IOCReport

loading gif

Files

File Path
Type
Category
Malicious
QTN3C2AF414EDF9_041873.xlsx
CDFV2 Encrypted
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winlog[1]
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
downloaded
malicious
C:\Users\user\Desktop\~$QTN3C2AF414EDF9_041873.xlsx
data
dropped
malicious
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1CFA2F95.jpeg
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5D657FE6.png
PNG image data, 712 x 712, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AC9322AF.jpeg
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C6617CE4.png
PNG image data, 712 x 712, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E1722339.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
clean
C:\Users\user\AppData\Local\Temp\nsgE449.tmp
data
dropped
clean
C:\Users\user\AppData\Local\Temp\nsqE488.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
clean
C:\Users\user\AppData\Local\Temp\tjqth.zz
data
dropped
clean
C:\Users\user\AppData\Local\Temp\z9ayiyo.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
clean
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
malicious
C:\Users\Public\vbc.exe
'C:\Users\Public\vbc.exe'
malicious
C:\Users\Public\vbc.exe
'C:\Users\Public\vbc.exe'
malicious
C:\Windows\explorer.exe
malicious
C:\Windows\SysWOW64\ipconfig.exe
C:\Windows\SysWOW64\ipconfig.exe
malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
clean
C:\Windows\SysWOW64\cmd.exe
/c del 'C:\Users\Public\vbc.exe'
clean

URLs

Name
IP
Malicious
http://www.athara-kiano.com/nsag/?SFN=1e70w6qoH0iHBmxDX27vpOpA5lfYuhHzBJ3+ZXyYbvrIHeDq+MUfY30bwUf90UJ6GkTmZw==&cBb=LtD0g
103.251.44.218
malicious
http://search.chol.com/favicon.ico
unknown
clean
http://www.mercadolivre.com.br/
unknown
clean
http://www.merlin.com.pl/favicon.ico
unknown
clean
http://search.ebay.de/
unknown
clean
http://www.mtv.com/
unknown
clean
http://www.rambler.ru/
unknown
clean
http://www.nifty.com/favicon.ico
unknown
clean
http://www.dailymail.co.uk/
unknown
clean
http://www3.fnac.com/favicon.ico
unknown
clean
http://buscar.ya.com/
unknown
clean
http://search.yahoo.com/favicon.ico
unknown
clean
http://www.iis.fhg.de/audioPA
unknown
clean
http://www.sogou.com/favicon.ico
unknown
clean
http://asp.usatoday.com/
unknown
clean
http://fr.search.yahoo.com/
unknown
clean
http://rover.ebay.com
unknown
clean
http://in.search.yahoo.com/
unknown
clean
http://img.shopzilla.com/shopzilla/shopzilla.ico
unknown
clean
http://search.ebay.in/
unknown
clean
http://image.excite.co.jp/jp/favicon/lep.ico
unknown
clean
http://%s.com
unknown
clean
http://msk.afisha.ru/
unknown
clean
http://busca.igbusca.com.br//app/static/images/favicon.ico
unknown
clean
http://search.rediff.com/
unknown
clean
http://www.windows.com/pctv.
unknown
clean
http://www.ya.com/favicon.ico
unknown
clean
http://www.etmall.com.tw/favicon.ico
unknown
clean
http://it.search.dada.net/favicon.ico
unknown
clean
http://search.naver.com/
unknown
clean
http://www.google.ru/
unknown
clean
http://search.hanafos.com/favicon.ico
unknown
clean
http://cgi.search.biglobe.ne.jp/favicon.ico
unknown
clean
http://www.abril.com.br/favicon.ico
unknown
clean
http://search.daum.net/
unknown
clean
http://search.naver.com/favicon.ico
unknown
clean
http://search.msn.co.jp/results.aspx?q=
unknown
clean
http://www.clarin.com/favicon.ico
unknown
clean
http://buscar.ozu.es/
unknown
clean
http://kr.search.yahoo.com/
unknown
clean
http://search.about.com/
unknown
clean
http://busca.igbusca.com.br/
unknown
clean
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
unknown
clean
http://www.ask.com/
unknown
clean
http://www.priceminister.com/favicon.ico
unknown
clean
http://www.cjmall.com/
unknown
clean
http://search.centrum.cz/
unknown
clean
http://suche.t-online.de/
unknown
clean
http://www.google.it/
unknown
clean
http://search.auction.co.kr/
unknown
clean
http://www.ceneo.pl/
unknown
clean
http://www.amazon.de/
unknown
clean
http://nsis.sf.net/NSIS_Error
unknown
clean
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
unknown
clean
http://sads.myspace.com/
unknown
clean
http://busca.buscape.com.br/favicon.ico
unknown
clean
http://www.pchome.com.tw/favicon.ico
unknown
clean
http://browse.guardian.co.uk/favicon.ico
unknown
clean
http://google.pchome.com.tw/
unknown
clean
http://list.taobao.com/browse/search_visual.htm?n=15&q=
unknown
clean
http://www.rambler.ru/favicon.ico
unknown
clean
http://uk.search.yahoo.com/
unknown
clean
http://espanol.search.yahoo.com/
unknown
clean
http://www.ozu.es/favicon.ico
unknown
clean
http://search.sify.com/
unknown
clean
http://openimage.interpark.com/interpark.ico
unknown
clean
http://search.yahoo.co.jp/favicon.ico
unknown
clean
http://search.ebay.com/
unknown
clean
http://www.gmarket.co.kr/
unknown
clean
http://search.nifty.com/
unknown
clean
http://searchresults.news.com.au/
unknown
clean
http://www.google.si/
unknown
clean
http://www.google.cz/
unknown
clean
http://www.soso.com/
unknown
clean
http://www.univision.com/
unknown
clean
http://search.ebay.it/
unknown
clean
http://images.joins.com/ui_c/fvc_joins.ico
unknown
clean
http://www.asharqalawsat.com/
unknown
clean
http://busca.orange.es/
unknown
clean
http://cnweb.search.live.com/results.aspx?q=
unknown
clean
http://auto.search.msn.com/response.asp?MT=
unknown
clean
http://search.yahoo.co.jp
unknown
clean
http://www.target.com/
unknown
clean
http://buscador.terra.es/
unknown
clean
http://search.orange.co.uk/favicon.ico
unknown
clean
http://www.iask.com/
unknown
clean
http://www.tesco.com/
unknown
clean
http://cgi.search.biglobe.ne.jp/
unknown
clean
http://search.seznam.cz/favicon.ico
unknown
clean
http://suche.freenet.de/favicon.ico
unknown
clean
http://search.interpark.com/
unknown
clean
http://search.ipop.co.kr/favicon.ico
unknown
clean
http://investor.msn.com/
unknown
clean
http://search.espn.go.com/
unknown
clean
http://www.myspace.com/favicon.ico
unknown
clean
http://search.centrum.cz/favicon.ico
unknown
clean
http://p.zhongsou.com/favicon.ico
unknown
clean
http://service2.bfast.com/
unknown
clean
http://www.%s.comPA
unknown
clean
http://ariadna.elmundo.es/
unknown
clean
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
overseaexpert.com
191.96.163.202
malicious
athara-kiano.com
103.251.44.218
malicious
www.fashionwatchesstore.com
104.21.61.250
malicious
www.evoslancete.com
unknown
malicious
www.athara-kiano.com
unknown
malicious
www.oryanomer.com
unknown
malicious
www.overseaexpert.com
unknown
malicious
ow.ly
54.67.57.56
clean
algreenstdykeghestqw.dns.army
103.140.251.164
clean
oryanos-env.eba-4sqpgjbe.eu-central-1.elasticbeanstalk.com
52.57.196.177
clean

IPs

IP
Domain
Country
Active
Malicious
191.96.163.202
unknown
Chile
unknown
malicious
104.21.61.250
unknown
United States
unknown
malicious
103.251.44.218
unknown
Indonesia
unknown
malicious
103.140.251.164
unknown
Viet Nam
unknown
clean
54.67.57.56
unknown
United States
unknown
clean
52.57.196.177
unknown
United States
unknown
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
;l8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F0454
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
-s8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F4E30
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F5DBA
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 21
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F4E30
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EquationEditorFilesIntl_1033
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
SavedLegacySettings
clean
There are 50 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown image
page execute and read and write
malicious
80000
unkown
page execute and read and write
malicious
1F0000
unkown
page execute and read and write
malicious
400000
unkown
page execute and read and write
malicious
2900000
unkown
page read and write
malicious
3A0000
unkown
page execute and read and write
malicious
2B0000
unkown
page read and write
malicious
230000
unkown
page execute and read and write
malicious
2D70000
unkown
page read and write
clean
2A90000
unkown
page read and write
clean
2D30000
unkown
page read and write
clean
2E2E000
unkown
page read and write
clean
2EC0000
unkown
page read and write
clean
2E4D000
unkown
page read and write
clean
B0AB000
unkown
page read and write
clean
2BB000
heap default
page read and write
clean
27A0000
unkown
page read and write
clean
380000
unkown
page read and write
clean
CCA3000
unkown
page read and write
clean
44C0000
unkown
page read and write
clean
220000
unkown
page read and write
clean
1BB0000
unkown
page readonly
clean
2AB4000
unkown
page read and write
clean
2FF1000
unkown
page read and write
clean
5E4A000
unkown
page readonly
clean
1D7000
heap default
page read and write
clean
966B000
unkown
page readonly
clean
854C000
unkown
page read and write
clean
710B000
unkown
page read and write
clean
2E4D000
unkown
page read and write
clean
1A0000
unkown
page execute and read and write
clean
BB0000
unkown
page execute and read and write
clean
8B000
unkown
page read and write
clean
4051000
unkown
page read and write
clean
35A2000
unkown
page readonly
clean
2F00000
unkown
page read and write
clean
2E50000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
46B0000
unkown
page read and write
clean
2180000
unkown
page execute and read and write
clean
35FD000
unkown
page readonly
clean
2954000
heap private
page read and write
clean
720000
unkown
page read and write
clean
20000
unkown
page readonly
clean
8B0000
unkown
page execute and read and write
clean
2FE0000
unkown
page read and write
clean
1FC2000
heap private
page read and write
clean
86B0000
unkown
page read and write
clean
824000
unkown
page read and write
clean
49FD000
unkown
page read and write
clean
3635000
unkown
page readonly
clean
3412000
unkown
page readonly
clean
3672000
unkown
page readonly
clean
220000
unkown
page read and write
clean
C6E0000
unkown
page read and write
clean
2390000
unkown
page execute and read and write
clean
77F9000
unkown
page read and write
clean
7C0000
unkown
page readonly
clean
25A0000
unkown
page readonly
clean
4F4000
heap default
page read and write
clean
2D0000
unkown
page read and write
clean
BCF0000
heap private
page read and write
clean
220000
unkown
page read and write
clean
827000
unkown
page read and write
clean
30B000
unkown
page read and write
clean
C120000
unkown
page read and write
clean
3649000
unkown
page readonly
clean
260000
heap default
page read and write
clean
8AC2000
unkown
page readonly
clean
A20000
unkown
page execute and read and write
clean
324000
heap default
page read and write
clean
96F4000
unkown
page readonly
clean
6CF000
stack
page read and write
clean
8140000
unkown
page read and write
clean
2CC0000
unkown
page read and write
clean
46E0000
unkown
page read and write
clean
4DF000
unkown
page read and write
clean
2EC0000
unkown
page readonly
clean
260000
heap default
page read and write
clean
20A0000
unkown
page execute and read and write
clean
888E000
unkown
page read and write
clean
2FF1000
unkown
page read and write
clean
F0000
unkown
page read and write
clean
6888000
unkown
page readonly
clean
2EF5000
heap private
page read and write
clean
3596000
unkown
page readonly
clean
27A0000
unkown
page read and write
clean
2B30000
unkown
page readonly
clean
856E000
unkown
page read and write
clean
A40000
unkown
page execute and read and write
clean
2510000
unkown
page write copy
clean
401000
unkown image
page execute read
clean
2B50000
unkown
page readonly
clean
690000
unkown
page readonly
clean
2FC1000
unkown
page read and write
clean
2520000
unkown
page readonly
clean
2700000
unkown
page readonly
clean
2E60000
unkown
page readonly
clean
2B30000
unkown
page readonly
clean
438000
unkown image
page readonly
clean
4060000
unkown
page read and write
clean
2EF0000
unkown
page read and write
clean
540000
heap default
page read and write
clean
1F90000
unkown
page readonly
clean
2EE0000
unkown
page readonly
clean
43D0000
unkown
page write copy
clean
2830000
unkown
page read and write
clean
2F7000
heap default
page read and write
clean
3B98000
unkown
page read and write
clean
231000
heap default
page read and write
clean
26D0000
unkown
page readonly
clean
2FC1000
unkown
page read and write
clean
401000
unkown image
page execute read
clean
8C2A000
unkown
page readonly
clean
220000
unkown
page read and write
clean
2E90000
unkown
page read and write
clean
190000
unkown
page read and write
clean
60000
unkown
page readonly
clean
2FF4000
unkown
page read and write
clean
2010000
unkown
page read and write
clean
2ED0000
unkown
page readonly
clean
2E7A000
unkown
page read and write
clean
2CE0000
unkown
page read and write
clean
1DD000
heap default
page read and write
clean
1E8A000
unkown
page read and write
clean
4610000
unkown
page read and write
clean
46F000
unkown
page read and write
clean
1F00000
unkown
page read and write
clean
2710000
unkown
page readonly
clean
1F4E000
unkown
page read and write
clean
2550000
unkown
page read and write
clean
9B4000
unkown
page execute and read and write
clean
24B0000
unkown
page write copy
clean
1F5000
heap default
page read and write
clean
1FF0000
unkown
page read and write
clean
689E000
unkown
page readonly
clean
6914000
unkown
page readonly
clean
E0000
unkown
page readonly
clean
2220000
unkown
page execute and read and write
clean
2F00000
unkown
page read and write
clean
4291000
unkown
page read and write
clean
2CE0000
unkown
page read and write
clean
27A0000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
2B40000
unkown
page readonly
clean
2910000
unkown
page read and write
clean
1EC000
unkown
page read and write
clean
8AF000
stack
page read and write
clean
2CB0000
unkown
page read and write
clean
16E000
unkown
page read and write
clean
27A0000
unkown
page read and write
clean
2E80000
unkown
page read and write
clean
72E30000
unkown image
page readonly
clean
2990000
unkown
page readonly
clean
3619000
unkown
page readonly
clean
2690000
unkown
page readonly
clean
38A0000
unkown
page readonly
clean
810000
unkown
page readonly
clean
1BF0000
heap private
page read and write
clean
1C0000
unkown
page readonly
clean
3000000
unkown
page read and write
clean
1D0000
heap default
page read and write
clean
2E40000
unkown
page read and write
clean
2FC4000
unkown
page read and write
clean
7B40000
unkown
page read and write
clean
7A0000
heap private
page read and write
clean
1B9A000
unkown
page read and write
clean
2AB4000
unkown
page read and write
clean
968E000
unkown
page readonly
clean
190000
unkown
page read and write
clean
CB66000
unkown
page read and write
clean
73EE000
unkown
page read and write
clean
1BB0000
unkown
page readonly
clean
2666000
unkown
page read and write
clean
2E38000
unkown
page read and write
clean
365000
heap default
page read and write
clean
1C0000
unkown
page readonly
clean
3060000
unkown
page read and write
clean
438000
unkown image
page readonly
clean
1D0000
heap default
page read and write
clean
722F1000
unkown image
page execute and write copy
clean
1E9000
heap default
page read and write
clean
9668000
unkown
page readonly
clean
20000
unkown
page readonly
clean
1B80000
unkown
page read and write
clean
8BCD000
unkown
page readonly
clean
2C2000
heap default
page read and write
clean
2722000
unkown
page read and write
clean
2070000
unkown
page readonly
clean
2ED0000
unkown
page read and write
clean
32F000
unkown
page read and write
clean
70FE000
unkown
page read and write
clean
4263000
unkown
page read and write
clean
1AF0000
unkown
page read and write
clean
419A000
unkown
page read and write
clean
6F77000
unkown
page read and write
clean
179000
unkown
page read and write
clean
2FD0000
unkown
page read and write
clean
2004000
unkown
page read and write
clean
25D000
heap default
page read and write
clean
890000
unkown
page read and write
clean
4070000
unkown
page readonly
clean
2300000
unkown
page execute and read and write
clean
1F8E000
unkown
page read and write
clean
2A71000
unkown
page read and write
clean
2FF7000
unkown
page read and write
clean
A3DF000
unkown
page write copy
clean
2FC4000
unkown
page read and write
clean
9B0000
unkown
page execute and read and write
clean
842E000
unkown
page read and write
clean
77F0000
unkown
page read and write
clean
1E7F000
unkown
page read and write
clean
6AA000
unkown
page read and write
clean
2A80000
unkown
page read and write
clean
967E000
unkown
page readonly
clean
40A000
unkown image
page read and write
clean
25F2000
unkown
page read and write
clean
220000
unkown
page read and write
clean
2EE0000
unkown
page readonly
clean
58AF000
unkown
page read and write
clean
4530000
heap private
page read and write
clean
E0000
unkown
page read and write
clean
9CB0000
heap private
page read and write
clean
C23E000
unkown
page read and write
clean
2C90000
unkown
page read and write
clean
34F4000
unkown
page readonly
clean
2570000
unkown
page readonly
clean
2EC0000
unkown
page read and write
clean
2F70000
unkown
page readonly
clean
1A0000
unkown
page read and write
clean
3AF0000
unkown
page read and write
clean
27C0000
heap private
page read and write
clean
550000
unkown
page readonly
clean
2950000
heap private
page read and write
clean
3060000
unkown
page read and write
clean
2EC0000
unkown
page readonly
clean
A3BE000
unkown
page write copy
clean
2A20000
unkown
page readonly
clean
20000
unkown
page read and write
clean
2E4A000
unkown
page read and write
clean
72F0000
heap private
page read and write
clean
2380000
unkown
page execute and read and write
clean
2060000
unkown
page readonly
clean
5B71000
unkown
page readonly
clean
2570000
unkown
page readonly
clean
90A5000
unkown
page readonly
clean
2007000
unkown
page read and write
clean
B361000
unkown
page read and write
clean
2540000
unkown
page read and write
clean
2E60000
unkown
page readonly
clean
530000
heap private
page read and write
clean
B149000
unkown
page read and write
clean
72E30000
unkown image
page readonly
clean
5A20000
heap private
page read and write
clean
2850000
unkown
page read and write
clean
688B000
unkown
page readonly
clean
1DB0000
unkown
page execute and read and write
clean
4D0000
heap default
page read and write
clean
810000
unkown
page read and write
clean
650000
heap private
page read and write
clean
4800000
heap private
page read and write
clean
24B0000
unkown
page write copy
clean
265C000
unkown
page read and write
clean
2A20000
unkown
page readonly
clean
2DBF000
unkown
page read and write
clean
2BE0000
unkown
page readonly
clean
2BE0000
unkown
page readonly
clean
2EE000
unkown
page read and write
clean
2CA0000
unkown
page read and write
clean
6AD000
unkown
page read and write
clean
2DBF000
unkown
page read and write
clean
9B7000
unkown
page execute and read and write
clean
2E70000
unkown
page read and write
clean
1BD0000
unkown
page read and write
clean
2EF9000
heap private
page read and write
clean
C320000
unkown
page read and write
clean
30B000
unkown
page read and write
clean
2F90000
unkown
page readonly
clean
2FC1000
unkown
page read and write
clean
230000
heap default
page read and write
clean
2E80000
unkown
page read and write
clean
3B30000
unkown
page read and write
clean
CAE0000
unkown
page read and write
clean
2B40000
unkown
page readonly
clean
2EF0000
unkown
page read and write
clean
2720000
unkown
page read and write
clean
5CE2000
unkown
page readonly
clean
329000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
296C000
unkown
page execute and read and write
clean
82DC000
unkown
page read and write
clean
1C70000
unkown
page readonly
clean
1F5000
heap default
page read and write
clean
2E7A000
unkown
page read and write
clean
2B50000
unkown
page readonly
clean
408000
unkown image
page readonly
clean
1BF5000
heap private
page read and write
clean
550000
unkown
page readonly
clean
2FB0000
unkown
page read and write
clean
2FE0000
unkown
page read and write
clean
26F0000
unkown
page readonly
clean
B0000
unkown
page write copy
clean
2710000
unkown
page readonly
clean
D4000
heap private
page read and write
clean
7EFDF000
unkown
page read and write
clean
6F0000
unkown
page readonly
clean
7EFDF000
unkown
page read and write
clean
594000
heap default
page read and write
clean
3030000
unkown
page read and write
clean
279F000
stack
page read and write
clean
7490000
unkown
page write copy
clean
26A0000
unkown
page read and write
clean
7A8B000
unkown
page read and write
clean
2E2E000
unkown
page read and write
clean
2943000
unkown
page execute and read and write
clean
2533000
unkown
page read and write
clean
BA0000
unkown
page execute and read and write
clean
2B20000
unkown
page readonly
clean
31F000
unkown
page read and write
clean
579E000
unkown
page read and write
clean
2D70000
unkown
page read and write
clean
1B40000
unkown
page readonly
clean
C6D0000
unkown
page read and write
clean
32A000
unkown
page read and write
clean
2B80000
unkown
page read and write
clean
B31000
unkown
page execute and read and write
clean
BFC3000
heap private
page read and write
clean
2B80000
unkown
page read and write
clean
2B20000
unkown
page readonly
clean
39EB000
unkown
page read and write
clean
280000
unkown
page readonly
clean
480A000
heap private
page read and write
clean
2FC4000
unkown
page read and write
clean
3060000
unkown
page read and write
clean
26F0000
unkown
page readonly
clean
1F10000
unkown
page read and write
clean
440000
unkown
page read and write
clean
2320000
unkown
page execute and read and write
clean
1BE0000
unkown
page read and write
clean
2FF4000
unkown
page read and write
clean
3D0000
unkown
page readonly
clean
34D4000
unkown
page readonly
clean
2510000
unkown
page write copy
clean
6FB3000
heap private
page read and write
clean
72E35000
unkown image
page readonly
clean
2E70000
unkown
page read and write
clean
2560000
unkown
page read and write
clean
38B0000
unkown
page read and write
clean
23AA000
unkown
page read and write
clean
35F6000
unkown
page readonly
clean
2666000
unkown
page read and write
clean
26B0000
unkown
page readonly
clean
2A50000
unkown
page readonly
clean
A53E000
unkown
page read and write
clean
4234000
unkown
page read and write
clean
2311000
unkown
page execute and read and write
clean
30D000
unkown
page read and write
clean
4130000
unkown
page read and write
clean
3585000
unkown
page readonly
clean
8666000
unkown
page read and write
clean
18C000
stack
page read and write
clean
7EFDF000
unkown
page read and write
clean
2C80000
unkown
page read and write
clean
2ED0000
unkown
page readonly
clean
D0000
heap private
page read and write
clean
5680000
heap private
page read and write
clean
BD70000
unkown
page read and write
clean
2FF7000
unkown
page read and write
clean
2EF9000
heap private
page read and write
clean
20000
unkown
page readonly
clean
5A1E000
unkown
page read and write
clean
2C0000
heap default
page read and write
clean
7040000
heap private
page read and write
clean
4440000
unkown
page read and write
clean
861C000
unkown
page read and write
clean
408000
unkown image
page readonly
clean
2CF0000
unkown
page read and write
clean
25F2000
unkown
page read and write
clean
2E7D000
unkown
page read and write
clean
3679000
unkown
page readonly
clean
2971000
heap private
page read and write
clean
C020000
unkown
page read and write
clean
B150000
unkown
page read and write
clean
414D000
unkown
page read and write
clean
39F0000
unkown
page read and write
clean
28F3000
unkown
page read and write
clean
1E80000
heap private
page read and write
clean
1E40000
unkown
page execute and read and write
clean
821000
unkown
page read and write
clean
44B0000
unkown
page write copy
clean
6F0000
unkown
page readonly
clean
2700000
unkown
page readonly
clean
5D0000
unkown
page read and write
clean
2EE000
unkown
page read and write
clean
34F2000
unkown
page readonly
clean
3612000
unkown
page readonly
clean
1E3000
heap default
page read and write
clean
3318000
unkown
page readonly
clean
18C000
stack
page read and write
clean
6988000
unkown
page readonly
clean
3840000
unkown
page readonly
clean
21E0000
unkown
page readonly
clean
640000
unkown
page readonly
clean
37E000
unkown
page read and write
clean
4B4E000
unkown
page read and write
clean
220000
unkown
page read and write
clean
20FF000
unkown
page read and write
clean
2DA0000
unkown
page read and write
clean
3030000
unkown
page read and write
clean
2200000
unkown
page execute and read and write
clean
4520000
unkown
page readonly
clean
E0000
unkown
page readonly
clean
2FD0000
unkown
page read and write
clean
A330000
unkown
page write copy
clean
A3B9000
unkown
page write copy
clean
2D0000
unkown
page read and write
clean
2EFE000
heap private
page read and write
clean
2D70000
unkown
page read and write
clean
F0000
unkown
page read and write
clean
30D000
unkown
page read and write
clean
830000
unkown
page read and write
clean
2F70000
unkown
page readonly
clean
26D0000
unkown
page readonly
clean
4196000
unkown
page read and write
clean
12C000
unkown
page read and write
clean
8662000
unkown
page read and write
clean
9BCF000
unkown
page readonly
clean
48B0000
heap private
page read and write
clean
220000
unkown
page read and write
clean
2FB0000
unkown
page read and write
clean
CC60000
unkown
page read and write
clean
3642000
unkown
page readonly
clean
3000000
unkown
page read and write
clean
3542000
unkown
page readonly
clean
1D60000
unkown
page readonly
clean
2BB000
heap default
page read and write
clean
47A0000
unkown
page read and write
clean
B2A0000
heap private
page read and write
clean
2D70000
unkown
page read and write
clean
1B40000
unkown
page readonly
clean
20FF000
unkown
page read and write
clean
3665000
unkown
page readonly
clean
435000
unkown image
page read and write
clean
265C000
unkown
page read and write
clean
1BD0000
unkown
page read and write
clean
4253000
unkown
page read and write
clean
B2C3000
heap private
page read and write
clean
26C0000
unkown
page readonly
clean
26B0000
unkown
page readonly
clean
2F90000
unkown
page readonly
clean
B34000
unkown
page execute and read and write
clean
3512000
unkown
page readonly
clean
2317000
unkown
page execute and read and write
clean
2AF0000
unkown
page read and write
clean
2ED0000
unkown
page read and write
clean
5829000
unkown
page read and write
clean
4D7000
heap default
page read and write
clean
8040000
unkown
page read and write
clean
1E3000
heap default
page read and write
clean
BFA5000
heap private
page read and write
clean
1BE0000
unkown
page read and write
clean
2A80000
unkown
page read and write
clean
7AC0000
heap private
page read and write
clean
3FE000
unkown
page read and write
clean
564000
heap default
page read and write
clean
1FE0000
unkown
page readonly
clean
2FC4000
unkown
page read and write
clean
C220000
unkown
page read and write
clean
4C0000
heap private
page read and write
clean
31E000
unkown
page read and write
clean
82D0000
unkown
page read and write
clean
9C0000
unkown
page execute and read and write
clean
130000
unkown
page readonly
clean
4090000
heap private
page read and write
clean
4450000
unkown
page readonly
clean
2EA0000
unkown
page read and write
clean
16E000
unkown
page read and write
clean
4460000
unkown
page read and write
clean
240000
unkown
page readonly
clean
72E31000
unkown image
page execute read
clean
2FE0000
unkown
page read and write
clean
2190000
unkown
page execute and read and write
clean
9D57000
unkown
page read and write
clean
1B80000
unkown
page read and write
clean
A3DA000
unkown
page write copy
clean
2520000
unkown
page readonly
clean
400000
unkown image
page readonly
clean
9B0000
unkown
page readonly
clean
9CB5000
heap private
page read and write
clean
3695000
unkown
page readonly
clean
3572000
unkown
page readonly
clean
8890000
unkown
page readonly
clean
2BC0000
unkown
page write copy
clean
2D20000
unkown
page execute read
clean
2FD0000
unkown
page read and write
clean
597A000
unkown
page read and write
clean
8C0000
unkown
page execute and read and write
clean
A30000
unkown
page execute and read and write
clean
2A60000
unkown
page read and write
clean
41D000
unkown image
page read and write
clean
3030000
unkown
page read and write
clean
2720000
unkown
page read and write
clean
582B000
unkown
page read and write
clean
CBE2000
unkown
page read and write
clean
B37000
unkown
page execute and read and write
clean
2FB0000
unkown
page read and write
clean
2E7A000
unkown
page read and write
clean
C0000
unkown
page read and write
clean
2EF0000
heap private
page read and write
clean
4F30000
unkown
page readonly
clean
CA63000
unkown
page read and write
clean
94CF000
unkown
page readonly
clean
3BB8000
unkown
page read and write
clean
90D2000
unkown
page readonly
clean
35F000
unkown
page read and write
clean
62C5000
unkown
page readonly
clean
1E8D000
unkown
page read and write
clean
78EE000
unkown
page read and write
clean
408000
unkown image
page readonly
clean
2A50000
unkown
page readonly
clean
2E4D000
unkown
page read and write
clean
1F8F000
stack
page read and write
clean
4470000
unkown
page readonly
clean
438000
unkown image
page readonly
clean
2CD0000
unkown
page write copy
clean
596F000
unkown
page read and write
clean
3860000
unkown
page readonly
clean
78F0000
unkown
page read and write
clean
231000
heap default
page read and write
clean
2E7D000
unkown
page read and write
clean
1C70000
unkown
page readonly
clean
1FA0000
heap private
page read and write
clean
3AEF000
unkown
page read and write
clean
2DA0000
unkown
page read and write
clean
28FF000
stack
page read and write
clean
314000
heap default
page read and write
clean
2D20000
unkown
page execute read
clean
2CB0000
unkown
page read and write
clean
8625000
unkown
page read and write
clean
2EF5000
heap private
page read and write
clean
3B00000
unkown
page readonly
clean
25D000
heap default
page read and write
clean
2DA0000
unkown
page read and write
clean
10000
heap private
page read and write
clean
4D9000
unkown
page read and write
clean
66EF000
unkown
page readonly
clean
6F94000
heap private
page read and write
clean
722F0000
unkown image
page readonly
clean
26A0000
unkown
page read and write
clean
2090000
unkown
page execute and read and write
clean
428C000
unkown
page read and write
clean
722F0000
unkown image
page readonly
clean
2D30000
unkown
page read and write
clean
2FC7000
unkown
page read and write
clean
260000
heap default
page read and write
clean
A3E4000
unkown
page write copy
clean
1D7000
heap default
page read and write
clean
CB24000
unkown
page read and write
clean
2E4A000
unkown
page read and write
clean
4226000
unkown
page read and write
clean
726D000
unkown
page read and write
clean
1BC0000
unkown
page read and write
clean
2FF4000
unkown
page read and write
clean
2690000
unkown
page readonly
clean
1A0000
unkown
page read and write
clean
CD0000
unkown
page readonly
clean
730000
unkown
page read and write
clean
2100000
unkown
page readonly
clean
1B5A000
unkown
page read and write
clean
46B8000
unkown
page read and write
clean
B383000
unkown
page read and write
clean
21E0000
unkown
page readonly
clean
4F9000
heap default
page read and write
clean
1C13000
heap private
page read and write
clean
3802000
unkown
page readonly
clean
2100000
unkown
page readonly
clean
2CF0000
unkown
page read and write
clean
2587000
unkown
page readonly
clean
39F4000
unkown
page read and write
clean
3940000
unkown
page read and write
clean
1C0000
unkown
page readonly
clean
41AD000
unkown
page read and write
clean
2533000
unkown
page read and write
clean
2C2000
heap default
page read and write
clean
B322000
unkown
page read and write
clean
177000
unkown
page read and write
clean
3030000
unkown
page read and write
clean
D4000
heap private
page read and write
clean
2060000
unkown
page readonly
clean
2FC7000
unkown
page read and write
clean
3D0000
unkown
page readonly
clean
2587000
unkown
page readonly
clean
2C90000
unkown
page read and write
clean
D0000
heap private
page read and write
clean
B320000
unkown
page read and write
clean
40A000
unkown image
page write copy
clean
722F3000
unkown image
page execute and read and write
clean
2A71000
unkown
page read and write
clean
205E000
unkown
page read and write
clean
6F70000
unkown
page read and write
clean
2ED0000
unkown
page read and write
clean
3C40000
unkown
page readonly
clean
3000000
unkown
page read and write
clean
1C0000
unkown
page readonly
clean
62F2000
unkown
page readonly
clean
9768000
unkown
page readonly
clean
250000
unkown
page read and write
clean
2900000
unkown
page execute and read and write
clean
85C0000
unkown
page read and write
clean
401000
unkown image
page execute read
clean
329000
unkown
page read and write
clean
A3E9000
unkown
page write copy
clean
2EB0000
unkown
page read and write
clean
7150000
heap private
page read and write
clean
2CC0000
unkown
page read and write
clean
370000
unkown
page execute and read and write
clean
2E38000
unkown
page read and write
clean
3B90000
unkown
page read and write
clean
58B6000
unkown
page read and write
clean
3566000
unkown
page readonly
clean
63E000
unkown
page read and write
clean
2EF0000
unkown
page read and write
clean
2EC0000
unkown
page read and write
clean
35C6000
unkown
page readonly
clean
26A0000
unkown
page read and write
clean
4DE000
unkown
page read and write
clean
2F0000
heap default
page read and write
clean
1BC0000
unkown
page read and write
clean
2A60000
unkown
page read and write
clean
4AE000
unkown
page read and write
clean
BB20000
unkown
page read and write
clean
4B50000
unkown
page readonly
clean
39E0000
unkown
page read and write
clean
1FA4000
heap private
page read and write
clean
CBA3000
unkown
page read and write
clean
2540000
unkown
page read and write
clean
58D000
heap default
page read and write
clean
35E5000
unkown
page readonly
clean
9A0000
unkown
page execute and read and write
clean
7550000
unkown
page read and write
clean
1DB0000
unkown
page read and write
clean
2BC0000
unkown
page write copy
clean
4616000
unkown
page read and write
clean
2FC7000
unkown
page read and write
clean
2AF0000
unkown
page read and write
clean
23D0000
unkown
page readonly
clean
2E40000
unkown
page read and write
clean
2E4D000
unkown
page read and write
clean
1AF0000
unkown
page read and write
clean
2197000
unkown
page execute and read and write
clean
5DED000
unkown
page readonly
clean
4297000
unkown
page read and write
clean
722F5000
unkown image
page readonly
clean
2ED0000
unkown
page read and write
clean
26A0000
unkown
page readonly
clean
2EC0000
unkown
page read and write
clean
C6D8000
unkown
page read and write
clean
2EA0000
unkown
page read and write
clean
5230000
unkown
page read and write
clean
C61B000
unkown
page read and write
clean
2E4A000
unkown
page read and write
clean
2E7D000
unkown
page read and write
clean
4510000
unkown
page execute and read and write
clean
2070000
unkown
page read and write
clean
2FF7000
unkown
page read and write
clean
43E0000
unkown
page read and write
clean
296E000
unkown
page execute and read and write
clean
180000
unkown
page write copy
clean
2070000
unkown
page readonly
clean
2FD0000
unkown
page read and write
clean
220000
unkown
page read and write
clean
9475000
unkown
page readonly
clean
E50000
unkown
page readonly
clean
1BF5000
heap private
page read and write
clean
3555000
unkown
page readonly
clean
20000
unkown
page read and write
clean
2194000
unkown
page execute and read and write
clean
4AC7000
unkown
page read and write
clean
2550000
unkown
page read and write
clean
220000
unkown
page read and write
clean
2FB0000
unkown
page read and write
clean
180000
unkown
page write copy
clean
5AB0000
unkown
page readonly
clean
C78000
unkown
page execute and read and write
clean
3312000
unkown
page readonly
clean
B20000
unkown
page execute and read and write
clean
9D52000
unkown
page read and write
clean
82B0000
unkown
page read and write
clean
BC0000
unkown
page execute and read and write
clean
4110000
unkown
page read and write
clean
393E000
unkown
page read and write
clean
32F000
unkown
page read and write
clean
2F00000
unkown
page read and write
clean
8951000
unkown
page readonly
clean
28F3000
unkown
page read and write
clean
BFA0000
heap private
page read and write
clean
60000
unkown
page readonly
clean
44E0000
unkown
page read and write
clean
43DF000
unkown
page read and write
clean
35D2000
unkown
page readonly
clean
35F9000
unkown
page readonly
clean
26C0000
unkown
page readonly
clean
1BF0000
heap private
page read and write
clean
3B42000
unkown
page read and write
clean
35B5000
unkown
page readonly
clean
BE70000
unkown
page read and write
clean
10000
heap private
page read and write
clean
2E50000
unkown
page read and write
clean
2900000
unkown
page read and write
clean
4500000
unkown
page readonly
clean
722F2000
unkown image
page readonly
clean
2FC7000
unkown
page read and write
clean
1DD000
heap default
page read and write
clean
220000
unkown
page read and write
clean
2CA0000
unkown
page read and write
clean
2EB0000
unkown
page read and write
clean
CC23000
unkown
page read and write
clean
2C80000
unkown
page read and write
clean
31E000
unkown
page read and write
clean
40A000
unkown image
page write copy
clean
28A0000
unkown
page write copy
clean
2FC1000
unkown
page read and write
clean
68AE000
unkown
page readonly
clean
4295000
unkown
page read and write
clean
320000
unkown
page read and write
clean
6695000
unkown
page readonly
clean
2946000
unkown
page execute and read and write
clean
1E9000
heap default
page read and write
clean
8D000
unkown
page read and write
clean
57F000
unkown
page read and write
clean
3880000
unkown
page readonly
clean
2CD0000
unkown
page write copy
clean
42C000
unkown image
page read and write
clean
82FD000
unkown
page read and write
clean
6DEF000
unkown
page readonly
clean
9D50000
unkown
page read and write
clean
3514000
unkown
page readonly
clean
360000
unkown
page execute and read and write
clean
6F90000
heap private
page read and write
clean
2AC0000
unkown
page read and write
clean
C420000
unkown
page read and write
clean
76C0000
heap private
page read and write
clean
2C60000
unkown
page read and write
clean
2314000
unkown
page execute and read and write
clean
21A0000
unkown
page execute and read and write
clean
B2A4000
heap private
page read and write
clean
72E33000
unkown image
page readonly
clean
34D2000
unkown
page readonly
clean
428F000
unkown
page read and write
clean
2E90000
unkown
page read and write
clean
220000
unkown
page read and write
clean
2EFE000
heap private
page read and write
clean
2E4A000
unkown
page read and write
clean
C610000
unkown
page read and write
clean
1B9A000
unkown
page read and write
clean
43BD000
unkown
page read and write
clean
1C13000
heap private
page read and write
clean
B40000
unkown
page execute and read and write
clean
26A0000
unkown
page readonly
clean
25A0000
unkown
page readonly
clean
2FF1000
unkown
page read and write
clean
2EF0000
heap private
page read and write
clean
220000
unkown
page read and write
clean
9F69000
unkown
page read and write
clean
7410000
heap private
page read and write
clean
2001000
unkown
page read and write
clean
380000
unkown
page write copy
clean
2210000
unkown
page execute and read and write
clean
47A6000
unkown
page read and write
clean
3E27000
unkown
page readonly
clean
25A7000
unkown
page read and write
clean
547000
heap default
page read and write
clean
9D5A000
unkown
page read and write
clean
1B5A000
unkown
page read and write
clean
CAA2000
unkown
page read and write
clean
There are 765 hidden memdumps, click here to show them.