Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
ORDER 9387383900.xlsx
|
CDFV2 Encrypted
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\rrr[1].exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
downloaded
|
|
|
|
C:\Users\user\Desktop\~$ORDER 9387383900.xlsx
|
data
|
dropped
|
|
|
|
C:\Users\Public\vbc.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3CF4807.png
|
PNG image data, 294 x 262, 8-bit/color RGBA, non-interlaced
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\45AE4F8B.png
|
PNG image data, 294 x 262, 8-bit/color RGBA, non-interlaced
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9C9F6B5.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C21E6C10.jpeg
|
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D0E8725C.jpeg
|
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F3AA532.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\Excel8.0\MSForms.exd
|
data
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
|
|
|
|
C:\Users\Public\vbc.exe
|
'C:\Users\Public\vbc.exe'
|
|
|
|
C:\Users\Public\vbc.exe
|
C:\Users\Public\vbc.exe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://198.23.213.61/rrr.exe
|
198.23.213.61
|
|
|
|
https://bfdUomDwe8FRPCAbrg.com
|
unknown
|
|
|
|
http://127.0.0.1:HTTP/1.1
|
unknown
|
|
|
|
http://DynDns.comDynDNS
|
unknown
|
|
|
|
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
|
unknown
|
|
|
|
http://us2.smtp.mailhostbox.com
|
unknown
|
|
|
|
http://www.day.com/dam/1.0
|
unknown
|
|
|
|
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
|
unknown
|
|
|
|
http://htJAdA.com
|
unknown
|
|
|
|
https://api.ipify.org%GETMozilla/5.0
|
unknown
|
|
|
|
http://www.%s.comPA
|
unknown
|
|
|
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
|
|
|
https://api.ipify.org%
|
unknown
|
|
|
|
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
|
unknown
|
|
|
|
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
|
unknown
|
|
There are 5 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
us2.smtp.mailhostbox.com
|
208.91.199.225
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
198.23.213.61
|
unknown
|
United States
|
|
|
|
208.91.199.225
|
us2.smtp.mailhostbox.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
6 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
MTTT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ReviewToken
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
VBAFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ECD9C
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DefaultSheetR2L
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
UseSystemSeparators
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ThousandsSeparator
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DecimalSeparator
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
:08
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F142C
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F2359
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 21
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
LastPurgeTime
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EXCELFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F142C
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F142C
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
F142C
|
|
|
|
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
EquationEditorFilesIntl_1033
|
|
|
|
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
SavedLegacySettings
|
|
|
|
C:\Users\Public\vbc.exe
|
FontCachePath
|
|
There are 192 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2451000
|
unkown
|
page read and write
|
|
|
|
2609000
|
unkown
|
page read and write
|
|
|
|
402000
|
unkown
|
page execute and read and write
|
|
|
|
35C9000
|
unkown
|
page read and write
|
|
|
|
24F4000
|
unkown
|
page read and write
|
|
|
|
4C30000
|
unkown
|
page readonly
|
|
|
|
4ABE000
|
unkown
|
page read and write
|
|
|
|
613F000
|
unkown
|
page read and write
|
|
|
|
25FF000
|
unkown
|
page read and write
|
|
|
|
64D4000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
65DE000
|
unkown
|
page read and write
|
|
|
|
6540000
|
unkown
|
page read and write
|
|
|
|
CB0000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown
|
page execute and read and write
|
|
|
|
6ACD000
|
unkown
|
page read and write
|
|
|
|
1D0000
|
unkown
|
page read and write
|
|
|
|
668F000
|
unkown
|
page read and write
|
|
|
|
6606000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
2590000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
CB0000
|
unkown
|
page read and write
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
541F000
|
unkown
|
page read and write
|
|
|
|
683000
|
unkown
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
3D8000
|
stack
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
65DB000
|
unkown
|
page read and write
|
|
|
|
660A000
|
unkown
|
page read and write
|
|
|
|
50E4000
|
unkown
|
page read and write
|
|
|
|
20E000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
249E000
|
unkown
|
page read and write
|
|
|
|
17D000
|
unkown
|
page execute and read and write
|
|
|
|
6A20000
|
heap private
|
page read and write
|
|
|
|
D1E000
|
unkown
|
page read and write
|
|
|
|
610000
|
unkown
|
page read and write
|
|
|
|
52EE000
|
unkown
|
page read and write
|
|
|
|
530000
|
unkown
|
page read and write
|
|
|
|
6A3E000
|
unkown
|
page read and write
|
|
|
|
62DB000
|
unkown
|
page read and write
|
|
|
|
6ED7000
|
unkown
|
page read and write
|
|
|
|
6450000
|
unkown
|
page read and write
|
|
|
|
50C9000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
4A20000
|
heap private
|
page read and write
|
|
|
|
66B2000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
6A05000
|
unkown
|
page read and write
|
|
|
|
6A80000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
610000
|
unkown
|
page read and write
|
|
|
|
811000
|
unkown
|
page read and write
|
|
|
|
820000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
50A8000
|
unkown
|
page read and write
|
|
|
|
35C1000
|
unkown
|
page read and write
|
|
|
|
7583000
|
unkown
|
page read and write
|
|
|
|
6838000
|
unkown
|
page read and write
|
|
|
|
5E3C000
|
unkown
|
page read and write
|
|
|
|
4C00000
|
unkown
|
page readonly
|
|
|
|
6B03000
|
unkown
|
page read and write
|
|
|
|
255A000
|
unkown
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown
|
page read and write
|
|
|
|
45C0000
|
unkown
|
page readonly
|
|
|
|
6E94000
|
unkown
|
page read and write
|
|
|
|
6480000
|
unkown
|
page read and write
|
|
|
|
6692000
|
unkown
|
page read and write
|
|
|
|
12D000
|
unkown
|
page execute and read and write
|
|
|
|
6665000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
6542000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page read and write
|
|
|
|
606E000
|
unkown
|
page read and write
|
|
|
|
666C000
|
unkown
|
page read and write
|
|
|
|
CC0000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
2C0000
|
heap private
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
6A35000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
250000
|
heap private
|
page read and write
|
|
|
|
5912000
|
unkown
|
page readonly
|
|
|
|
56B2000
|
unkown
|
page readonly
|
|
|
|
332000
|
unkown
|
page read and write
|
|
|
|
61BE000
|
unkown
|
page read and write
|
|
|
|
D95E000
|
unkown
|
page read and write | page guard
|
|
|
|
58CF000
|
unkown
|
page read and write
|
|
|
|
5330000
|
unkown
|
page readonly
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
D85D000
|
stack
|
page read and write
|
|
|
|
258E000
|
unkown
|
page read and write
|
|
|
|
503E000
|
stack
|
page read and write
|
|
|
|
532D000
|
unkown
|
page read and write
|
|
|
|
837000
|
heap private
|
page read and write
|
|
|
|
5106000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
5B5000
|
unkown
|
page read and write
|
|
|
|
240000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
632A000
|
unkown
|
page read and write
|
|
|
|
6B0B000
|
unkown
|
page read and write
|
|
|
|
CC0000
|
unkown
|
page read and write
|
|
|
|
73D000
|
heap default
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
60EB000
|
unkown
|
page read and write
|
|
|
|
350000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
208000
|
unkown
|
page read and write
|
|
|
|
208000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
5D3E000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
F60000
|
unkown image
|
page readonly
|
|
|
|
2616000
|
unkown
|
page read and write
|
|
|
|
63F0000
|
unkown
|
page read and write
|
|
|
|
820000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
F40000
|
unkown
|
page read and write
|
|
|
|
661E000
|
unkown
|
page read and write
|
|
|
|
6547000
|
unkown
|
page read and write
|
|
|
|
50E3000
|
unkown
|
page read and write
|
|
|
|
6740000
|
unkown
|
page read and write
|
|
|
|
490000
|
heap private
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
66D0000
|
unkown
|
page read and write
|
|
|
|
687E000
|
unkown
|
page read and write
|
|
|
|
52D8000
|
heap private
|
page read and write
|
|
|
|
4A42000
|
heap private
|
page read and write
|
|
|
|
50C7000
|
unkown
|
page read and write
|
|
|
|
6539000
|
unkown
|
page read and write
|
|
|
|
5936000
|
unkown
|
page readonly
|
|
|
|
52DB000
|
heap private
|
page read and write
|
|
|
|
600000
|
heap default
|
page read and write
|
|
|
|
410000
|
unkown
|
page read and write
|
|
|
|
339000
|
unkown
|
page read and write
|
|
|
|
910000
|
unkown
|
page readonly
|
|
|
|
227000
|
unkown
|
page read and write
|
|
|
|
5136000
|
unkown
|
page read and write
|
|
|
|
50A8000
|
unkown
|
page read and write
|
|
|
|
480000
|
unkown
|
page read and write
|
|
|
|
360000
|
unkown
|
page readonly
|
|
|
|
660000
|
unkown
|
page read and write
|
|
|
|
350000
|
unkown
|
page execute and read and write
|
|
|
|
C60000
|
heap private
|
page read and write
|
|
|
|
F62000
|
unkown image
|
page execute read
|
|
|
|
650F000
|
unkown
|
page read and write
|
|
|
|
6DE6000
|
unkown
|
page read and write
|
|
|
|
50E3000
|
unkown
|
page read and write
|
|
|
|
F62000
|
unkown image
|
page execute read
|
|
|
|
4450000
|
unkown
|
page readonly
|
|
|
|
186000
|
unkown
|
page execute and read and write
|
|
|
|
4B90000
|
heap private
|
page read and write
|
|
|
|
63C5000
|
unkown
|
page read and write
|
|
|
|
63EA000
|
unkown
|
page read and write
|
|
|
|
52D4000
|
heap private
|
page read and write
|
|
|
|
4FC000
|
unkown
|
page read and write
|
|
|
|
E20000
|
unkown
|
page readonly
|
|
|
|
7B0000
|
unkown
|
page read and write
|
|
|
|
64EC000
|
unkown
|
page read and write
|
|
|
|
210000
|
unkown
|
page read and write
|
|
|
|
6232000
|
unkown
|
page read and write
|
|
|
|
66DE000
|
unkown
|
page read and write
|
|
|
|
D3D000
|
stack
|
page read and write
|
|
|
|
5060000
|
heap private
|
page read and write
|
|
|
|
810000
|
unkown
|
page readonly
|
|
|
|
E20000
|
unkown
|
page read and write
|
|
|
|
4BF0000
|
heap private
|
page execute and read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
24DA000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page read and write
|
|
|
|
63F7000
|
unkown
|
page read and write
|
|
|
|
5310000
|
unkown
|
page readonly
|
|
|
|
66AB000
|
unkown
|
page read and write
|
|
|
|
D6FE000
|
stack
|
page read and write
|
|
|
|
EA000
|
unkown
|
page read and write
|
|
|
|
5996000
|
unkown
|
page readonly
|
|
|
|
4B0E000
|
unkown
|
page read and write
|
|
|
|
7566000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
639A000
|
unkown
|
page read and write
|
|
|
|
541E000
|
unkown
|
page read and write | page guard
|
|
|
|
102E000
|
unkown image
|
page readonly
|
|
|
|
80000
|
unkown
|
page readonly
|
|
|
|
8CF000
|
stack
|
page read and write
|
|
|
|
6A54000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
5BE0000
|
unkown
|
page readonly
|
|
|
|
5874000
|
unkown
|
page readonly
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
5084000
|
unkown
|
page read and write
|
|
|
|
69C4000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
520000
|
unkown
|
page readonly
|
|
|
|
3E8000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
6C1F000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
25BF000
|
unkown
|
page read and write
|
|
|
|
5360000
|
heap private
|
page read and write
|
|
|
|
34B000
|
unkown
|
page read and write
|
|
|
|
65C6000
|
unkown
|
page read and write
|
|
|
|
664C000
|
unkown
|
page read and write
|
|
|
|
5C40000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
25C1000
|
unkown
|
page read and write
|
|
|
|
C5E000
|
unkown
|
page read and write
|
|
|
|
3451000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
645A000
|
unkown
|
page read and write
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
CB0000
|
unkown
|
page read and write
|
|
|
|
65D1000
|
unkown
|
page read and write
|
|
|
|
88D000
|
heap default
|
page read and write
|
|
|
|
3E0000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
8D0000
|
heap private
|
page execute and read and write
|
|
|
|
660000
|
unkown
|
page read and write
|
|
|
|
F62000
|
unkown image
|
page execute read
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page readonly
|
|
|
|
6648000
|
unkown
|
page read and write
|
|
|
|
197000
|
unkown
|
page execute and read and write
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
3F0000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
645D000
|
unkown
|
page read and write
|
|
|
|
29E000
|
unkown
|
page read and write
|
|
|
|
5122000
|
unkown
|
page read and write
|
|
|
|
621E000
|
unkown
|
page read and write
|
|
|
|
59B9000
|
unkown
|
page readonly
|
|
|
|
5F0000
|
unkown
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
E25000
|
unkown
|
page read and write
|
|
|
|
F60000
|
unkown image
|
page readonly
|
|
|
|
163000
|
unkown
|
page execute and read and write
|
|
|
|
CD0000
|
unkown
|
page read and write
|
|
|
|
170000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
678B000
|
unkown
|
page read and write
|
|
|
|
B0E000
|
unkown
|
page read and write
|
|
|
|
6E0000
|
heap default
|
page read and write
|
|
|
|
6AC5000
|
unkown
|
page read and write
|
|
|
|
499000
|
heap private
|
page read and write
|
|
|
|
13D000
|
unkown
|
page execute and read and write
|
|
|
|
6B16000
|
unkown
|
page read and write
|
|
|
|
130000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
652C000
|
unkown
|
page read and write
|
|
|
|
F3E000
|
unkown
|
page read and write
|
|
|
|
6646000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
69FB000
|
unkown
|
page read and write
|
|
|
|
CD0000
|
unkown
|
page execute and read and write
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
230000
|
heap private
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
8E2000
|
heap default
|
page read and write
|
|
|
|
2B0000
|
unkown
|
page read and write
|
|
|
|
7A0000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
599D000
|
unkown
|
page readonly
|
|
|
|
210000
|
unkown
|
page read and write
|
|
|
|
528E000
|
unkown
|
page read and write
|
|
|
|
680000
|
unkown
|
page readonly
|
|
|
|
F60000
|
unkown image
|
page readonly
|
|
|
|
180000
|
unkown
|
page read and write
|
|
|
|
660000
|
unkown
|
page read and write
|
|
|
|
63C8000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
48BF000
|
unkown
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
696B000
|
unkown
|
page read and write
|
|
|
|
6C4000
|
heap default
|
page read and write
|
|
|
|
823000
|
unkown
|
page read and write
|
|
|
|
58E2000
|
unkown
|
page readonly
|
|
|
|
6153000
|
unkown
|
page read and write
|
|
|
|
6699000
|
unkown
|
page read and write
|
|
|
|
6617000
|
unkown
|
page read and write
|
|
|
|
5122000
|
unkown
|
page read and write
|
|
|
|
3E0000
|
unkown
|
page read and write
|
|
|
|
CC0000
|
unkown
|
page read and write
|
|
|
|
6EBA000
|
unkown
|
page read and write
|
|
|
|
CD0000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
6911000
|
unkown
|
page read and write
|
|
|
|
CB0000
|
unkown
|
page read and write
|
|
|
|
4F1E000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
4B10000
|
heap private
|
page read and write
|
|
|
|
5906000
|
unkown
|
page readonly
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
A0000
|
unkown
|
page read and write
|
|
|
|
6BF9000
|
unkown
|
page read and write
|
|
|
|
5A0000
|
unkown
|
page read and write
|
|
|
|
5B4000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
CD0000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
6127000
|
unkown
|
page read and write
|
|
|
|
F62000
|
unkown image
|
page execute read
|
|
|
|
197000
|
unkown
|
page execute and read and write
|
|
|
|
840000
|
heap default
|
page read and write
|
|
|
|
4A60000
|
unkown
|
page read and write
|
|
|
|
830000
|
heap private
|
page read and write
|
|
|
|
7FEE000
|
stack
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
7EFDF000
|
unkown
|
page read and write
|
|
|
|
6F21000
|
unkown
|
page read and write
|
|
|
|
6EC000
|
heap default
|
page read and write
|
|
|
|
364000
|
unkown
|
page read and write
|
|
|
|
64DF000
|
unkown
|
page read and write
|
|
|
|
360000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
6F10000
|
unkown
|
page read and write
|
|
|
|
47E000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
C1D000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
50C7000
|
unkown
|
page read and write
|
|
|
|
515D000
|
unkown
|
page read and write
|
|
|
|
63BC000
|
unkown
|
page read and write
|
|
|
|
192000
|
unkown
|
page read and write
|
|
|
|
7571000
|
unkown
|
page read and write
|
|
|
|
6ABD000
|
unkown
|
page read and write
|
|
|
|
20B000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
F60000
|
unkown image
|
page readonly
|
|
|
|
512E000
|
unkown
|
page read and write
|
|
|
|
6EE5000
|
unkown
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
5E40000
|
unkown
|
page readonly
|
|
|
|
25A9000
|
unkown
|
page read and write
|
|
|
|
660000
|
unkown
|
page read and write
|
|
|
|
6A78000
|
unkown
|
page read and write
|
|
|
|
50F2000
|
unkown
|
page read and write
|
|
|
|
6220000
|
unkown
|
page read and write
|
|
|
|
6C9A000
|
unkown
|
page read and write
|
|
|
|
2D0000
|
unkown
|
page read and write
|
|
|
|
5894000
|
unkown
|
page readonly
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
6A97000
|
unkown
|
page read and write
|
|
|
|
360000
|
unkown
|
page read and write
|
|
|
|
66FA000
|
unkown
|
page read and write
|
|
|
|
6AD8000
|
unkown
|
page read and write
|
|
|
|
B20000
|
unkown
|
page write copy
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
1F0000
|
unkown
|
page read and write
|
|
|
|
F0000
|
unkown
|
page readonly
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
756B000
|
unkown
|
page read and write
|
|
|
|
6C35000
|
unkown
|
page read and write
|
|
|
|
60D1000
|
unkown
|
page read and write
|
|
|
|
102E000
|
unkown image
|
page readonly
|
|
|
|
CA1000
|
unkown
|
page read and write
|
|
|
|
E30000
|
unkown
|
page read and write
|
|
|
|
480000
|
unkown
|
page read and write
|
|
|
|
7EDC000
|
unkown
|
page read and write
|
|
|
|
5966000
|
unkown
|
page readonly
|
|
|
|
6B01000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
5365000
|
heap private
|
page read and write
|
|
|
|
5B1D000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
50DE000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
CB0000
|
unkown
|
page read and write
|
|
|
|
5A05000
|
unkown
|
page readonly
|
|
|
|
147000
|
unkown
|
page execute and read and write
|
|
|
|
6660000
|
unkown
|
page read and write
|
|
|
|
4BFE000
|
stack
|
page read and write
|
|
|
|
4A0000
|
unkown
|
page read and write
|
|
|
|
D40000
|
unkown
|
page readonly
|
|
|
|
65D9000
|
unkown
|
page read and write
|
|
|
|
6625000
|
unkown
|
page read and write
|
|
|
|
E1E000
|
unkown
|
page read and write | page guard
|
|
|
|
65D7000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
69F3000
|
unkown
|
page read and write
|
|
|
|
7587000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
18B000
|
unkown
|
page read and write
|
|
|
|
2612000
|
unkown
|
page read and write
|
|
|
|
6C75000
|
unkown
|
page read and write
|
|
|
|
350000
|
unkown
|
page read and write
|
|
|
|
D4CE000
|
stack
|
page read and write
|
|
|
|
58B4000
|
unkown
|
page readonly
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
25A4000
|
unkown
|
page read and write
|
|
|
|
CC0000
|
unkown
|
page read and write
|
|
|
|
6395000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
7EFDF000
|
unkown
|
page read and write
|
|
|
|
5187000
|
unkown
|
page read and write
|
|
|
|
A90000
|
unkown
|
page readonly
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
370000
|
heap private
|
page read and write
|
|
|
|
50AC000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
6A56000
|
unkown
|
page read and write
|
|
|
|
6425000
|
unkown
|
page read and write
|
|
|
|
820000
|
unkown
|
page read and write
|
|
|
|
5955000
|
unkown
|
page readonly
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
5CAF000
|
unkown
|
page read and write
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
CA5000
|
unkown
|
page read and write
|
|
|
|
332000
|
unkown
|
page read and write
|
|
|
|
864000
|
heap default
|
page read and write
|
|
|
|
CC1000
|
unkown
|
page read and write
|
|
|
|
59E2000
|
unkown
|
page readonly
|
|
|
|
540000
|
unkown
|
page execute and read and write
|
|
|
|
F50000
|
unkown
|
page read and write
|
|
|
|
124000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
590000
|
unkown
|
page readonly
|
|
|
|
374000
|
heap private
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
664E000
|
unkown
|
page read and write
|
|
|
|
57B2000
|
unkown
|
page readonly
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
CBA000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
8FF000
|
heap default
|
page read and write
|
|
|
|
360000
|
unkown
|
page read and write
|
|
|
|
19B000
|
unkown
|
page execute and read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
6A48000
|
unkown
|
page read and write
|
|
|
|
50F2000
|
unkown
|
page read and write
|
|
|
|
58D0000
|
unkown
|
page read and write
|
|
|
|
68D9000
|
unkown
|
page read and write
|
|
|
|
6667000
|
unkown
|
page read and write
|
|
|
|
192000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
2CC000
|
heap private
|
page read and write
|
|
|
|
4A24000
|
heap private
|
page read and write
|
|
|
|
5892000
|
unkown
|
page readonly
|
|
|
|
65C3000
|
unkown
|
page read and write
|
|
|
|
220000
|
unkown
|
page read and write
|
|
|
|
2C0000
|
unkown
|
page read and write
|
|
|
|
50F2000
|
unkown
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
E30000
|
unkown
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
102E000
|
unkown image
|
page readonly
|
|
|
|
2A0000
|
unkown
|
page readonly
|
|
|
|
327000
|
unkown
|
page read and write
|
|
|
|
64E6000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
6654000
|
unkown
|
page read and write
|
|
|
|
360000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
6697000
|
unkown
|
page read and write
|
|
|
|
61BA000
|
unkown
|
page read and write
|
|
|
|
F60000
|
unkown image
|
page readonly
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
5180000
|
heap private
|
page read and write
|
|
|
|
1E0000
|
unkown
|
page execute and read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
63F4000
|
unkown
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
610000
|
unkown
|
page read and write
|
|
|
|
48C0000
|
unkown
|
page readonly
|
|
|
|
164000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
500000
|
heap default
|
page read and write
|
|
|
|
E36000
|
unkown
|
page read and write
|
|
|
|
1050000
|
unkown
|
page readonly
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
5136000
|
unkown
|
page read and write
|
|
|
|
20000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
6484000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
16D000
|
unkown
|
page execute and read and write
|
|
|
|
933000
|
heap default
|
page read and write
|
|
|
|
6A83000
|
unkown
|
page read and write
|
|
|
|
6AC2000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
5136000
|
unkown
|
page read and write
|
|
|
|
637E000
|
unkown
|
page read and write
|
|
|
|
392000
|
heap private
|
page read and write
|
|
|
|
62B2000
|
unkown
|
page read and write
|
|
|
|
210000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
3866000
|
unkown
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
6ABA000
|
unkown
|
page read and write
|
|
|
|
63C1000
|
unkown
|
page read and write
|
|
|
|
6A7000
|
heap default
|
page read and write
|
|
|
|
67F5000
|
unkown
|
page read and write
|
|
|
|
6A40000
|
unkown
|
page read and write
|
|
|
|
820000
|
unkown
|
page read and write
|
|
|
|
684C000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
665E000
|
unkown
|
page read and write
|
|
|
|
DE0000
|
heap private
|
page execute and read and write
|
|
|
|
5CE0000
|
unkown
|
page read and write
|
|
|
|
620000
|
heap private
|
page read and write
|
|
|
|
5106000
|
unkown
|
page read and write
|
|
|
|
350000
|
unkown
|
page read and write
|
|
|
|
4A0000
|
unkown
|
page read and write
|
|
|
|
558D000
|
unkown
|
page read and write
|
|
|
|
74DC000
|
unkown
|
page read and write
|
|
|
|
65BA000
|
unkown
|
page read and write
|
|
|
|
4890000
|
unkown
|
page read and write
|
|
|
|
47A0000
|
unkown
|
page read and write
|
|
|
|
880000
|
heap default
|
page read and write
|
|
|
|
4BDF000
|
unkown
|
page read and write
|
|
|
|
618E000
|
unkown
|
page read and write
|
|
|
|
546E000
|
unkown
|
page read and write
|
|
|
|
6651000
|
unkown
|
page read and write
|
|
|
|
360000
|
unkown
|
page read and write
|
|
|
|
5942000
|
unkown
|
page readonly
|
|
|
|
6456000
|
unkown
|
page read and write
|
|
|
|
5985000
|
unkown
|
page readonly
|
|
|
|
5240000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
80000
|
unkown
|
page read and write
|
|
|
|
50AD000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
847000
|
heap default
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
6601000
|
unkown
|
page read and write
|
|
|
|
6A12000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
195000
|
unkown
|
page execute and read and write
|
|
|
|
F60000
|
unkown image
|
page readonly
|
|
|
|
7C0000
|
unkown
|
page read and write
|
|
|
|
CB0000
|
unkown
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
5925000
|
unkown
|
page readonly
|
|
|
|
25FB000
|
unkown
|
page read and write
|
|
|
|
523E000
|
unkown
|
page read and write
|
|
|
|
333000
|
unkown
|
page read and write
|
|
|
|
102E000
|
unkown image
|
page readonly
|
|
|
|
6AFB000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
810000
|
unkown
|
page read and write
|
|
|
|
14A000
|
unkown
|
page execute and read and write
|
|
|
|
6709000
|
unkown
|
page read and write
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
687E000
|
unkown
|
page read and write
|
|
|
|
92C000
|
heap default
|
page read and write
|
|
|
|
6AF9000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
69FE000
|
unkown
|
page read and write
|
|
|
|
59B2000
|
unkown
|
page readonly
|
|
|
|
4F10000
|
unkown
|
page read and write
|
|
|
|
820000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
62EF000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
5F0000
|
unkown
|
page read and write
|
|
|
|
D95F000
|
unkown
|
page read and write
|
|
|
|
4790000
|
unkown
|
page read and write
|
|
|
|
5A19000
|
unkown
|
page readonly
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
120000
|
unkown
|
page read and write
|
|
|
|
52D0000
|
heap private
|
page read and write
|
|
|
|
142000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
63D1000
|
unkown
|
page read and write
|
|
|
|
210000
|
unkown
|
page execute and read and write
|
|
|
|
505D000
|
unkown
|
page read and write
|
|
|
|
25A2000
|
unkown
|
page read and write
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
62D0000
|
unkown
|
page read and write
|
|
|
|
182000
|
unkown
|
page read and write
|
|
|
|
60D0000
|
unkown
|
page read and write
|
|
|
|
800000
|
unkown
|
page readonly
|
|
|
|
641D000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown
|
page read and write
|
|
|
|
4F23000
|
unkown
|
page read and write
|
|
|
|
3F0000
|
unkown
|
page read and write
|
|
|
|
63BA000
|
unkown
|
page read and write
|
|
|
|
2557000
|
unkown
|
page read and write
|
|
|
|
5140000
|
unkown
|
page read and write
|
|
|
|
6892000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
6270000
|
unkown
|
page read and write
|
|
|
|
5B9E000
|
unkown
|
page read and write
|
|
|
|
614E000
|
unkown
|
page read and write
|
|
|
|
336000
|
unkown
|
page read and write
|
|
|
|
3B0000
|
heap private
|
page execute and read and write
|
|
|
|
737A000
|
unkown
|
page read and write
|
|
|
|
660000
|
unkown
|
page read and write
|
|
|
|
6423000
|
unkown
|
page read and write
|
|
|
|
660000
|
unkown
|
page execute and read and write
|
|
|
|
652E000
|
unkown
|
page read and write
|
|
|
|
3F0000
|
unkown
|
page readonly
|
|
|
|
66A5000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
652E000
|
unkown
|
page read and write
|
|
|
|
6AB7000
|
unkown
|
page read and write
|
|
|
|
67C7000
|
unkown
|
page read and write
|
|
|
|
66AF000
|
unkown
|
page read and write
|
|
|
|
65BE000
|
unkown
|
page read and write
|
|
|
|
CB0000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
330000
|
unkown
|
page read and write
|
|
|
|
633E000
|
unkown
|
page read and write
|
|
|
|
5106000
|
unkown
|
page read and write
|
|
|
|
5D90000
|
unkown
|
page read and write
|
|
|
|
CA0000
|
unkown
|
page read and write
|
|
|
|
E20000
|
unkown
|
page read and write
|
|
|
|
6EA000
|
heap default
|
page read and write
|
|
|
|
4720000
|
unkown
|
page readonly
|
|
|
|
58B2000
|
unkown
|
page readonly
|
|
|
|
25BE000
|
unkown
|
page read and write | page guard
|
|
|
|
2598000
|
unkown
|
page read and write
|
|
|
|
641F000
|
unkown
|
page read and write
|
|
|
|
5C00000
|
unkown
|
page readonly
|
|
|
|
600000
|
unkown
|
page read and write
|
|
|
|
5872000
|
unkown
|
page readonly
|
|
|
|
550000
|
heap private
|
page execute and read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
5A35000
|
unkown
|
page readonly
|
|
|
|
67B8000
|
unkown
|
page read and write
|
|
|
|
E1F000
|
unkown
|
page read and write
|
|
|
|
674E000
|
unkown
|
page read and write
|
|
|
|
4A0C000
|
unkown
|
page read and write
|
|
|
|
61A1000
|
unkown
|
page read and write
|
|
|
|
6A8B000
|
unkown
|
page read and write
|
|
|
|
6ED0000
|
unkown
|
page read and write
|
|
|
|
670000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
4141000
|
unkown
|
page read and write
|
|
|
|
72AE000
|
unkown
|
page read and write
|
|
|
|
4980000
|
heap private
|
page execute and read and write
|
|
|
|
A025000
|
unkown
|
page read and write
|
|
|
|
6BAC000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
F3E000
|
unkown
|
page read and write
|
|
|
|
335000
|
unkown
|
page read and write
|
|
|
|
5FE000
|
unkown
|
page read and write
|
|
|
|
5A12000
|
unkown
|
page readonly
|
|
|
|
360000
|
unkown
|
page read and write
|
|
|
|
5BA2000
|
unkown
|
page readonly
|
|
|
|
110000
|
unkown
|
page read and write
|
|
|
|
5570000
|
unkown
|
page read and write
|
|
|
|
5C20000
|
unkown
|
page readonly
|
|
|
|
660D000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
200000
|
unkown
|
page read and write
|
|
|
|
6A14000
|
unkown
|
page read and write
|
|
|
|
6808000
|
unkown
|
page read and write
|
|
|
|
2B0000
|
unkown
|
page read and write
|
|
|
|
5382000
|
heap private
|
page read and write
|
|
|
|
18A000
|
unkown
|
page execute and read and write
|
|
|
|
5999000
|
unkown
|
page readonly
|
|
|
|
59E9000
|
unkown
|
page readonly
|
|
|
|
5122000
|
unkown
|
page read and write
|
|
|
|
6620000
|
unkown
|
page read and write
|
|
|
|
6379000
|
unkown
|
page read and write
|
|
|
|
5040000
|
unkown
|
page read and write
|
|
|
|
B10000
|
heap private
|
page read and write
|
|
|
|
340000
|
unkown
|
page read and write
|
|
|
|
5B0000
|
unkown
|
page read and write
|
|
|
|
22E000
|
unkown
|
page read and write
|
|
|
|
205000
|
unkown
|
page read and write
|
|
|
|
59D5000
|
unkown
|
page readonly
|
|
|
|
332000
|
unkown
|
page read and write
|
|
|
|
6F8F000
|
unkown
|
page read and write
|
|
|
|
50AC000
|
unkown
|
page read and write
|
|
|
|
690000
|
unkown
|
page read and write
|
|
|
|
56B8000
|
unkown
|
page readonly
|
|
|
|
5972000
|
unkown
|
page readonly
|
|
|
|
123000
|
unkown
|
page execute and read and write
|
|
|
|
D5EE000
|
stack
|
page read and write
|
|
|
|
19B000
|
unkown
|
page execute and read and write
|
|
|
|
626E000
|
unkown
|
page read and write
|
|
|
|
677C000
|
unkown
|
page read and write
|
|
|
|
5BC000
|
unkown
|
page read and write
|
|
|
|
6282000
|
unkown
|
page read and write
|
|
|
|
24A8000
|
unkown
|
page read and write
|
|
|
|
58F5000
|
unkown
|
page readonly
|
|
|
|
6A0000
|
heap default
|
page read and write
|
|
There are 708 hidden memdumps, click here to show them.