IOCReport

loading gif

Files

File Path
Type
Category
Malicious
AWB00028487364 -000487449287.doc
Rich Text Format data, unknown version
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\prosperx[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
downloaded
malicious
C:\Users\user\AppData\Roaming\prosper3512.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{08186652-BACB-4000-A55F-0BCBA7498F21}.tmp
data
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{55594574-8E09-401E-A760-1A1C7B299BE3}.tmp
data
dropped
clean
C:\Users\user\AppData\Local\Temp\02vqprgl0atfidc
data
dropped
clean
C:\Users\user\AppData\Local\Temp\nsu2B37.tmp
data
dropped
clean
C:\Users\user\AppData\Local\Temp\nsu2B38.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
clean
C:\Users\user\AppData\Local\Temp\wkxohdeyqvvyr
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\AWB00028487364 -000487449287.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:17 2020, mtime=Wed Aug 26 14:08:17 2020, atime=Thu Jun 10 22:21:34 2021, length=5618, window=hide
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
clean
C:\Users\user\Desktop\~$B00028487364 -000487449287.doc
data
dropped
clean
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
malicious
C:\Users\user\AppData\Roaming\prosper3512.exe
C:\Users\user\AppData\Roaming\prosper3512.exe
malicious
C:\Users\user\AppData\Roaming\prosper3512.exe
C:\Users\user\AppData\Roaming\prosper3512.exe
malicious
C:\Windows\explorer.exe
malicious
C:\Windows\SysWOW64\control.exe
C:\Windows\SysWOW64\control.exe
malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
clean
C:\Windows\SysWOW64\cmd.exe
/c del 'C:\Users\user\AppData\Roaming\prosper3512.exe'
clean

URLs

Name
IP
Malicious
www.updatesz.com/hlx/
malicious
http://search.chol.com/favicon.ico
unknown
clean
http://www.mercadolivre.com.br/
unknown
clean
http://www.merlin.com.pl/favicon.ico
unknown
clean
http://search.ebay.de/
unknown
clean
http://www.mtv.com/
unknown
clean
http://www.rambler.ru/
unknown
clean
http://www.nifty.com/favicon.ico
unknown
clean
http://www.dailymail.co.uk/
unknown
clean
http://www3.fnac.com/favicon.ico
unknown
clean
https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
unknown
clean
http://buscar.ya.com/
unknown
clean
http://search.yahoo.com/favicon.ico
unknown
clean
http://www.iis.fhg.de/audioPA
unknown
clean
http://www.sogou.com/favicon.ico
unknown
clean
http://asp.usatoday.com/
unknown
clean
http://fr.search.yahoo.com/
unknown
clean
http://rover.ebay.com
unknown
clean
http://in.search.yahoo.com/
unknown
clean
http://img.shopzilla.com/shopzilla/shopzilla.ico
unknown
clean
http://search.ebay.in/
unknown
clean
http://image.excite.co.jp/jp/favicon/lep.ico
unknown
clean
http://msk.afisha.ru/
unknown
clean
http://www.msn.com/?ocid=iehps
unknown
clean
http://busca.igbusca.com.br//app/static/images/favicon.ico
unknown
clean
https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1es
unknown
clean
http://search.rediff.com/
unknown
clean
http://www.windows.com/pctv.
unknown
clean
http://www.ya.com/favicon.ico
unknown
clean
http://www.etmall.com.tw/favicon.ico
unknown
clean
http://it.search.dada.net/favicon.ico
unknown
clean
http://search.naver.com/
unknown
clean
http://www.google.ru/
unknown
clean
http://search.hanafos.com/favicon.ico
unknown
clean
http://cgi.search.biglobe.ne.jp/favicon.ico
unknown
clean
http://www.abril.com.br/favicon.ico
unknown
clean
http://search.daum.net/
unknown
clean
http://search.naver.com/favicon.ico
unknown
clean
http://search.msn.co.jp/results.aspx?q=
unknown
clean
http://www.clarin.com/favicon.ico
unknown
clean
http://buscar.ozu.es/
unknown
clean
http://kr.search.yahoo.com/
unknown
clean
http://search.about.com/
unknown
clean
http://busca.igbusca.com.br/
unknown
clean
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
unknown
clean
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
unknown
clean
http://www.ask.com/
unknown
clean
http://www.priceminister.com/favicon.ico
unknown
clean
http://www.cjmall.com/
unknown
clean
http://search.centrum.cz/
unknown
clean
http://suche.t-online.de/
unknown
clean
http://www.google.it/
unknown
clean
http://search.auction.co.kr/
unknown
clean
http://www.ceneo.pl/
unknown
clean
http://www.amazon.de/
unknown
clean
http://nsis.sf.net/NSIS_Error
unknown
clean
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
unknown
clean
http://sads.myspace.com/
unknown
clean
http://busca.buscape.com.br/favicon.ico
unknown
clean
http://www.pchome.com.tw/favicon.ico
unknown
clean
http://browse.guardian.co.uk/favicon.ico
unknown
clean
http://google.pchome.com.tw/
unknown
clean
http://list.taobao.com/browse/search_visual.htm?n=15&q=
unknown
clean
http://www.rambler.ru/favicon.ico
unknown
clean
http://uk.search.yahoo.com/
unknown
clean
http://espanol.search.yahoo.com/
unknown
clean
http://www.ozu.es/favicon.ico
unknown
clean
http://search.sify.com/
unknown
clean
http://openimage.interpark.com/interpark.ico
unknown
clean
http://search.yahoo.co.jp/favicon.ico
unknown
clean
http://search.ebay.com/
unknown
clean
http://www.gmarket.co.kr/
unknown
clean
http://search.nifty.com/
unknown
clean
http://searchresults.news.com.au/
unknown
clean
http://www.google.si/
unknown
clean
http://www.google.cz/
unknown
clean
http://www.soso.com/
unknown
clean
http://www.univision.com/
unknown
clean
http://search.ebay.it/
unknown
clean
http://images.joins.com/ui_c/fvc_joins.ico
unknown
clean
http://www.asharqalawsat.com/
unknown
clean
http://busca.orange.es/
unknown
clean
http://cnweb.search.live.com/results.aspx?q=
unknown
clean
http://search.yahoo.co.jp
unknown
clean
http://www.target.com/
unknown
clean
http://buscador.terra.es/
unknown
clean
http://search.orange.co.uk/favicon.ico
unknown
clean
http://www.iask.com/
unknown
clean
http://www.tesco.com/
unknown
clean
http://cgi.search.biglobe.ne.jp/
unknown
clean
http://search.seznam.cz/favicon.ico
unknown
clean
http://suche.freenet.de/favicon.ico
unknown
clean
http://search.interpark.com/
unknown
clean
http://search.ipop.co.kr/favicon.ico
unknown
clean
http://investor.msn.com/
unknown
clean
http://search.espn.go.com/
unknown
clean
http://www.myspace.com/favicon.ico
unknown
clean
http://search.centrum.cz/favicon.ico
unknown
clean
http://p.zhongsou.com/favicon.ico
unknown
clean
http://service2.bfast.com/
unknown
clean
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
carbinz.ga
185.239.243.112
malicious
centerstageacademyaz.com
184.168.131.241
malicious
www.pwagih.com
unknown
malicious
www.skip1-dndasasd.com
unknown
malicious
www.centerstageacademyaz.com
unknown
malicious

IPs

IP
Domain
Country
Malicious
185.239.243.112
carbinz.ga
Moldova Republic of
malicious
184.168.131.241
centerstageacademyaz.com
United States
malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'!0
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
<'0
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
s#0
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ECE86
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F3D10
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F3D10
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EquationEditorFilesIntl_1033
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
SavedLegacySettings
clean
There are 313 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page execute and read and write
malicious
390000
unkown
page read and write
malicious
80000
unkown
page execute and read and write
malicious
400000
unkown image
page execute and read and write
malicious
1D0000
unkown
page execute and read and write
malicious
8D0000
unkown
page execute and read and write
malicious
290000
unkown
page execute and read and write
malicious
5C0000
unkown
page read and write
malicious
98AD000
unkown
page read and write
clean
43D0000
unkown
page write copy
clean
2C0000
unkown
page read and write
clean
9930000
unkown
page read and write
clean
3642000
unkown
page readonly
clean
70D000
unkown
page read and write
clean
C61B000
unkown
page read and write
clean
56B000
unkown
page read and write
clean
A3DA000
unkown
page write copy
clean
5CE2000
unkown
page readonly
clean
25D0000
unkown
page execute and read and write
clean
23A7000
unkown
page execute and read and write
clean
A3DF000
unkown
page write copy
clean
1F1D000
unkown
page read and write
clean
49FD000
unkown
page read and write
clean
34D2000
unkown
page readonly
clean
20000
unkown
page read and write
clean
2390000
unkown
page execute and read and write
clean
2AF0000
unkown
page read and write
clean
2690000
unkown
page readonly
clean
2E50000
unkown
page read and write
clean
64E000
unkown
page read and write
clean
577000
unkown
page read and write
clean
2C60000
unkown
page read and write
clean
1B9A000
unkown
page read and write
clean
66EF000
unkown
page readonly
clean
270000
unkown
page read and write
clean
60000
unkown
page readonly
clean
4460000
unkown
page read and write
clean
30B000
unkown
page read and write
clean
9920000
unkown
page read and write
clean
2E40000
unkown
page read and write
clean
614000
heap default
page read and write
clean
3619000
unkown
page readonly
clean
5B0000
unkown
page readonly
clean
1B5A000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
180000
unkown
page write copy
clean
72FE0000
unkown image
page readonly
clean
1DC4000
heap private
page read and write
clean
9A10000
unkown
page read and write
clean
630000
unkown
page read and write
clean
2A71000
unkown
page read and write
clean
47A6000
unkown
page read and write
clean
4520000
unkown
page readonly
clean
407000
unkown image
page readonly
clean
3AF0000
unkown
page read and write
clean
401000
unkown image
page execute read
clean
920000
unkown
page execute and read and write
clean
2E38000
unkown
page read and write
clean
37F000
unkown
page read and write
clean
46E0000
unkown
page read and write
clean
2510000
unkown
page write copy
clean
2A20000
unkown
page readonly
clean
35F6000
unkown
page readonly
clean
2EA0000
unkown
page read and write
clean
658000
unkown
page read and write
clean
10000
heap private
page read and write
clean
3940000
unkown
page read and write
clean
39EB000
unkown
page read and write
clean
3B90000
unkown
page read and write
clean
39F0000
unkown
page read and write
clean
2C60000
unkown
page read and write
clean
881000
unkown
page read and write
clean
9CED000
unkown
page read and write
clean
1F5000
heap default
page read and write
clean
2130000
unkown
page execute and read and write
clean
2EFE000
heap private
page read and write
clean
380000
unkown
page execute and read and write
clean
A3B9000
unkown
page write copy
clean
9A21000
unkown
page read and write
clean
2BE000
unkown
page read and write
clean
9A21000
unkown
page read and write
clean
2AB4000
unkown
page read and write
clean
460000
heap private
page read and write
clean
9A21000
unkown
page read and write
clean
34D4000
unkown
page readonly
clean
2830000
unkown
page read and write
clean
2533000
unkown
page read and write
clean
72FE5000
unkown image
page readonly
clean
CC60000
unkown
page read and write
clean
5A0000
unkown
page read and write
clean
968E000
unkown
page readonly
clean
1E3000
heap default
page read and write
clean
7A99000
unkown
page read and write
clean
2E80000
unkown
page read and write
clean
4ACB000
unkown
page read and write
clean
720000
unkown
page readonly
clean
726D000
unkown
page read and write
clean
323000
unkown
page read and write
clean
265C000
unkown
page read and write
clean
24B0000
unkown
page write copy
clean
20FF000
unkown
page read and write
clean
3679000
unkown
page readonly
clean
7490000
unkown
page write copy
clean
890000
unkown
page execute and read and write
clean
C6D2000
unkown
page read and write
clean
38A0000
unkown
page readonly
clean
1E00000
unkown
page readonly
clean
3C0000
unkown
page execute and read and write
clean
2097000
unkown
page read and write
clean
EA0000
unkown
page readonly
clean
9A27000
unkown
page read and write
clean
2060000
unkown
page readonly
clean
407000
unkown image
page readonly
clean
42B3000
unkown
page read and write
clean
620000
heap default
page read and write
clean
A17000
unkown
page execute and read and write
clean
1C70000
unkown
page readonly
clean
25D000
heap default
page read and write
clean
9A21000
unkown
page read and write
clean
3412000
unkown
page readonly
clean
260000
heap default
page read and write
clean
35F9000
unkown
page readonly
clean
409000
unkown image
page read and write
clean
401000
unkown image
page execute read
clean
94CF000
unkown
page readonly
clean
E0000
unkown
page readonly
clean
C6D7000
unkown
page read and write
clean
170000
unkown
page read and write
clean
967E000
unkown
page readonly
clean
2290000
unkown
page execute and read and write
clean
1B9A000
unkown
page read and write
clean
97D0000
unkown
page read and write
clean
2B80000
unkown
page read and write
clean
BCF0000
heap private
page read and write
clean
16E000
unkown
page read and write
clean
2ED0000
unkown
page readonly
clean
9A27000
unkown
page read and write
clean
380000
heap default
page read and write
clean
2830000
unkown
page read and write
clean
35D2000
unkown
page readonly
clean
25F2000
unkown
page read and write
clean
2EF000
unkown
page read and write
clean
CBE2000
unkown
page read and write
clean
2533000
unkown
page read and write
clean
884000
unkown
page read and write
clean
9A30000
unkown
page read and write
clean
B2C3000
heap private
page read and write
clean
4234000
unkown
page read and write
clean
BE8E000
unkown
page read and write
clean
266000
heap private
page read and write
clean
2587000
unkown
page readonly
clean
554000
heap default
page read and write
clean
9920000
unkown
page read and write
clean
170000
unkown
page read and write
clean
62F2000
unkown
page readonly
clean
2D20000
unkown
page execute read
clean
1BE0000
unkown
page read and write
clean
72FE1000
unkown image
page execute read
clean
2E90000
unkown
page read and write
clean
CC23000
unkown
page read and write
clean
9BCF000
unkown
page readonly
clean
21CE000
unkown
page read and write
clean
3A0000
unkown
page execute and read and write
clean
26F0000
unkown
page readonly
clean
98AA000
unkown
page read and write
clean
2091000
unkown
page read and write
clean
9A24000
unkown
page read and write
clean
3B98000
unkown
page read and write
clean
568000
unkown
page read and write
clean
2570000
unkown
page readonly
clean
23A1000
unkown
page execute and read and write
clean
8F0000
unkown
page read and write
clean
1E9000
heap default
page read and write
clean
2900000
unkown
page read and write
clean
98AD000
unkown
page read and write
clean
2EF5000
heap private
page read and write
clean
9A27000
unkown
page read and write
clean
28F000
unkown
page read and write
clean
540000
unkown
page execute and read and write
clean
1C70000
unkown
page readonly
clean
2E70000
unkown
page read and write
clean
240000
unkown
page readonly
clean
2BE0000
unkown
page readonly
clean
97D0000
unkown
page read and write
clean
7AC0000
heap private
page read and write
clean
C800000
unkown
page read and write
clean
2EE000
unkown
page read and write
clean
30D000
unkown
page read and write
clean
2666000
unkown
page read and write
clean
26F0000
unkown
page readonly
clean
2550000
unkown
page read and write
clean
1F5000
heap default
page read and write
clean
652000
heap default
page read and write
clean
1B5A000
unkown
page read and write
clean
409000
unkown image
page write copy
clean
BEA0000
heap private
page read and write
clean
1C13000
heap private
page read and write
clean
8313000
unkown
page read and write
clean
B2A0000
heap private
page read and write
clean
4B4E000
unkown
page read and write
clean
CB24000
unkown
page read and write
clean
545000
unkown
page execute and read and write
clean
27C0000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
2B30000
unkown
page readonly
clean
D20000
unkown
page readonly
clean
2DBF000
unkown
page read and write
clean
98AA000
unkown
page read and write
clean
2EF0000
heap private
page read and write
clean
2510000
unkown
page write copy
clean
2560000
unkown
page readonly
clean
C7FE000
unkown
page read and write
clean
21D0000
unkown
page readonly
clean
82DC000
unkown
page read and write
clean
41AD000
unkown
page read and write
clean
3572000
unkown
page readonly
clean
A40000
unkown
page readonly
clean
97D0000
unkown
page read and write
clean
1DE2000
heap private
page read and write
clean
2A80000
unkown
page read and write
clean
66C000
heap default
page read and write
clean
1AF0000
unkown
page read and write
clean
1D0000
heap default
page read and write
clean
1C80000
unkown
page readonly
clean
2E50000
unkown
page read and write
clean
4440000
unkown
page read and write
clean
414D000
unkown
page read and write
clean
3318000
unkown
page readonly
clean
39E0000
unkown
page read and write
clean
407000
unkown image
page readonly
clean
4060000
unkown
page read and write
clean
1E40000
unkown
page read and write
clean
2700000
unkown
page readonly
clean
C3A0000
unkown
page read and write
clean
2EC0000
unkown
page readonly
clean
2C0000
heap default
page read and write
clean
B320000
unkown
page read and write
clean
70FE000
unkown
page read and write
clean
170000
unkown
page read and write
clean
3312000
unkown
page readonly
clean
98AD000
unkown
page read and write
clean
D4000
heap private
page read and write
clean
2666000
unkown
page read and write
clean
5829000
unkown
page read and write
clean
8BCD000
unkown
page readonly
clean
9A10000
unkown
page read and write
clean
190000
unkown
page read and write
clean
6F0000
unkown
page readonly
clean
9A24000
unkown
page read and write
clean
2F90000
unkown
page readonly
clean
5A1000
unkown
page read and write
clean
9475000
unkown
page readonly
clean
1C13000
heap private
page read and write
clean
C7E0000
unkown
page read and write
clean
9A90000
unkown
page read and write
clean
3596000
unkown
page readonly
clean
2220000
unkown
page execute and read and write
clean
2D30000
unkown
page read and write
clean
4253000
unkown
page read and write
clean
1C0000
unkown
page readonly
clean
2710000
unkown
page readonly
clean
63F000
heap default
page read and write
clean
90A5000
unkown
page readonly
clean
52F000
unkown
page read and write
clean
5A3000
unkown
page read and write
clean
250000
unkown
page readonly
clean
97D0000
unkown
page read and write
clean
6888000
unkown
page readonly
clean
4530000
heap private
page read and write
clean
9A30000
unkown
page read and write
clean
2227000
unkown
page execute and read and write
clean
2C80000
unkown
page read and write
clean
2700000
unkown
page readonly
clean
6988000
unkown
page readonly
clean
98AA000
unkown
page read and write
clean
2C80000
unkown
page read and write
clean
87F000
unkown
page read and write
clean
B80000
unkown
page execute and read and write
clean
24B0000
unkown
page write copy
clean
1A0000
unkown
page read and write
clean
1BC0000
unkown
page read and write
clean
545000
unkown
page execute and read and write
clean
170000
unkown
page read and write
clean
966B000
unkown
page readonly
clean
60000
unkown
page readonly
clean
10000
heap private
page read and write
clean
3555000
unkown
page readonly
clean
1F90000
unkown
page read and write
clean
710B000
unkown
page read and write
clean
5230000
unkown
page read and write
clean
38B0000
unkown
page read and write
clean
26F000
unkown
page read and write
clean
3585000
unkown
page readonly
clean
1E9000
heap default
page read and write
clean
2436000
unkown
page read and write
clean
70A000
unkown
page read and write
clean
2B20000
unkown
page readonly
clean
1B40000
unkown
page readonly
clean
720000
unkown
page execute and read and write
clean
BA0000
unkown
page execute and read and write
clean
2C90000
unkown
page read and write
clean
8B0000
unkown
page execute and read and write
clean
8140000
unkown
page read and write
clean
2080000
unkown
page read and write
clean
18B000
unkown
page read and write
clean
2A50000
unkown
page readonly
clean
2410000
unkown
page execute and read and write
clean
20000
unkown
page read and write
clean
2BC0000
unkown
page write copy
clean
9930000
unkown
page read and write
clean
16E000
unkown
page read and write
clean
2BE0000
unkown
page readonly
clean
530000
heap default
page read and write
clean
28F1000
unkown
page read and write
clean
CB66000
unkown
page read and write
clean
2587000
unkown
page readonly
clean
21E0000
unkown
page readonly
clean
9A90000
unkown
page read and write
clean
4297000
unkown
page read and write
clean
34F2000
unkown
page readonly
clean
43BC000
unkown
page read and write
clean
2EE0000
unkown
page readonly
clean
4450000
unkown
page readonly
clean
6F90000
heap private
page read and write
clean
3566000
unkown
page readonly
clean
170000
unkown
page read and write
clean
170000
unkown
page read and write
clean
662000
heap default
page read and write
clean
27C0000
unkown
page read and write
clean
9930000
unkown
page read and write
clean
2560000
unkown
page readonly
clean
3672000
unkown
page readonly
clean
2CF0000
unkown
page read and write
clean
790000
unkown
page read and write
clean
8644000
unkown
page read and write
clean
2EB0000
unkown
page read and write
clean
4291000
unkown
page read and write
clean
2120000
unkown
page execute and read and write
clean
35FD000
unkown
page readonly
clean
72F0000
heap private
page read and write
clean
B149000
unkown
page read and write
clean
5680000
heap private
page read and write
clean
597A000
unkown
page read and write
clean
2A90000
unkown
page read and write
clean
2C2000
heap default
page read and write
clean
9A24000
unkown
page read and write
clean
854C000
unkown
page read and write
clean
4AC0000
unkown
page read and write
clean
C00000
unkown
page execute and read and write
clean
2570000
unkown
page readonly
clean
2D0000
unkown
page read and write
clean
98AA000
unkown
page read and write
clean
73EE000
unkown
page read and write
clean
30B000
unkown
page read and write
clean
2567000
unkown
page execute and read and write
clean
9768000
unkown
page readonly
clean
2CC0000
unkown
page read and write
clean
5A1E000
unkown
page read and write
clean
97D0000
unkown
page read and write
clean
4130000
unkown
page read and write
clean
2B20000
unkown
page readonly
clean
48B0000
heap private
page read and write
clean
2900000
unkown
page read and write
clean
401000
unkown image
page execute read
clean
2BB000
heap default
page read and write
clean
1C0000
unkown
page readonly
clean
90D2000
unkown
page readonly
clean
23A4000
unkown
page execute and read and write
clean
2CC0000
unkown
page read and write
clean
5DED000
unkown
page readonly
clean
2210000
unkown
page execute and read and write
clean
C610000
unkown
page read and write
clean
428F000
unkown
page read and write
clean
BCB9000
unkown
page read and write
clean
3B20000
unkown
page read and write
clean
98AD000
unkown
page read and write
clean
76C0000
heap private
page read and write
clean
260000
heap default
page read and write
clean
2AF0000
unkown
page read and write
clean
8471000
unkown
page read and write
clean
42C000
unkown image
page readonly
clean
A53E000
unkown
page read and write
clean
8890000
unkown
page readonly
clean
96F4000
unkown
page readonly
clean
A10000
unkown
page execute and read and write
clean
C4A0000
unkown
page read and write
clean
97D0000
unkown
page read and write
clean
53F000
unkown
page read and write
clean
2720000
unkown
page read and write
clean
1BF5000
heap private
page read and write
clean
35A2000
unkown
page readonly
clean
550000
unkown
page readonly
clean
B94000
unkown
page execute and read and write
clean
86B0000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
627000
heap default
page read and write
clean
6DEF000
unkown
page readonly
clean
F0000
unkown
page read and write
clean
9920000
unkown
page read and write
clean
4196000
unkown
page read and write
clean
6F94000
heap private
page read and write
clean
26D0000
unkown
page readonly
clean
856E000
unkown
page read and write
clean
C6CF000
unkown
page read and write
clean
85BE000
unkown
page read and write
clean
23B0000
unkown
page execute and read and write
clean
25A0000
unkown
page readonly
clean
4110000
unkown
page read and write
clean
2A80000
unkown
page read and write
clean
18C000
unkown
page read and write
clean
1AF0000
unkown
page read and write
clean
7B40000
unkown
page read and write
clean
3649000
unkown
page readonly
clean
20FF000
unkown
page read and write
clean
9A10000
unkown
page read and write
clean
2A71000
unkown
page read and write
clean
AA0000
unkown
page execute and read and write
clean
9930000
unkown
page read and write
clean
1F1A000
unkown
page read and write
clean
1FA0000
unkown
page read and write
clean
2ED0000
unkown
page readonly
clean
688B000
unkown
page readonly
clean
CAE0000
unkown
page read and write
clean
170000
unkown
page read and write
clean
780000
unkown
page read and write
clean
265C000
unkown
page read and write
clean
2CF0000
unkown
page read and write
clean
2EE000
unkown
page read and write
clean
9A30000
unkown
page read and write
clean
2A60000
unkown
page read and write
clean
3312000
unkown
page readonly
clean
550000
unkown
page readonly
clean
9A10000
unkown
page read and write
clean
4800000
heap private
page read and write
clean
1D0000
heap default
page read and write
clean
7410000
heap private
page read and write
clean
20BE000
unkown
page read and write
clean
9A30000
unkown
page read and write
clean
46B8000
unkown
page read and write
clean
B91000
unkown
page execute and read and write
clean
280000
heap private
page read and write
clean
5B71000
unkown
page readonly
clean
B334000
unkown
page read and write
clean
1BC0000
unkown
page read and write
clean
888E000
unkown
page read and write
clean
2070000
unkown
page readonly
clean
262F000
unkown
page read and write
clean
B150000
unkown
page read and write
clean
340000
unkown
page read and write
clean
1BB0000
unkown
page readonly
clean
2100000
unkown
page readonly
clean
2520000
unkown
page readonly
clean
9CF0000
unkown
page read and write
clean
2E80000
unkown
page read and write
clean
2DBF000
unkown
page read and write
clean
231000
heap default
page read and write
clean
3542000
unkown
page readonly
clean
9A27000
unkown
page read and write
clean
A80000
unkown
page execute and read and write
clean
1D7000
heap default
page read and write
clean
1B40000
unkown
page readonly
clean
2060000
unkown
page readonly
clean
340000
unkown
page read and write
clean
9A30000
unkown
page read and write
clean
2A50000
unkown
page readonly
clean
910000
unkown
page execute and read and write
clean
A14000
unkown
page execute and read and write
clean
429000
unkown image
page read and write
clean
8666000
unkown
page read and write
clean
5A20000
heap private
page read and write
clean
2720000
unkown
page read and write
clean
35C6000
unkown
page readonly
clean
26C0000
unkown
page read and write
clean
98AA000
unkown
page read and write
clean
BB20000
unkown
page read and write
clean
689E000
unkown
page readonly
clean
D0000
heap private
page read and write
clean
44B0000
unkown
page write copy
clean
2F70000
unkown
page readonly
clean
B0B0000
heap private
page read and write
clean
2C2000
heap default
page read and write
clean
3880000
unkown
page readonly
clean
7150000
heap private
page read and write
clean
170000
unkown
page read and write
clean
68AE000
unkown
page readonly
clean
4070000
unkown
page readonly
clean
630000
unkown
page execute and read and write
clean
2EF0000
heap private
page read and write
clean
2230000
unkown
page execute and read and write
clean
D4000
heap private
page read and write
clean
480A000
heap private
page read and write
clean
4B50000
unkown
page readonly
clean
8A0000
unkown
page readonly
clean
27C0000
unkown
page read and write
clean
422000
unkown image
page read and write
clean
565000
unkown
page read and write
clean
3E27000
unkown
page readonly
clean
2E2E000
unkown
page read and write
clean
1A0000
unkown
page read and write
clean
1DD000
heap default
page read and write
clean
2EFE000
heap private
page read and write
clean
842E000
unkown
page read and write
clean
26B0000
unkown
page readonly
clean
A3E9000
unkown
page write copy
clean
BFA0000
unkown
page read and write
clean
8AC2000
unkown
page readonly
clean
6FB3000
heap private
page read and write
clean
9A10000
unkown
page read and write
clean
2EC0000
unkown
page readonly
clean
44E0000
unkown
page read and write
clean
861C000
unkown
page read and write
clean
35B5000
unkown
page readonly
clean
9920000
unkown
page read and write
clean
2CD0000
unkown
page write copy
clean
310000
heap default
page read and write
clean
9A21000
unkown
page read and write
clean
3C3B000
unkown
page read and write
clean
1DD000
heap default
page read and write
clean
2AC0000
unkown
page read and write
clean
2D0000
unkown
page read and write
clean
2F70000
unkown
page readonly
clean
2CE0000
unkown
page read and write
clean
2B30000
unkown
page readonly
clean
2520000
unkown
page readonly
clean
540000
unkown
page execute and read and write
clean
98AD000
unkown
page read and write
clean
2EF9000
heap private
page read and write
clean
BF9F000
unkown
page read and write
clean
2A20000
unkown
page readonly
clean
20000
unkown
page readonly
clean
25A0000
unkown
page readonly
clean
170000
unkown
page read and write
clean
1D7000
heap default
page read and write
clean
26C0000
unkown
page readonly
clean
2B50000
unkown
page readonly
clean
82B0000
unkown
page read and write
clean
21E0000
unkown
page readonly
clean
2AB4000
unkown
page read and write
clean
A5CF000
unkown
page read and write
clean
839A000
unkown
page read and write
clean
1DC0000
heap private
page read and write
clean
887000
unkown
page read and write
clean
2CD0000
unkown
page write copy
clean
39F4000
unkown
page read and write
clean
9668000
unkown
page readonly
clean
1B80000
unkown
page read and write
clean
323000
unkown
page read and write
clean
34F4000
unkown
page readonly
clean
2B50000
unkown
page readonly
clean
9920000
unkown
page read and write
clean
8951000
unkown
page readonly
clean
170000
unkown
page read and write
clean
3B39000
unkown
page read and write
clean
B97000
unkown
page execute and read and write
clean
A3BE000
unkown
page write copy
clean
47A0000
unkown
page read and write
clean
409000
unkown image
page write copy
clean
4F30000
unkown
page readonly
clean
2E60000
unkown
page readonly
clean
2710000
unkown
page readonly
clean
1C0000
unkown
page readonly
clean
330000
heap private
page read and write
clean
2EB0000
unkown
page read and write
clean
20000
unkown
page read and write
clean
3FE000
unkown
page read and write
clean
2CA0000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
C10000
unkown
page execute and read and write
clean
9A27000
unkown
page read and write
clean
9930000
unkown
page read and write
clean
3840000
unkown
page readonly
clean
72FE3000
unkown image
page readonly
clean
58AF000
unkown
page read and write
clean
2C90000
unkown
page read and write
clean
B2A4000
heap private
page read and write
clean
26B0000
unkown
page readonly
clean
539000
unkown
page read and write
clean
72FE0000
unkown image
page readonly
clean
2E38000
unkown
page read and write
clean
2094000
unkown
page read and write
clean
3860000
unkown
page readonly
clean
4226000
unkown
page read and write
clean
6914000
unkown
page readonly
clean
30E000
unkown
page read and write
clean
2550000
unkown
page read and write
clean
56F000
unkown
page read and write
clean
2CB0000
unkown
page read and write
clean
2100000
unkown
page readonly
clean
2690000
unkown
page readonly
clean
A3E4000
unkown
page write copy
clean
2070000
unkown
page readonly
clean
2B1F000
unkown
page read and write
clean
9A10000
unkown
page read and write
clean
4500000
unkown
page readonly
clean
9A27000
unkown
page read and write
clean
9930000
unkown
page read and write
clean
26BF000
unkown
page read and write
clean
8D000
unkown
page read and write
clean
6F0000
unkown
page readonly
clean
9A30000
unkown
page read and write
clean
2E40000
unkown
page read and write
clean
B0B5000
heap private
page read and write
clean
24C000
unkown
page read and write
clean
4610000
unkown
page read and write
clean
8040000
unkown
page read and write
clean
652000
heap default
page read and write
clean
9920000
unkown
page read and write
clean
3C40000
unkown
page readonly
clean
3AEF000
unkown
page read and write
clean
1BF0000
heap private
page read and write
clean
2100000
unkown
page read and write
clean
A90000
unkown
page execute and read and write
clean
9A90000
unkown
page read and write
clean
D1F000
unkown
page read and write
clean
2D30000
unkown
page read and write
clean
25D000
heap default
page read and write
clean
9A24000
unkown
page read and write
clean
5A5000
unkown
page read and write
clean
42CB000
unkown
page read and write
clean
1E3000
heap default
page read and write
clean
26A0000
unkown
page readonly
clean
400000
unkown image
page readonly
clean
5EF000
unkown
page read and write
clean
260000
heap private
page read and write
clean
2A60000
unkown
page read and write
clean
1B80000
unkown
page read and write
clean
1CC000
unkown
page read and write
clean
C2A0000
unkown
page read and write
clean
9A24000
unkown
page read and write
clean
8C2A000
unkown
page readonly
clean
2540000
unkown
page read and write
clean
340000
unkown
page read and write
clean
428C000
unkown
page read and write
clean
2E70000
unkown
page read and write
clean
9A10000
unkown
page read and write
clean
537000
heap default
page read and write
clean
317F000
unkown
page read and write
clean
26C0000
unkown
page readonly
clean
9A21000
unkown
page read and write
clean
9A90000
unkown
page read and write
clean
3318000
unkown
page readonly
clean
6F70000
unkown
page read and write
clean
A330000
unkown
page write copy
clean
9920000
unkown
page read and write
clean
4470000
unkown
page readonly
clean
55C000
unkown
page read and write
clean
4051000
unkown
page read and write
clean
C0A0000
unkown
page read and write
clean
28F1000
unkown
page read and write
clean
82FD000
unkown
page read and write
clean
98AD000
unkown
page read and write
clean
1BF0000
heap private
page read and write
clean
3612000
unkown
page readonly
clean
179000
unkown
page read and write
clean
2CE0000
unkown
page read and write
clean
2224000
unkown
page execute and read and write
clean
1BD0000
unkown
page read and write
clean
2B40000
unkown
page readonly
clean
870000
unkown
page read and write
clean
77F0000
unkown
page read and write
clean
2B80000
unkown
page read and write
clean
190000
unkown
page read and write
clean
9A24000
unkown
page read and write
clean
2EF9000
heap private
page read and write
clean
596F000
unkown
page read and write
clean
2E90000
unkown
page read and write
clean
BEA5000
heap private
page read and write
clean
1C0000
unkown
page readonly
clean
25D5000
unkown
page execute and read and write
clean
62C5000
unkown
page readonly
clean
9A30000
unkown
page read and write
clean
3695000
unkown
page readonly
clean
3412000
unkown
page readonly
clean
30D000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
2D20000
unkown
page execute read
clean
4294000
unkown
page read and write
clean
57C000
unkown
page read and write
clean
42C000
unkown image
page readonly
clean
579E000
unkown
page read and write
clean
2EA0000
unkown
page read and write
clean
430000
unkown
page readonly
clean
2CB0000
unkown
page read and write
clean
5E4A000
unkown
page readonly
clean
35E5000
unkown
page readonly
clean
CBA0000
unkown
page read and write
clean
22B0000
unkown
page execute and read and write
clean
9A90000
unkown
page read and write
clean
6F77000
unkown
page read and write
clean
B0000
unkown
page readonly
clean
BEC3000
heap private
page read and write
clean
26D0000
unkown
page readonly
clean
1BB0000
unkown
page readonly
clean
A00000
unkown
page execute and read and write
clean
3514000
unkown
page readonly
clean
231000
heap default
page read and write
clean
1BF5000
heap private
page read and write
clean
26A0000
unkown
page readonly
clean
5F0000
heap default
page read and write
clean
82D0000
unkown
page read and write
clean
582B000
unkown
page read and write
clean
20000
unkown
page readonly
clean
170000
unkown
page read and write
clean
9A90000
unkown
page read and write
clean
2540000
unkown
page read and write
clean
1BD0000
unkown
page read and write
clean
98AA000
unkown
page read and write
clean
340000
unkown
page read and write
clean
7040000
heap private
page read and write
clean
5AB0000
unkown
page readonly
clean
2E2E000
unkown
page read and write
clean
E0000
unkown
page readonly
clean
5F7000
heap default
page read and write
clean
2E60000
unkown
page readonly
clean
8662000
unkown
page read and write
clean
27C0000
unkown
page read and write
clean
A20000
unkown
page execute and read and write
clean
4510000
unkown
page execute and read and write
clean
890000
unkown
page read and write
clean
2B40000
unkown
page readonly
clean
4616000
unkown
page read and write
clean
CCA3000
unkown
page read and write
clean
1BE0000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
2EE0000
unkown
page readonly
clean
3802000
unkown
page readonly
clean
46B0000
unkown
page read and write
clean
2CA0000
unkown
page read and write
clean
2EF5000
heap private
page read and write
clean
C1A0000
unkown
page read and write
clean
120000
unkown
page read and write
clean
78EE000
unkown
page read and write
clean
644000
heap default
page read and write
clean
D0000
heap private
page read and write
clean
77F9000
unkown
page read and write
clean
393E000
unkown
page read and write
clean
9930000
unkown
page read and write
clean
9A21000
unkown
page read and write
clean
58B6000
unkown
page read and write
clean
9A90000
unkown
page read and write
clean
6695000
unkown
page readonly
clean
2F90000
unkown
page readonly
clean
53E000
unkown
page read and write
clean
9A24000
unkown
page read and write
clean
CAA3000
unkown
page read and write
clean
2440000
unkown
page execute and read and write
clean
98AA000
unkown
page read and write
clean
2BC0000
unkown
page write copy
clean
3D0000
unkown
page readonly
clean
98AD000
unkown
page read and write
clean
22A0000
unkown
page execute and read and write
clean
2420000
unkown
page execute and read and write
clean
4263000
unkown
page read and write
clean
179000
unkown
page read and write
clean
180000
unkown
page write copy
clean
8B000
unkown
page read and write
clean
3665000
unkown
page readonly
clean
3512000
unkown
page readonly
clean
4090000
heap private
page read and write
clean
A328000
unkown
page read and write
clean
470000
unkown
page execute and read and write
clean
F0000
unkown
page read and write
clean
20A0000
unkown
page read and write
clean
16E000
unkown
page read and write
clean
3635000
unkown
page readonly
clean
42C000
unkown image
page readonly
clean
3BB8000
unkown
page read and write
clean
170000
unkown
page read and write
clean
55F000
unkown
page read and write
clean
2BB000
heap default
page read and write
clean
3D0000
unkown
page readonly
clean
55E000
unkown
page read and write
clean
419A000
unkown
page read and write
clean
9A27000
unkown
page read and write
clean
25F2000
unkown
page read and write
clean
97D0000
unkown
page read and write
clean
57C000
unkown
page read and write
clean
There are 767 hidden memdumps, click here to show them.