
 clean
5260000
unkown
page read and write
 clean
549A000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
21C000
unkown
page read and write
 clean
E42000
heap private
page read and write
 clean
610000
unkown
page read and write
 clean
736000
heap default
page read and write
 clean
3E5000
unkown
page read and write
 clean
220000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
3D0000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
470000
unkown
page read and write
 clean
659E000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
29C4000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
11E0000
unkown image
page readonly
 clean
26AB000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
615000
unkown
page read and write
 clean
92B000
unkown
page read and write
 clean
619000
unkown
page read and write
 clean
546F000
stack
page read and write
 clean
3E5000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
6D0000
heap default
page read and write
 clean
713E000
unkown
page read and write
 clean
12D000
unkown
page execute and read and write
 clean
5476000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
548E000
unkown
page read and write
 clean
570000
unkown
page read and write
 clean
612000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
157000
unkown
page execute and read and write
 clean
648E000
unkown
page read and write
 clean
B1DE000
unkown
page read and write
 clean
338000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
5DE000
unkown
page read and write
 clean
5F0000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
790000
unkown
page read and write
 clean
2885000
unkown
page read and write
 clean
8390000
unkown
page read and write
 clean
3799000
unkown
page read and write
 clean
120000
unkown
page read and write
 clean
5499000
unkown
page read and write
 clean
9160000
unkown
page read and write
 clean
738E000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
3679000
unkown
page read and write
 clean
4A1E000
unkown
page read and write
 clean
920000
unkown
page read and write
 clean
C96D000
unkown
page read and write
 clean
4F0000
heap default
page read and write
 clean
4630000
unkown
page readonly
 clean
F3E000
unkown
page read and write
 clean
649C000
unkown
page read and write
 clean
64A0000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
83DA000
unkown
page read and write
 clean
8090000
unkown
page readonly
 clean
610000
unkown
page read and write
 clean
548F000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
590000
unkown
page read and write
 clean
197000
unkown
page execute and read and write
 clean
4C9D000
unkown
page read and write
 clean
5F0000
unkown
page read and write
 clean
50B6000
heap private
page read and write
 clean
790000
unkown
page execute and read and write
 clean
497000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
6E0000
heap default
page read and write
 clean
6493000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
80000
unkown
page readonly
 clean
4C88000
unkown
page read and write
 clean
60AD000
unkown
page read and write
 clean
240000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
690000
heap default
page read and write
 clean
EAE000
unkown
page read and write | page guard
 clean
5E0000
unkown
page read and write
 clean
3E5000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
8426000
unkown
page read and write
 clean
37B9000
unkown
page read and write
 clean
70D000
heap default
page read and write
 clean
D6E000
unkown
page read and write
 clean
13A000
unkown
page read and write
 clean
11E0000
unkown image
page readonly
 clean
4C89000
unkown
page read and write
 clean
5C4C000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
8760000
unkown
page read and write
 clean
5A5E000
unkown
page read and write
 clean
3839000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
6712000
unkown
page read and write
 clean
1230000
unkown
page readonly
 clean
63ED000
unkown
page read and write
 clean
11E2000
unkown image
page execute read
 clean
610000
unkown
page read and write
 clean
64CF000
unkown
page read and write
 clean
5F2000
unkown
page read and write
 clean
612000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
4D0000
unkown
page read and write
 clean
142000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
720000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
2631000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
5F0000
unkown
page read and write
 clean
58DC000
unkown
page read and write
 clean
8C12000
unkown
page read and write
 clean
497000
unkown
page read and write
 clean
DF0000
heap private
page read and write
 clean
587E000
unkown
page read and write
 clean
6495000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
2A81000
unkown
page read and write
 clean
11E0000
unkown image
page readonly
 clean
5AB0000
unkown
page read and write
 clean
2B17000
unkown
page read and write
 clean
230000
unkown
page read and write
 clean
7390000
unkown
page read and write
 clean
495000
unkown
page read and write
 clean
540000
unkown
page read and write
 clean
400000
unkown
page execute and read and write
 clean
132000
unkown
page read and write
 clean
7EE000
unkown
page read and write
 clean
6498000
unkown
page read and write
 clean
610000
unkown
page read and write
 clean
64CD000
unkown
page read and write
 clean
567F000
unkown
page read and write
 clean
740000
unkown
page read and write
 clean
210000
unkown
page read and write
 clean
490000
unkown
page read and write
 clean
3E0000
unkown
page read and write
 clean
527D000
unkown
page read and write
 clean
19A000
unkown
page read and write
 clean
There are 624 hidden memdumps, click here to show them.