IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Sign-1870635479_637332644.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Feb 19 10:48:36 2021, Security: 0
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
downloaded
malicious
C:\Users\user\BASE.BABAA
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
clean
C:\Users\user\AppData\Local\Temp\B7DE0000
data
dropped
clean
C:\Users\user\AppData\Local\Temp\Cab563C.tmp
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
clean
C:\Users\user\AppData\Local\Temp\Tar563D.tmp
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Sat Feb 20 16:47:41 2021, atime=Sat Feb 20 16:47:41 2021, length=12288, window=hide
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Sign-1870635479_637332644.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Sat Feb 20 16:47:41 2021, atime=Sat Feb 20 16:47:41 2021, length=168448, window=hide
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Roaming\QNetMonitor3154395120\AlternateServices.txt
ASCII text, with very long lines, with CRLF line terminators
modified
clean
C:\Users\user\Desktop\EADE0000
Applesoft BASIC program data, first line number 16
dropped
clean
There are 5 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\BASE.BABAA,DllRegisterServer
malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32 ..\BASE.BABAA,DllRegisterServer
malicious
C:\Windows\System32\wermgr.exe
C:\Windows\system32\wermgr.exe
malicious
C:\Windows\System32\wermgr.exe
C:\Windows\system32\wermgr.exe
malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.EXE 'C:\Users\user\AppData\Roaming\QNetMonitor3154395120\ujBASEmc.rrd',DllRegisterServer
malicious
C:\Windows\System32\taskeng.exe
taskeng.exe {C999D15C-7BEE-4793-989A-0EF4E6A22007} S-1-5-18:NT AUTHORITY\System:Service:
clean

URLs

Name
IP
Malicious
http://www.chipmania.it/mails/open.php
185.81.0.78
malicious
http://www.windows.com/pctv.
unknown
clean
http://investor.msn.com
unknown
clean
http://www.msnbc.com/news/ticker.txt
unknown
clean
http://crl.entrust.net/server1.crl0
unknown
clean
https://ident.me/
unknown
clean
http://cps.letsencrypt.org0
unknown
clean
http://ocsp.entrust.net03
unknown
clean
http://crl.microsofv
unknown
clean
https://193.8.194.96/rob60/134349_W617601.1D7953BB38B5711FB702EBB79BB8BAD5/14/NAT%20status/client%20
unknown
clean
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
clean
http://www.diginotar.nl/cps/pkioverheid0
unknown
clean
http://r3.i.lencr.org/0;
unknown
clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
clean
http://www.hotmail.com/oe
unknown
clean
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
clean
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
clean
http://www.icra.org/vocabulary/.
unknown
clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
clean
https://103.233.118.34:447/rob60/134349_W617601.1D7953BB38B5711FB702EBB79BB8BAD5/5/pwgrab64/
unknown
clean
http://investor.msn.com/
unknown
clean
https://103.220.47.220:447/rob60/134349_W617601.1D7953BB38B5711FB702EBB79BB8BAD5/5/pwgrab64/
unknown
clean
https://45.155.173.242/rob60/134349_W617601.1D7953BB38B5711FB702EBB79BB8BAD5/5/file/
unknown
clean
http://r3.o.lencr.org0
unknown
clean
http://www.%s.comPA
unknown
clean
http://ocsp.entrust.net0D
unknown
clean
https://secure.comodo.com/CPS0
unknown
clean
http://servername/isapibackend.dll
unknown
clean
http://crl.entrust.net/2048ca.crl0
unknown
clean
http://cps.root-x1.letsencrypt.org0
unknown
clean
There are 20 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ident.me
176.58.123.25
clean
chipmania.it
185.81.0.78
clean
38.52.17.84.zen.spamhaus.org
unknown
clean
38.52.17.84.cbl.abuseat.org
unknown
clean
38.52.17.84.dnsbl-1.uceprotect.net
unknown
clean
www.chipmania.it
unknown
clean
38.52.17.84.b.barracudacentral.org
unknown
clean
38.52.17.84.spam.dnsbl.sorbs.net
unknown
clean

IPs

IP
Domain
Country
Active
Malicious
45.155.173.242
unknown
Germany
unknown
malicious
5.202.150.151
unknown
Iran (ISLAMIC Republic Of)
unknown
malicious
193.8.194.96
unknown
United Kingdom
unknown
malicious
185.81.0.78
unknown
Italy
unknown
clean
194.5.249.156
unknown
Romania
unknown
clean
103.220.47.220
unknown
Indonesia
unknown
clean
176.58.123.25
unknown
United Kingdom
unknown
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ya1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED134
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED5D6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED76B
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDAA6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDB71
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
gp1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F51B9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F5679
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\system32\qagentrt.dll,-10
clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\System32\fveui.dll,-843
clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\System32\fveui.dll,-844
clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\System32\wuaueng.dll,-400
clean
C:\Windows\System32\wermgr.exe
Blob
clean
C:\Windows\System32\wermgr.exe
Blob
clean
C:\Windows\System32\wermgr.exe
Blob
clean
C:\Windows\System32\wermgr.exe
Blob
clean
C:\Windows\System32\wermgr.exe
Blob
clean
C:\Windows\System32\wermgr.exe
Blob
clean
C:\Windows\System32\wermgr.exe
Blob
clean
C:\Windows\System32\taskeng.exe
data
clean
There are 107 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
230000
unkown
page execute and read and write
malicious
324000
unkown
page read and write
malicious
324000
unkown
page read and write
malicious
878000
unkown
page read and write
malicious
2F0000
heap default
page read and write
malicious
2F4000
heap private
page read and write
clean
20000
unkown
page readonly
clean
160000
unkown
page read and write
clean
32E50000
unkown
page readonly
clean
1362000
unkown
page readonly
clean
2F7000
heap default
page read and write
clean
3360B000
unkown
page read and write
clean
200000
unkown
page readonly
clean
336000
unkown
page read and write
clean
1F69000
heap private
page read and write
clean
2E0000
unkown
page read and write
clean
67000
heap default
page read and write
clean
1268000
unkown
page readonly
clean
3E1000
unkown
page read and write
clean
164000
heap private
page read and write
clean
14E6000
unkown
page readonly
clean
3362C000
unkown
page read and write
clean
1D90000
unkown
page write copy
clean
7E0000
unkown
page readonly
clean
1752000
unkown
page readonly
clean
9D0000
heap private
page read and write
clean
1464000
unkown
page readonly
clean
32D01000
heap private
page read and write
clean
20000
unkown
page read and write
clean
33615000
unkown
page read and write
clean
CC000
unkown
page read and write
clean
15C2000
unkown
page readonly
clean
337A0000
unkown
page readonly
clean
E0000
heap private
page read and write
clean
EC0000
unkown
page readonly
clean
2457000
stack
page read and write
clean
1E10000
unkown
page readonly
clean
20000
unkown
page readonly
clean
720000
unkown
page readonly
clean
21E000
heap default
page read and write
clean
9E0000
heap private
page read and write
clean
33B90000
unkown
page readonly
clean
454000
heap private
page read and write
clean
34050000
heap private
page read and write
clean
34715000
unkown
page read and write
clean
970000
heap private
page read and write
clean
28E000
heap default
page read and write
clean
270000
unkown
page execute and read and write
clean
350000
unkown
page read and write
clean
35C000
unkown
page read and write
clean
3335B000
heap private
page read and write
clean
32B03000
heap private
page read and write
clean
EBF000
unkown
page read and write
clean
34180000
unkown
page readonly
clean
160000
heap private
page read and write
clean
166000
unkown
page read and write
clean
510000
unkown
page readonly
clean
33682000
unkown
page read and write
clean
6DFF1000
unkown image
page execute read
clean
3362F000
unkown
page read and write
clean
9C7000
unkown
page readonly
clean
31A000
unkown
page read and write
clean
32E01000
heap private
page read and write
clean
2F1000
unkown
page read and write
clean
3361B000
unkown
page read and write
clean
33664000
unkown
page read and write
clean
32717000
heap private
page read and write
clean
32E06000
heap private
page read and write
clean
34715000
unkown
page read and write
clean
31A000
unkown
page read and write
clean
170000
unkown
page read and write
clean
1E0000
unkown
page read and write
clean
92000
stack
page read and write
clean
386000
unkown
page read and write
clean
570000
unkown
page readonly
clean
33631000
unkown
page read and write
clean
E3F000
unkown
page read and write
clean
1A0000
heap default
page read and write
clean
290000
heap default
page read and write
clean
1F9F000
heap private
page read and write
clean
35A000
heap default
page read and write
clean
150000
unkown
page read and write
clean
346F1000
unkown
page read and write
clean
830000
unkown
page read and write
clean
3361C000
unkown
page read and write
clean
128E000
unkown
page read and write
clean
400000
unkown
page readonly
clean
220000
unkown
page readonly
clean
992000
heap private
page read and write
clean
33614000
unkown
page read and write
clean
335C1000
unkown
page read and write
clean
1FF7000
unkown
page readonly
clean
450000
heap private
page read and write
clean
34733000
unkown
page read and write
clean
33613000
unkown
page read and write
clean
2110000
heap private
page read and write
clean
34715000
unkown
page read and write
clean
1FC000
unkown
page read and write
clean
32B03000
heap private
page read and write
clean
CAC000
unkown
page read and write
clean
CB0000
unkown
page read and write
clean
6E43A000
unkown image
page read and write
clean
2030000
heap private
page read and write
clean
14A5000
unkown
page readonly
clean
790000
unkown
page execute and read and write
clean
14C2000
unkown
page readonly
clean
150000
unkown
page read and write
clean
6DFF0000
unkown image
page readonly
clean
3360A000
unkown
page read and write
clean
332FE000
unkown
page read and write
clean
1505000
unkown
page readonly
clean
33613000
unkown
page read and write
clean
33609000
unkown
page read and write
clean
3361A000
unkown
page read and write
clean
2E0000
unkown
page read and write
clean
1B10000
heap private
page read and write
clean
235C000
unkown
page read and write
clean
17D0000
unkown
page readonly
clean
33540000
heap private
page read and write
clean
7F0000
unkown
page execute and read and write
clean
1C9F000
unkown
page read and write
clean
1522000
unkown
page readonly
clean
710000
unkown
page readonly
clean
1E0000
heap default
page read and write
clean
3360A000
unkown
page read and write
clean
1D67000
unkown
page readonly
clean
770000
unkown
page readonly
clean
33603000
unkown
page read and write
clean
160000
unkown
page read and write
clean
352000
unkown
page read and write
clean
3402F000
unkown
page read and write
clean
3347C000
unkown
page read and write
clean
335E6000
unkown
page read and write
clean
33613000
unkown
page read and write
clean
3363F000
unkown
page read and write
clean
230000
unkown
page read and write
clean
1585000
unkown
page readonly
clean
3361C000
unkown
page read and write
clean
3E1000
unkown
page read and write
clean
33613000
unkown
page read and write
clean
1422000
unkown
page readonly
clean
350000
unkown
page read and write
clean
974000
heap private
page read and write
clean
EE0000
unkown
page readonly
clean
2F1000
unkown
page read and write
clean
1B80000
unkown
page readonly
clean
34715000
unkown
page read and write
clean
BCB000
heap private
page read and write
clean
AD000
unkown
page read and write
clean
3C6000
heap default
page read and write
clean
A0000
unkown
page execute and read and write
clean
D00000
heap private
page read and write
clean
1492000
unkown
page readonly
clean
14D5000
unkown
page readonly
clean
10001000
unkown
page execute and read and write
clean
32A04000
heap private
page read and write
clean
170000
unkown
page readonly
clean
33615000
unkown
page read and write
clean
6DFF0000
unkown image
page readonly
clean
3361C000
unkown
page read and write
clean
3361E000
unkown
page read and write
clean
33720000
heap private
page read and write
clean
2B4000
heap default
page read and write
clean
330000
unkown
page read and write
clean
280000
unkown
page write copy
clean
33617000
unkown
page read and write
clean
2F1000
unkown
page read and write
clean
450000
unkown
page readonly
clean
300000
unkown
page read and write
clean
1790000
unkown
page readonly
clean
155D000
unkown
page read and write
clean
1F60000
heap private
page read and write
clean
2370000
heap private
page read and write
clean
60000
heap default
page read and write
clean
216000
unkown
page read and write
clean
20000
unkown
page readonly
clean
257000
heap default
page read and write
clean
2CD000
heap default
page read and write
clean
120F000
unkown
page read and write
clean
36A000
unkown
page read and write
clean
2C7000
heap default
page read and write
clean
12B000
unkown
page read and write
clean
33325000
heap private
page read and write
clean
20000
unkown
page readonly
clean
316000
unkown
page read and write
clean
2F1000
unkown
page read and write
clean
33622000
unkown
page read and write
clean
460000
unkown
page readonly
clean
1599000
unkown
page readonly
clean
C0000
unkown
page readonly
clean
30C000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
3360F000
unkown
page read and write
clean
E4000
heap private
page read and write
clean
33613000
unkown
page read and write
clean
1549000
unkown
page readonly
clean
352000
unkown
page read and write
clean
180000
unkown
page readonly
clean
3CF000
heap default
page read and write
clean
2E0000
unkown
page read and write
clean
33615000
unkown
page read and write
clean
1262000
unkown
page readonly
clean
170000
unkown
page readonly
clean
5E0000
unkown
page readonly
clean
33320000
heap private
page read and write
clean
6B0000
unkown
page readonly
clean
1462000
unkown
page readonly
clean
580000
unkown
page readonly
clean
15C9000
unkown
page readonly
clean
250000
heap default
page read and write
clean
17B0000
unkown
page readonly
clean
6E43C000
unkown image
page readonly
clean
5D0000
unkown
page readonly
clean
1FE0000
unkown
page readonly
clean
D0000
unkown
page read and write
clean
1562000
unkown
page readonly
clean
2B3000
heap default
page read and write
clean
EC0000
unkown
page readonly
clean
E0000
unkown
page readonly
clean
154D000
unkown
page readonly
clean
1592000
unkown
page readonly
clean
A00000
heap private
page read and write
clean
3D1000
heap default
page read and write
clean
32E00000
heap private
page read and write
clean
9E000
heap default
page read and write
clean
1442000
unkown
page readonly
clean
351000
unkown
page read and write
clean
2F0000
heap default
page read and write
clean
1444000
unkown
page readonly
clean
33733000
heap private
page read and write
clean
330000
unkown
page read and write
clean
E49000
heap private
page read and write
clean
346F1000
unkown
page read and write
clean
1D8F000
unkown
page read and write
clean
34734000
unkown
page read and write
clean
34040000
heap private
page read and write
clean
335F7000
unkown
page read and write
clean
E0000
unkown
page readonly
clean
60000
unkown
page execute and read and write
clean
33D77000
unkown
page readonly
clean
32E000
heap default
page read and write
clean
3EA000
unkown
page read and write
clean
15E5000
unkown
page readonly
clean
32E3C000
heap private
page read and write
clean
3361C000
unkown
page read and write
clean
E40000
heap private
page read and write
clean
6E419000
unkown image
page readonly
clean
34670000
heap private
page read and write
clean
15B5000
unkown
page readonly
clean
B90000
heap private
page read and write
clean
1E7000
heap default
page read and write
clean
1535000
unkown
page readonly
clean
1516000
unkown
page readonly
clean
2FE000
unkown
page read and write
clean
297000
heap default
page read and write
clean
2F1000
unkown
page read and write
clean
BC0000
unkown
page write copy
clean
36D000
heap default
page read and write
clean
390000
unkown
page readonly
clean
330000
unkown
page read and write
clean
350000
heap default
page read and write
clean
1569000
unkown
page readonly
clean
D0000
unkown
page read and write
clean
14B6000
unkown
page readonly
clean
33614000
unkown
page read and write
clean
3E2000
unkown
page read and write
clean
3360F000
unkown
page read and write
clean
330000
unkown
page read and write
clean
6E454000
unkown image
page readonly
clean
1EFB000
unkown
page read and write
clean
B94000
heap private
page read and write
clean
1424000
unkown
page readonly
clean
3F0000
unkown
page readonly
clean
335C0000
unkown
page read and write
clean
1546000
unkown
page readonly
clean
346F0000
unkown
page read and write
clean
2F0000
heap private
page read and write
clean
335DF000
unkown
page read and write
clean
14F2000
unkown
page readonly
clean
130000
unkown
page readonly
clean
There are 270 hidden memdumps, click here to show them.