IOCReport

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Exploit.Siggen3.10350.857.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Feb 19 10:48:36 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
downloaded
 malicious
C:\Users\user\BASE.BABAA
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabD7BA.tmp
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\DCCE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarD7E9.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Sat Feb 20 09:19:38 2021, atime=Sat Feb 20 09:19:38 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.Exploit.Siggen3.10350.857.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Feb 20 09:19:25 2021, mtime=Sat Feb 20 09:19:38 2021, atime=Sat Feb 20 09:19:38 2021, length=168448, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\QNetMonitor8751465376\SecurityPreloadState.txt
ASCII text, with very long lines, with CRLF line terminators
modified
 clean
C:\Users\user\Desktop\10DE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\BASE.BABAA,DllRegisterServer
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32 ..\BASE.BABAA,DllRegisterServer
 malicious
C:\Windows\System32\wermgr.exe
C:\Windows\system32\wermgr.exe
 malicious
C:\Windows\System32\wermgr.exe
C:\Windows\system32\wermgr.exe
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.EXE 'C:\Users\user\AppData\Roaming\QNetMonitor8751465376\kiBASEzv.rrd',DllRegisterServer
 malicious
C:\Windows\System32\taskeng.exe
taskeng.exe {C999D15C-7BEE-4793-989A-0EF4E6A22007} S-1-5-18:NT AUTHORITY\System:Service:
 clean

URLs

Name
IP
Malicious
http://www.chipmania.it/mails/open.php
185.81.0.78
 malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://crl.entrust.net/server1.crl0
unknown
 clean
http://ocsp.entrust.net03
unknown
 clean
https://36.94.62.207/rob60/971342_W617601.BB08CBD1CB3BE0D331A29013BDDA57AE/14/NAT%20status/client%20
unknown
 clean
http://investor.msn.com/
unknown
 clean
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://www.diginotar.nl/cps/pkioverheid0
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://ocsp.entrust.net0D
unknown
 clean
https://36.94.62.207/rob60/971342_W617601.BB
unknown
 clean
http://wtfismyip.com/text
95.217.228.176
 clean
https://secure.comodo.com/CPS0
unknown
 clean
http://servername/isapibackend.dll
unknown
 clean
http://crl.entrust.net/2048ca.crl0
unknown
 clean
https://103.61.101.11:447/rob60/971342_W617601.BB08CBD1CB3BE0D331A29013BDDA57AE/5/pwgrab64/
unknown
 clean
There are 14 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
38.52.17.84.dnsbl-1.uceprotect.net
unknown
 malicious
www.chipmania.it
unknown
 malicious
chipmania.it
185.81.0.78
 clean
wtfismyip.com
95.217.228.176
 clean
38.52.17.84.zen.spamhaus.org
unknown
 clean
38.52.17.84.cbl.abuseat.org
unknown
 clean
38.52.17.84.b.barracudacentral.org
unknown
 clean
38.52.17.84.spam.dnsbl.sorbs.net
unknown
 clean

IPs

IP
Domain
Country
Active
Malicious
103.61.101.11
unknown
India
unknown
 malicious
142.202.191.164
unknown
Reserved
unknown
 malicious
36.94.62.207
unknown
Indonesia
unknown
 malicious
95.217.228.176
unknown
Germany
unknown
 clean
185.81.0.78
unknown
Italy
unknown
 clean
194.5.249.156
unknown
Romania
unknown
 clean
134.119.186.202
unknown
Germany
unknown
 clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
q.7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EC5FE
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECA90
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECC92
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECFDD
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED05A
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1=7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F41F0
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F4673
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\taskeng.exe
data
 clean
There are 106 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
6D0000
heap default
page read and write
 malicious
180000
unkown
page execute and read and write
 malicious
21E8000
unkown
page read and write
 malicious
704000
unkown
page read and write
 malicious
704000
unkown
page read and write
 malicious
1A0000
unkown
page read and write
 clean
C0000
unkown
page readonly
 clean
32CE0000
unkown
page readonly
 clean
10001000
unkown
page execute and read and write
 clean
670000
heap default
page read and write
 clean
21A0000
unkown
page read and write
 clean
160000
unkown
page read and write
 clean
574000
heap private
page read and write
 clean
33EDB000
unkown
page read and write
 clean
332D5000
heap private
page read and write
 clean
324F7000
heap private
page read and write
 clean
33E81000
unkown
page read and write
 clean
33E7F000
unkown
page read and write
 clean
2D6000
unkown
page read and write
 clean
564000
heap private
page read and write
 clean
33EF4000
unkown
page read and write
 clean
1685000
unkown
page readonly
 clean
346AB000
unkown
page read and write
 clean
694000
heap default
page read and write
 clean
2BE000
heap default
page read and write
 clean
1FC000
unkown
page read and write
 clean
20000
unkown
page read and write
 clean
33FFB000
unkown
page read and write
 clean
170000
unkown
page readonly
 clean
1E60000
heap private
page read and write
 clean
6AD000
heap default
page read and write
 clean
33E80000
unkown
page read and write
 clean
1D6000
unkown
page read and write
 clean
1CF7000
unkown
page readonly
 clean
210000
unkown
page readonly
 clean
6FA000
unkown
page read and write
 clean
16C2000
unkown
page readonly
 clean
1A7000
heap default
page read and write
 clean
1E3F000
unkown
page read and write
 clean
160000
unkown
page read and write
 clean
31F0D000
heap private
page read and write
 clean
1635000
unkown
page readonly
 clean
1362000
unkown
page readonly
 clean
390000
unkown
page readonly
 clean
677000
heap default
page read and write
 clean
1544000
unkown
page readonly
 clean
6E884000
unkown image
page readonly
 clean
35B80000
unkown
page read and write
 clean
560000
heap private
page read and write
 clean
3B0000
unkown
page readonly
 clean
160000
unkown
page read and write
 clean
1E69000
heap private
page read and write
 clean
33EB7000
unkown
page read and write
 clean
F8F000
unkown
page read and write
 clean
26A000
heap default
page read and write
 clean
570000
heap private
page read and write
 clean
15A5000
unkown
page readonly
 clean
327F4000
heap private
page read and write
 clean
FC0000
unkown
page readonly
 clean
24F6000
stack
page read and write
 clean
1DE000
heap default
page read and write
 clean
380000
unkown
page readonly
 clean
32C2C000
heap private
page read and write
 clean
1462000
unkown
page readonly
 clean
33B17000
unkown
page readonly
 clean
280000
heap default
page read and write
 clean
D20000
heap private
page read and write
 clean
1852000
unkown
page readonly
 clean
1542000
unkown
page readonly
 clean
1FA7000
unkown
page readonly
 clean
474000
heap private
page read and write
 clean
33EE5000
unkown
page read and write
 clean
7A0000
unkown
page readonly
 clean
33F04000
unkown
page read and write
 clean
732000
unkown
page read and write
 clean
33EDC000
unkown
page read and write
 clean
3A0000
unkown
page readonly
 clean
4A0000
unkown
page readonly
 clean
6D1000
unkown
page read and write
 clean
1562000
unkown
page readonly
 clean
287000
heap default
page read and write
 clean
F49000
heap private
page read and write
 clean
E0000
unkown
page read and write
 clean
9A7000
unkown
page readonly
 clean
480000
unkown
page readonly
 clean
1605000
unkown
page readonly
 clean
D24000
heap private
page read and write
 clean
196000
unkown
page read and write
 clean
15E6000
unkown
page readonly
 clean
33930000
unkown
page readonly
 clean
33120000
unkown
page readonly
 clean
346C3000
unkown
page read and write
 clean
494000
heap private
page read and write
 clean
334C0000
heap private
page read and write
 clean
34681000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
32FB0000
unkown
page write copy
 clean
32BF6000
heap private
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
6E849000
unkown image
page readonly
 clean
732000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
283000
unkown
page read and write
 clean
32C38000
heap private
page read and write
 clean
2A0000
unkown
page read and write
 clean
15C2000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
6D1000
unkown
page read and write
 clean
100000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
33540000
unkown
page readonly
 clean
15F2000
unkown
page readonly
 clean
3A0000
unkown
page execute and read and write
 clean
710000
unkown
page read and write
 clean
710000
unkown
page read and write
 clean
730000
unkown
page read and write
 clean
16C000
unkown
page read and write
 clean
EEC000
unkown
page read and write
 clean
D0000
unkown
page read and write
 clean
346A5000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
16B5000
unkown
page readonly
 clean
6E420000
unkown image
page readonly
 clean
20A000
unkown
page read and write
 clean
164D000
unkown
page readonly
 clean
283000
unkown
page read and write
 clean
23AC000
unkown
page read and write
 clean
1564000
unkown
page readonly
 clean
346C3000
unkown
page read and write
 clean
300000
unkown
page read and write
 clean
33ED7000
unkown
page read and write
 clean
16C9000
unkown
page readonly
 clean
33EED000
unkown
page read and write
 clean
33ED5000
unkown
page read and write
 clean
33F48000
unkown
page read and write
 clean
33ED5000
unkown
page read and write
 clean
260000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
1368000
unkown
page readonly
 clean
333C0000
heap private
page read and write
 clean
710000
unkown
page read and write
 clean
321FA000
heap private
page read and write
 clean
146F000
unkown
page read and write
 clean
500000
unkown
page readonly
 clean
710000
unkown
page read and write
 clean
C50000
heap private
page read and write
 clean
33E9F000
unkown
page read and write
 clean
60000
unkown
page execute and read and write
 clean
6A7000
heap default
page read and write
 clean
630000
unkown
page execute and read and write
 clean
1FA000
heap default
page read and write
 clean
1F00000
heap private
page read and write
 clean
33EA6000
unkown
page read and write
 clean
190000
heap default
page read and write
 clean
16E5000
unkown
page readonly
 clean
3311C000
unkown
page read and write
 clean
1CE000
heap default
page read and write
 clean
15B6000
unkown
page readonly
 clean
1B10000
unkown
page readonly
 clean
34681000
unkown
page read and write
 clean
CD0000
unkown
page write copy
 clean
1692000
unkown
page readonly
 clean
332D0000
heap private
page read and write
 clean
359D0000
heap private
page read and write
 clean
1890000
unkown
page readonly
 clean
32BF0000
heap private
page read and write
 clean
26D000
heap default
page read and write
 clean
3467E000
unkown
page read and write
 clean
1592000
unkown
page readonly
 clean
1646000
unkown
page readonly
 clean
1F0000
heap default
page read and write
 clean
197000
heap default
page read and write
 clean
D0000
unkown
page read and write
 clean
6E421000
unkown image
page execute read
 clean
32BF1000
heap private
page read and write
 clean
328F3000
heap private
page read and write
 clean
6D1000
unkown
page read and write
 clean
1090000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
6EC000
unkown
page read and write
 clean
203000
heap default
page read and write
 clean
600000
unkown
page readonly
 clean
32AF1000
heap private
page read and write
 clean
510000
unkown
page readonly
 clean
3F0000
unkown
page execute and read and write
 clean
F40000
heap private
page read and write
 clean
22F0000
heap private
page read and write
 clean
E0000
unkown
page read and write
 clean
100000
unkown
page write copy
 clean
284000
unkown
page read and write
 clean
1E9F000
heap private
page read and write
 clean
620000
unkown
page readonly
 clean
6FA000
unkown
page read and write
 clean
A0000
unkown
page execute and read and write
 clean
6E420000
unkown image
page readonly
 clean
156000
unkown
page read and write
 clean
D5B000
heap private
page read and write
 clean
6E86C000
unkown image
page readonly
 clean
1699000
unkown
page readonly
 clean
22F4000
heap private
page read and write
 clean
1C0000
heap private
page read and write
 clean
F90000
unkown
page read and write
 clean
15C000
unkown
page read and write
 clean
1616000
unkown
page readonly
 clean
2B0000
heap default
page read and write
 clean
490000
heap private
page read and write
 clean
272000
heap default
page read and write
 clean
1F20000
heap private
page read and write
 clean
810000
unkown
page readonly
 clean
15BF000
unkown
page read and write
 clean
1DC0000
unkown
page readonly
 clean
340E0000
unkown
page readonly
 clean
346A5000
unkown
page read and write
 clean
33EF7000
unkown
page read and write
 clean
20D000
heap default
page read and write
 clean
33EDA000
unkown
page read and write
 clean
334D3000
heap private
page read and write
 clean
35B70000
heap private
page read and write
 clean
290000
unkown
page readonly
 clean
2B7000
heap default
page read and write
 clean
328F3000
heap private
page read and write
 clean
1622000
unkown
page readonly
 clean
18B0000
unkown
page readonly
 clean
33EDB000
unkown
page read and write
 clean
470000
heap private
page read and write
 clean
266000
heap default
page read and write
 clean
A0000
unkown
page read and write
 clean
1F2000
stack
page read and write
 clean
530000
unkown
page readonly
 clean
1524000
unkown
page readonly
 clean
336000
unkown
page read and write
 clean
400000
heap default
page read and write
 clean
FE0000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
19C000
unkown
page read and write
 clean
6DE000
unkown
page read and write
 clean
FB000
unkown
page read and write
 clean
2312000
heap private
page read and write
 clean
7C0000
unkown
page readonly
 clean
33F2A000
unkown
page read and write
 clean
15D5000
unkown
page readonly
 clean
7C0000
unkown
page readonly
 clean
700000
unkown
page readonly
 clean
1662000
unkown
page readonly
 clean
3330B000
heap private
page read and write
 clean
90000
unkown
page read and write
 clean
1A0000
heap default
page read and write
 clean
31DFE000
heap private
page read and write
 clean
346A6000
unkown
page read and write
 clean
167D000
unkown
page read and write
 clean
6D1000
unkown
page read and write
 clean
7D0000
heap private
page read and write
 clean
33ED5000
unkown
page read and write
 clean
18D0000
unkown
page readonly
 clean
1C9E000
unkown
page read and write
 clean
1CB0000
heap private
page read and write
 clean
2EE000
heap default
page read and write
 clean
1669000
unkown
page readonly
 clean
34490000
heap private
page read and write
 clean
34680000
unkown
page read and write
 clean
6E86A000
unkown image
page read and write
 clean
33EE5000
unkown
page read and write
 clean
1522000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
930000
heap private
page read and write
 clean
C8F000
unkown
page read and write
 clean
6D1000
unkown
page read and write
 clean
1649000
unkown
page readonly
 clean
731000
unkown
page read and write
 clean
There are 259 hidden memdumps, click here to show them.