IOCReport

loading gif

Files

File Path
Type
Category
Malicious
DHL88700456XXXX_CONFIRMATION_BOOKING_REFERENCE_BJC400618092909yy.doc
Rich Text Format data, unknown version
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\HOMqO[1].txt
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
downloaded
 malicious
C:\Users\user\AppData\Local\Temp\tmpA738.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\xWdTBYiTWyTud.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\Public\69577.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
modified
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\3kijui1[1].htm
HTML document, ASCII text
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7621A4C2-B642-4F8D-8632-93AA6D767CE8}.tmp
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B5F6BABB-61BE-41BF-89DB-AF92964D1C77}.tmp
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F060F5F7-4AFC-467A-BEBB-A714D3C0AD58}.tmp
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\Cab36BA.tmp
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\Tar36BB.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\DHL88700456XXXX_CONFIRMATION_BOOKING_REFERENCE_BJC400618092909yy.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Wed Aug 26 14:08:13 2020, atime=Wed Feb 24 19:53:30 2021, length=1380809, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Little-endian UTF-16 Unicode text, with no line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\ZEL5A6R0.txt
ASCII text
downloaded
 clean
C:\Users\user\Desktop\~$L88700456XXXX_CONFIRMATION_BOOKING_REFERENCE_BJC400618092909yy.doc
data
dropped
 clean
There are 11 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
 malicious
C:\Users\Public\69577.exe
C:\Users\Public\69577.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\xWdTBYiTWyTud' /XML 'C:\Users\user\AppData\Local\Temp\tmpA738.tmp'
 malicious
C:\Users\Public\69577.exe
{path}
 malicious
C:\Users\Public\69577.exe
{path}
 malicious
C:\Users\Public\69577.exe
{path}
 malicious
C:\Users\Public\69577.exe
{path}
 malicious
C:\Users\Public\69577.exe
{path}
 malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 clean

URLs

Name
IP
Malicious
https://u.teknik.io/HOMqO.txt
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://bit.ly/3kijui1
67.199.248.11
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
 clean

Domains

Name
IP
Malicious
bit.ly
67.199.248.11
 clean
teknik.io
5.79.72.163
 clean
u.teknik.io
unknown
 clean

IPs

IP
Domain
Country
Active
Malicious
67.199.248.11
unknown
United States
unknown
 clean
5.79.72.163
unknown
Netherlands
unknown
 clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
y 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
6b7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
wg7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ED356
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FBEAE
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FBEAE
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EquationEditorFilesIntl_1033
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
SavedLegacySettings
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Blob
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Blob
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Blob
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Blob
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Blob
 clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Blob
 clean
C:\Users\Public\69577.exe
FontCachePath
 clean
There are 320 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3259000
unkown
page read and write
 malicious
6512000
unkown
page read and write
 clean
684E000
unkown
page read and write
 clean
6A5B000
unkown
page read and write
 clean
60A1000
unkown
page read and write
 clean
65F0000
unkown
page read and write
 clean
4F0000
unkown
page read and write
 clean
6797000
unkown
page read and write
 clean
308000
unkown
page read and write
 clean
147000
unkown
page execute and read and write
 clean
64FC000
unkown
page read and write
 clean
658A000
unkown
page read and write
 clean
6669000
unkown
page read and write
 clean
753B000
unkown
page read and write
 clean
65AB000
unkown
page read and write
 clean
ACC000
unkown
page read and write
 clean
510C000
heap private
page read and write
 clean
8ED000
unkown
page read and write
 clean
6808000
unkown
page read and write
 clean
7536000
unkown
page read and write
 clean
6395000
unkown
page read and write
 clean
663C000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
6EE0000
unkown
page read and write
 clean
435D000
stack
page read and write
 clean
6630000
unkown
page read and write
 clean
6420000
unkown
page read and write
 clean
6349000
unkown
page read and write
 clean
6A50000
unkown
page read and write
 clean
69B000
unkown
page read and write
 clean
618E000
unkown
page read and write
 clean
7FBE000
stack
page read and write
 clean
3E2000
unkown image
page execute read
 clean
4C0000
unkown
page read and write
 clean
49E000
unkown image
page readonly
 clean
65D6000
unkown
page read and write
 clean
4910000
heap private
page read and write
 clean
67C5000
unkown
page read and write
 clean
636B000
unkown
page read and write
 clean
6A67000
unkown
page read and write
 clean
8D9000
unkown
page read and write
 clean
72E000
unkown
page read and write
 clean
727E000
unkown
page read and write
 clean
4E0000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
5D3E000
stack
page read and write
 clean
69E2000
unkown
page read and write
 clean
5F7E000
stack
page read and write
 clean
20A0000
unkown
page read and write
 clean
6675000
unkown
page read and write
 clean
27C6000
unkown
page read and write
 clean
50F0000
unkown
page read and write
 clean
6E8A000
unkown
page read and write
 clean
68E1000
unkown
page read and write
 clean
62BF000
unkown
page read and write
 clean
4F0000
unkown
page read and write
 clean
124000
unkown
page read and write
 clean
6252000
unkown
page read and write
 clean
62AB000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
4E0000
unkown
page read and write
 clean
644D000
unkown
page read and write
 clean
6682000
unkown
page read and write
 clean
630E000
unkown
page read and write
 clean
63C4000
unkown
page read and write
 clean
6AD1000
unkown
page read and write
 clean
4C0000
unkown
page read and write
 clean
64B6000
unkown
page read and write
 clean
64BC000
unkown
page read and write
 clean
6123000
unkown
page read and write
 clean
6365000
unkown
page read and write
 clean
4E02000
unkown
page read and write
 clean
49E000
unkown image
page readonly
 clean
4DF3000
unkown
page read and write
 clean
5BC000
unkown
page read and write
 clean
64DF000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
6C6A000
unkown
page read and write
 clean
6A8D000
unkown
page read and write
 clean
4718000
unkown
page read and write
 clean
49E000
unkown image
page readonly
 clean
63A1000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
528C000
unkown
page read and write
 clean
6E64000
unkown
page read and write
 clean
55C000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
642A000
unkown
page read and write
 clean
4720000
unkown
page read and write
 clean
62A0000
unkown
page read and write
 clean
830000
heap default
page read and write
 clean
224E000
unkown
page read and write | page guard
 clean
6A8A000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
667B000
unkown
page read and write
 clean
3E2000
unkown image
page execute read
 clean
64A4000
unkown
page read and write
 clean
56BF000
stack
page read and write
 clean
4DB8000
unkown
page read and write
 clean
61F0000
unkown
page read and write
 clean
6862000
unkown
page read and write
 clean
49E000
unkown image
page readonly
 clean
4F00000
heap private
page execute and read and write
 clean
142000
unkown
page read and write
 clean
27C4000
unkown
page read and write
 clean
5211000
unkown
page read and write
 clean
65A9000
unkown
page read and write
 clean
4DD9000
unkown
page read and write
 clean
662E000
unkown
page read and write
 clean
5B5E000
unkown
page read and write
 clean
5110000
unkown
page read and write
 clean
53D0000
unkown
page readonly
 clean
6AC9000
unkown
page read and write
 clean
642D000
unkown
page read and write
 clean
56C0000
unkown
page readonly
 clean
6282000
unkown
page read and write
 clean
638C000
unkown
page read and write
 clean
615E000
unkown
page read and write
 clean
500000
heap private
page read and write
 clean
4932000
heap private
page read and write
 clean
49E000
unkown image
page readonly
 clean
5D8E000
unkown
page read and write
 clean
65F5000
unkown
page read and write
 clean
4E46000
unkown
page read and write
 clean
681C000
unkown
page read and write
 clean
60F7000
unkown
page read and write
 clean
69E4000
unkown
page read and write
 clean
6BC9000
unkown
page read and write
 clean
3E2000
unkown image
page execute read
 clean
49E000
unkown image
page readonly
 clean
503E000
stack
page read and write
 clean
661C000
unkown
page read and write
 clean
AD0000
heap private
page execute and read and write
 clean
1E0000
unkown
page execute and read and write
 clean
675B000
unkown
page read and write
 clean
49E000
unkown image
page readonly
 clean
6618000
unkown
page read and write
 clean
3D0000
unkown
page read and write
 clean
65AE000
unkown
page read and write
 clean
4B0000
unkown
page read and write
 clean
4C0000
unkown
page read and write
 clean
4C0000
unkown
page read and write
 clean
7E0000
unkown
page read and write
 clean
60A0000
unkown
page read and write
 clean
558E000
unkown
page read and write
 clean
6A9D000
unkown
page read and write
 clean
2140000
unkown
page readonly
 clean
6450000
unkown
page read and write
 clean
814000
heap default
page read and write
 clean
812E000
unkown
page read and write | page guard
 clean
13D000
unkown
page execute and read and write
 clean
6A95000
unkown
page read and write
 clean
6171000
unkown
page read and write
 clean
120000
unkown
page read and write
 clean
61EE000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
4C0000
unkown
page read and write
 clean
6C05000
unkown
page read and write
 clean
6455000
unkown
page read and write
 clean
4E32000
unkown
page read and write
 clean
4A70000
unkown
page readonly
 clean
63EF000
unkown
page read and write
 clean
68A9000
unkown
page read and write
 clean
8E9000
unkown
page read and write
 clean
A70000
unkown
page readonly
 clean
553D000
unkown
page read and write
 clean
4D94000
unkown
page read and write
 clean
4DB8000
unkown
page read and write
 clean
50F0000
unkown
page read and write
 clean
4DD7000
unkown
page read and write
 clean
49E000
unkown image
page readonly
 clean
63ED000
unkown
page read and write
 clean
20F3000
unkown
page read and write
 clean
8D0000
heap default
page read and write
 clean
7F7000
heap default
page read and write
 clean
8D9000
unkown
page read and write
 clean
50E0000
unkown
page read and write
 clean
4D6D000
unkown
page read and write
 clean
6202000
unkown
page read and write
 clean
A83000
unkown
page read and write
 clean
6B7C000
unkown
page read and write
 clean
50F0000
unkown
page read and write
 clean
49E000
unkown image
page readonly
 clean
6EF1000
unkown
page read and write
 clean
6596000
unkown
page read and write
 clean
6AD3000
unkown
page read and write
 clean
8DC000
unkown
page read and write
 clean
6EA0000
unkown
page read and write
 clean
4C0000
unkown
page read and write
 clean
5460000
unkown
page read and write
 clean
4E0000
unkown
page read and write
 clean
8D2000
heap default
page read and write
 clean
3E0000
unkown image
page readonly
 clean
4C0000
unkown
page read and write
 clean
4E0000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
4E16000
unkown
page read and write
 clean
63F3000
unkown
page read and write
 clean
1CB000
unkown
page read and write
 clean
5100000
heap private
page read and write
 clean
65D1000
unkown
page read and write
 clean
60BB000
unkown
page read and write
 clean
3E2000
unkown image
page execute read
 clean
53A0000
unkown
page readonly
 clean
3E2000
unkown image
page execute read
 clean
4950000
unkown
page read and write
 clean
69CB000
unkown
page read and write
 clean
665B000
unkown
page read and write
 clean
123000
unkown
page execute and read and write
 clean
8E0000
unkown
page read and write
 clean
658F000
unkown
page read and write
 clean
4E32000
unkown
page read and write
 clean
66A0000
unkown
page read and write
 clean
2135000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
6EB5000
unkown
page read and write
 clean
4C0000
unkown
page read and write
 clean
4DBD000
unkown
page read and write
 clean
6A24000
unkown
page read and write
 clean
6616000
unkown
page read and write
 clean
3E2000
unkown image
page execute read
 clean
67D8000
unkown
page read and write
 clean
2A97000
unkown
page read and write
 clean
4F0000
unkown
page execute and read and write
 clean
6A10000
unkown
page read and write
 clean
5440000
unkown
page read and write
 clean
734A000
unkown
page read and write
 clean
6240000
unkown
page read and write
 clean
6624000
unkown
page read and write
 clean
66CA000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
8EC000
unkown
page read and write
 clean
5287000
unkown
page read and write
 clean
3E2000
unkown image
page execute read
 clean
812F000
unkown
page read and write
 clean
4960000
unkown
page read and write
 clean
665F000
unkown
page read and write
 clean
4C0000
unkown
page read and write
 clean
20000
unkown
page read and write
 clean
65A1000
unkown
page read and write
 clean
152000
unkown
page read and write
 clean
63F5000
unkown
page read and write
 clean
4E16000
unkown
page read and write
 clean
63BA000
unkown
page read and write
 clean
49E000
unkown image
page readonly
 clean
822E000
stack
page read and write
 clean
4630000
unkown
page readonly
 clean
4F0000
unkown
page read and write
 clean
64FE000
unkown
page read and write
 clean
512D000
unkown
page read and write
 clean
62FA000
unkown
page read and write
 clean
6994000
unkown
page read and write
 clean
3251000
unkown
page read and write
 clean
60A000
heap private
page read and write
 clean
4830000
unkown
page read and write
 clean
64AF000
unkown
page read and write
 clean
12D000
unkown
page execute and read and write
 clean
3E2000
unkown image
page execute read
 clean
6AA8000
unkown
page read and write
 clean
6635000
unkown
page read and write
 clean
4E0000
unkown
page read and write
 clean
5298000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
6ACB000
unkown
page read and write
 clean
4DBC000
unkown
page read and write
 clean
4C0000
unkown
page read and write
 clean
69C3000
unkown
page read and write
 clean
6DB6000
unkown
page read and write
 clean
65A7000
unkown
page read and write
 clean
180000
heap private
page read and write
 clean
83C000
heap default
page read and write
 clean
65DA000
unkown
page read and write
 clean
65E7000
unkown
page read and write
 clean
14A000
unkown
page execute and read and write
 clean
6A18000
unkown
page read and write
 clean
5C1E000
unkown
page read and write
 clean
3E2000
unkown image
page execute read
 clean
6667000
unkown
page read and write
 clean
4DBC000
unkown
page read and write
 clean
6509000
unkown
page read and write
 clean
5040000
unkown
page read and write
 clean
65EE000
unkown
page read and write
 clean
4C0000
unkown
page read and write
 clean
2F8000
stack
page read and write
 clean
53A0000
unkown
page read and write
 clean
482F000
stack
page read and write
 clean
730000
unkown
page readonly
 clean
3E0000
unkown image
page readonly
 clean
4F0000
unkown
page read and write
 clean
63C0000
unkown
page read and write
 clean
3E2000
unkown image
page execute read
 clean
50E0000
unkown
page read and write
 clean
6593000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
69CE000
unkown
page read and write
 clean
4E16000
unkown
page read and write
 clean
3E2000
unkown image
page execute read
 clean
8F0000
unkown
page readonly
 clean
110000
unkown
page read and write
 clean
4360000
unkown
page readonly
 clean
63C7000
unkown
page read and write
 clean
4DF4000
unkown
page read and write
 clean
661E000
unkown
page read and write
 clean
7553000
unkown
page read and write
 clean
2140000
unkown
page read and write
 clean
7A0000
heap private
page execute and read and write
 clean
224F000
unkown
page read and write
 clean
6A87000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
6398000
unkown
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
4E50000
unkown
page read and write
 clean
1F0000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
130000
unkown
page read and write
 clean
671E000
unkown
page read and write
 clean
6637000
unkown
page read and write
 clean
5AB0000
unkown
page read and write
 clean
693B000
unkown
page read and write
 clean
6A26000
unkown
page read and write
 clean
4E46000
unkown
page read and write
 clean
611E000
unkown
page read and write
 clean
54E000
unkown
page read and write
 clean
6662000
unkown
page read and write
 clean
4E0000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
4E02000
unkown
page read and write
 clean
5210000
unkown
page read and write
 clean
66D9000
unkown
page read and write
 clean
65DD000
unkown
page read and write
 clean
6A48000
unkown
page read and write
 clean
4950000
unkown
page readonly
 clean
674C000
unkown
page read and write
 clean
4DD7000
unkown
page read and write
 clean
4E0000
unkown
page read and write
 clean
5450000
unkown
page read and write
 clean
623E000
unkown
page read and write
 clean
4914000
heap private
page read and write
 clean
49E000
unkown image
page readonly
 clean
6A05000
unkown
page read and write
 clean
610F000
unkown
page read and write
 clean
6510000
unkown
page read and write
 clean
3E2000
unkown image
page execute read
 clean
6614000
unkown
page read and write
 clean
6F5F000
unkown
page read and write
 clean
7541000
unkown
page read and write
 clean
4DF3000
unkown
page read and write
 clean
4D50000
unkown
page read and write
 clean
2130000
unkown
page read and write
 clean
3B0000
unkown
page read and write
 clean
7557000
unkown
page read and write
 clean
2251000
unkown
page read and write
 clean
6C45000
unkown
page read and write
 clean
6621000
unkown
page read and write
 clean
50F0000
unkown
page read and write
 clean
4E32000
unkown
page read and write
 clean
600000
heap private
page read and write
 clean
528F000
unkown
page read and write
 clean
7F0000
heap default
page read and write
 clean
6AE6000
unkown
page read and write
 clean
6788000
unkown
page read and write
 clean
6EA7000
unkown
page read and write
 clean
4B0000
unkown
page read and write
 clean
3D0000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
50E0000
unkown
page read and write
 clean
4E46000
unkown
page read and write
 clean
4A6E000
stack
page read and write
 clean
6A53000
unkown
page read and write
 clean
15B000
unkown
page execute and read and write
 clean
6517000
unkown
page read and write
 clean
6391000
unkown
page read and write
 clean
20ED000
unkown
page read and write
 clean
49E000
unkown image
page readonly
 clean
54CE000
unkown
page read and write
 clean
3727000
unkown
page read and write
 clean
3E0000
unkown image
page readonly
 clean
157000
unkown
page execute and read and write
 clean
4250000
unkown
page read and write
 clean
6ADB000
unkown
page read and write
 clean
610000
heap default
page read and write
 clean
3A0000
unkown
page readonly
 clean
4E0000
unkown
page read and write
 clean
74AC000
unkown
page read and write
 clean
4E0000
unkown
page read and write
 clean
6710000
unkown
page read and write
 clean
4E02000
unkown
page read and write
 clean
5310000
unkown
page read and write
 clean
4C0000
unkown
page read and write
 clean
667F000
unkown
page read and write
 clean
80000
unkown
page readonly
 clean
6426000
unkown
page read and write
 clean
8A9000
heap default
page read and write
 clean
5C0000
heap private
page read and write
 clean
20A0000
unkown
page readonly
 clean
6A0E000
unkown
page read and write
 clean
6A92000
unkown
page read and write
 clean
69D5000
unkown
page read and write
 clean
638A000
unkown
page read and write
 clean
4710000
unkown
page read and write
 clean
8E7000
unkown
page read and write
 clean
4E0000
unkown
page read and write
 clean
50E0000
unkown
page read and write
 clean
4D0000
unkown
page read and write
 clean
There are 394 hidden memdumps, click here to show them.