IOC Report

loading gif

Files

File Path
Type
Category
Malicious
a3.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{063EC3E3-27C5-11EC-90E9-ECF4BB862DED}.dat
Microsoft Word Document
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{063EC3E5-27C5-11EC-90E9-ECF4BB862DED}.dat
Microsoft Word Document
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log
ASCII text, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Local\Temp\~DF1728008F459C4534.TMP
data
dropped
clean
C:\Users\user\AppData\Local\Temp\~DF8F568B21079AA7B9.TMP
data
dropped
clean
There are 5 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\a3.exe
'C:\Users\user\Desktop\a3.exe'
malicious
C:\Program Files\internet explorer\iexplore.exe
'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
clean
C:\Program Files (x86)\Internet Explorer\iexplore.exe
'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6308 CREDAT:17410 /prefetch:2
clean

URLs

Name
IP
Malicious
http://api5.feen007.at/favicon.ico
87.106.18.141
malicious
http://www.wikipedia.com/
unknown
clean
http://www.amazon.com/
unknown
clean
http://www.nytimes.com/
unknown
clean
http://www.live.com/
unknown
clean
http://api5.feen007.at/webstore/DcjIiNGkOSL0_2FzFS0SI/7PtL4T1ixNrirqXI/ZpdUtfjmbk9XGDI/gk7_2BOWav_2F
unknown
clean
http://www.reddit.com/
unknown
clean
http://www.twitter.com/
unknown
clean
http://www.youtube.com/
unknown
clean
http://www.google.com/
unknown
clean

Domains

Name
IP
Malicious
api5.feen007.at
87.106.18.141
malicious
windowsupdate.s.llnwi.net
178.79.242.0
clean

IPs

IP
Domain
Country
Malicious
87.106.18.141
api5.feen007.at
Germany
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\AdminActive
{063EC3E3-27C5-11EC-90E9-ECF4BB862DED}
clean
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery
AdminActive
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore
Count
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore
Time
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore
Blocked
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
Count
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
Time
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
Count
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
Time
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
LoadTimeArray
clean
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
LoadTimeArray
clean
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\BrowserEmulation
CVListPingLastYMD
clean
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\BrowserEmulation
CVListPingBitmap
clean
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\BrowserEmulation
CVListPingRandomizedBitmap
clean
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage
DecayDateQueue
clean
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage
LastProcessed
clean
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage
DecayDateQueue
clean
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage
LastProcessed
clean
There are 8 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3410000
unkown
page execute and read and write
malicious
5E78000
heap private
page read and write
malicious
5629000
heap private
page read and write
malicious
5E78000
heap private
page read and write
malicious
5E78000
heap private
page read and write
malicious
5E78000
heap private
page read and write
malicious
5E78000
heap private
page read and write
malicious
5E78000
heap private
page read and write
malicious
5E78000
heap private
page read and write
malicious
5E78000
heap private
page read and write
malicious
5E78000
heap private
page read and write
malicious
4E00000
unkown
page read and write
clean
39E0000
unkown image
page readonly
clean
1C3C3987000
unkown
page read and write
clean
1C3C39A3000
unkown
page read and write
clean
217B0702000
unkown
page read and write
clean
426000
unkown image
page read and write
clean
217B0B80000
unkown image
page readonly
clean
161E4E46000
heap default
page read and write
clean
161E5300000
unkown image
page readonly
clean
7DF4724E0000
unkown image
page readonly
clean
1C3C3113000
unkown
page read and write
clean
505E000
unkown
page read and write
clean
1C3C3E02000
unkown
page read and write
clean
7DF418400000
unkown image
page readonly
clean
7FF522FB1000
unkown image
page readonly
clean
1C3C394E000
unkown
page read and write
clean
7FF566587000
unkown image
page readonly
clean
7DF51A542000
unkown image
page readonly
clean
1C3C30A4000
unkown
page read and write
clean
7FF542B4D000
unkown image
page readonly
clean
509E000
unkown
page read and write
clean
F4E5F6B000
unkown
page read and write
clean
1AA97400000
unkown
page read and write
clean
31E267B000
unkown
page read and write
clean
7FF542D81000
unkown image
page readonly
clean
7FF522FC1000
unkown image
page readonly
clean
1C3C39B8000
unkown
page read and write
clean
4D119E000
unkown
page read and write
clean
1C73B5B0000
unkown
page read and write
clean
7FF542CD3000
unkown image
page readonly
clean
1C3C398F000
unkown
page read and write
clean
7FFC0000
unkown image
page readonly
clean
1C3C397C000
unkown
page read and write
clean
7FF5668D7000
unkown image
page readonly
clean
7FF566831000
unkown image
page readonly
clean
7FF522F3D000
unkown image
page readonly
clean
178A49C000
unkown
page read and write
clean
7DF51A550000
unkown image
page readonly
clean
3438000
unkown
page execute and read and write
clean
1C3C3981000
unkown
page read and write
clean
4F6C000
unkown image
page readonly
clean
7DF5C1BB2000
unkown image
page readonly
clean
7DF596060000
unkown image
page readonly
clean
1C3C3913000
unkown
page read and write
clean
161E4E6C000
unkown
page read and write
clean
1C3C397F000
unkown
page read and write
clean
7DF530C22000
unkown image
page readonly
clean
1C3C398F000
unkown
page read and write
clean
1C3C3029000
unkown
page read and write
clean
843707D000
unkown
page read and write
clean
1C3C3981000
unkown
page read and write
clean
7FF542D59000
unkown image
page readonly
clean
161E4E78000
unkown
page read and write
clean
217B068B000
unkown
page read and write
clean
7FF58833E000
unkown image
page readonly
clean
7DF4BFA70000
unkown image
page readonly
clean
7FF50C755000
unkown image
page readonly
clean
178A87E000
unkown
page read and write
clean
1C3C3900000
unkown
page read and write
clean
1C73AAD9000
heap private
page read and write
clean
217B04C0000
heap default
page read and write
clean
31E26FE000
unkown
page read and write
clean
217B0460000
heap private
page read and write
clean
1C3C3980000
unkown
page read and write
clean
1C3C3E02000
unkown
page read and write
clean
18517A2A000
unkown
page read and write
clean
7FF5B3E60000
unkown image
page readonly
clean
178A979000
unkown
page read and write
clean
7FF542BDB000
unkown image
page readonly
clean
1C3C3991000
unkown
page read and write
clean
404000
unkown image
page execute and read and write
clean
7DF5509E2000
unkown image
page readonly
clean
7FF566317000
unkown image
page readonly
clean
7FF542D81000
unkown image
page readonly
clean
7FF5B3E63000
unkown image
page readonly
clean
7FF588303000
unkown image
page readonly
clean
7FF50C84D000
unkown image
page readonly
clean
7FF50C7F0000
unkown image
page readonly
clean
7FF522EE7000
unkown image
page readonly
clean
31E2BFE000
unkown
page read and write
clean
1C3C398E000
unkown
page read and write
clean
3495000
unkown
page read and write
clean
7FF542CB7000
unkown image
page readonly
clean
7FF542B8F000
unkown image
page readonly
clean
7FF542CA3000
unkown image
page readonly
clean
7FF542CA0000
unkown image
page readonly
clean
1C3C398E000
unkown
page read and write
clean
4E00000
unkown
page read and write
clean
7FF522ECF000
unkown image
page readonly
clean
1C3C2F60000
unkown image
page readonly
clean
843757D000
unkown
page read and write
clean
7FF50C7C7000
unkown image
page readonly
clean
1C3C3E02000
unkown
page read and write
clean
1C3C39BE000
unkown
page read and write
clean
7FF522F3A000
unkown image
page readonly
clean
7FF59FE51000
unkown image
page readonly
clean
217B0600000
unkown
page read and write
clean
7DF5509E2000
unkown image
page readonly
clean
F4E647B000
unkown
page read and write
clean
161E4E61000
unkown
page read and write
clean
1C3C398E000
unkown
page read and write
clean
7FF56670F000
unkown image
page readonly
clean
1C3C3968000
unkown
page read and write
clean
24C000
unkown
page read and write
clean
1C3C3108000
unkown
page read and write
clean
1C73ACF0000
unkown image
page readonly
clean
1C3C3991000
unkown
page read and write
clean
7DF5C1BB0000
unkown image
page readonly
clean
7FF5669AA000
unkown image
page readonly
clean
7FF588235000
unkown image
page readonly
clean
18517830000
unkown image
page read and write
clean
1C3C39AF000
unkown
page read and write
clean
1C3C2E20000
heap private
page read and write
clean
7FF587EC1000
unkown image
page readonly
clean
1C3C3400000
unkown image
page readonly
clean
1C73A810000
heap default
page read and write
clean
1C3C3E1E000
unkown
page read and write
clean
18517980000
unkown image
page readonly
clean
1C3C3989000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
7FF58832B000
unkown image
page readonly
clean
7FF50C807000
unkown image
page readonly
clean
7FF542C01000
unkown image
page readonly
clean
7FF542C8D000
unkown image
page readonly
clean
18517A00000
unkown
page read and write
clean
217B064F000
unkown
page read and write
clean
178A8FE000
unkown
page read and write
clean
7FF50C3B1000
unkown image
page readonly
clean
18517B08000
unkown
page read and write
clean
178A9FE000
unkown
page read and write
clean
1C3C3948000
unkown
page read and write
clean
843747E000
unkown
page read and write
clean
4D109B000
unkown
page read and write
clean
217B0655000
unkown
page read and write
clean
7DF574610000
unkown image
page readonly
clean
7FF50C725000
unkown image
page readonly
clean
1C3C30DF000
unkown
page read and write
clean
1C3C3802000
unkown
page read and write
clean
1C3C39A0000
unkown
page read and write
clean
18517B00000
unkown
page read and write
clean
1AA97290000
heap default
page read and write
clean
7FF50C656000
unkown image
page readonly
clean
39F0000
unkown image
page readonly
clean
178AA7B000
unkown
page read and write
clean
7DF596042000
unkown image
page readonly
clean
7FF50C847000
unkown image
page readonly
clean
1C73A817000
heap default
page read and write
clean
7FF566677000
unkown image
page readonly
clean
7FF588300000
unkown image
page readonly
clean
1AA97508000
unkown
page read and write
clean
4FD0000
heap private
page read and write
clean
7FF58835A000
unkown image
page readonly
clean
7FF542CFD000
unkown image
page readonly
clean
1C3C3971000
unkown
page read and write
clean
18517A5A000
unkown
page read and write
clean
217B0629000
unkown
page read and write
clean
7FF5881B0000
unkown image
page readonly
clean
18517A5E000
unkown
page read and write
clean
7FFD0000
unkown image
page readonly
clean
31D8000
unkown image
page readonly
clean
217B064B000
unkown
page read and write
clean
1C3C3000000
unkown
page read and write
clean
161E50F0000
heap private
page read and write
clean
1AA9744D000
unkown
page read and write
clean
1C3C39A2000
unkown
page read and write
clean
3660000
unkown image
page readonly
clean
161E4D00000
unkown image
page readonly
clean
1C3C3976000
unkown
page read and write
clean
7DF5C1BA0000
unkown image
page readonly
clean
7FF50C72B000
unkown image
page readonly
clean
18517A68000
unkown
page read and write
clean
1C3C3057000
unkown
page read and write
clean
1C3C39D0000
unkown
page read and write
clean
7FF5669B1000
unkown image
page readonly
clean
7FF50C81B000
unkown image
page readonly
clean
1C73B5C0000
unkown
page readonly
clean
7DF51A540000
unkown image
page readonly
clean
67A7F9000
unkown
page read and write
clean
5E7B000
heap private
page read and write
clean
7FF56679B000
unkown image
page readonly
clean
18517C00000
unkown image
page readonly
clean
1C3C397F000
unkown
page read and write
clean
1C3C397F000
unkown
page read and write
clean
18517A69000
unkown
page read and write
clean
1C3C3E02000
unkown
page read and write
clean
7FF588357000
unkown image
page readonly
clean
1C3C39A4000
unkown
page read and write
clean
7FF56689E000
unkown image
page readonly
clean
4E00000
unkown
page read and write
clean
7FF542CDE000
unkown image
page readonly
clean
1C3C2F80000
unkown
page read and write
clean
1C73AEF0000
unkown image
page readonly
clean
3400000
unkown image
page readonly
clean
1C3C3991000
unkown
page read and write
clean
217B0470000
unkown image
page readonly
clean
1C3C3990000
unkown
page read and write
clean
7FF58823B000
unkown image
page readonly
clean
161E4E10000
unkown
page read and write
clean
1C3C398C000
unkown
page read and write
clean
F4E627E000
unkown
page read and write
clean
1C3C3990000
unkown
page read and write
clean
5110000
heap private
page read and write
clean
1C3C3989000
unkown
page read and write
clean
1C3C2FF0000
unkown
page read and write
clean
5F8F000
unkown
page read and write
clean
32B0000
heap default
page read and write
clean
1C3C39B4000
unkown
page read and write
clean
34A6000
unkown
page read and write
clean
1AA97370000
unkown image
page readonly
clean
7DF530C20000
unkown image
page readonly
clean
1C3C398E000
unkown
page read and write
clean
1C73A7A0000
unkown
page read and write
clean
1C3C3987000
unkown
page read and write
clean
1C3C3981000
unkown
page read and write
clean
1C73AAD0000
heap private
page read and write
clean
32B5000
heap default
page read and write
clean
1AA97402000
unkown
page read and write
clean
1C3C397F000
unkown
page read and write
clean
1C3C39AB000
unkown
page read and write
clean
1C3C3992000
unkown
page read and write
clean
7FF56688E000
unkown image
page readonly
clean
7FF50C6A0000
unkown image
page readonly
clean
1C3C397F000
unkown
page read and write
clean
1C3C3993000
unkown
page read and write
clean
7DF530C22000
unkown image
page readonly
clean
7DF574630000
unkown image
page readonly
clean
1C73A862000
unkown
page read and write
clean
7FF522FAA000
unkown image
page readonly
clean
1C3C2E50000
unkown image
page readonly
clean
18517850000
unkown image
page readonly
clean
7FF566715000
unkown image
page readonly
clean
178A51E000
unkown
page read and write
clean
1C3C3056000
unkown
page read and write
clean
4D197F000
unkown
page read and write
clean
3428000
heap default
page read and write
clean
8436D4B000
unkown
page read and write
clean
7FF5883DA000
unkown image
page readonly
clean
1C3C3E02000
unkown
page read and write
clean
7FF588333000
unkown image
page readonly
clean
7FF5669A1000
unkown image
page readonly
clean
7FF5667BF000
unkown image
page readonly
clean
40000
unkown image
page readonly
clean
161E4E78000
unkown
page read and write
clean
7DF5509F2000
unkown image
page readonly
clean
7FF5668C3000
unkown image
page readonly
clean
1C3C399A000
unkown
page read and write
clean
7FF5883B9000
unkown image
page readonly
clean
18517880000
unkown image
page readonly
clean
1AA97C02000
unkown
page read and write
clean
7DF493F10000
unkown image
page readonly
clean
7FF542CFA000
unkown image
page readonly
clean
7FF50C7F3000
unkown image
page readonly
clean
1C73A862000
unkown
page read and write
clean
426000
unkown image
page write copy
clean
7FF50C7FE000
unkown image
page readonly
clean
7FF56621C000
unkown image
page readonly
clean
7FF522F1E000
unkown image
page readonly
clean
185178A0000
heap default
page read and write
clean
7FF5668BF000
unkown image
page readonly
clean
7FF5B37CE000
unkown image
page readonly
clean
1C3C304B000
unkown
page read and write
clean
1AA97502000
unkown
page read and write
clean
18517A5C000
unkown
page read and write
clean
7FF50C7E3000
unkown image
page readonly
clean
161E4F30000
unkown
page read and write
clean
7FF50C681000
unkown image
page readonly
clean
618F000
unkown
page read and write
clean
217B0470000
unkown image
page readonly
clean
217B064D000
unkown
page read and write
clean
1C3C3989000
unkown
page read and write
clean
1C3C30EA000
unkown
page read and write
clean
1C73A660000
unkown image
page read and write
clean
7FF588265000
unkown image
page readonly
clean
7FF50C6BB000
unkown image
page readonly
clean
7FF50C74B000
unkown image
page readonly
clean
161E4E56000
unkown
page read and write
clean
1C3C3990000
unkown
page read and write
clean
7FF50C8BA000
unkown image
page readonly
clean
1C3C397F000
unkown
page read and write
clean
217B0A00000
unkown image
page readonly
clean
1C3C3058000
unkown
page read and write
clean
7FF542B50000
unkown image
page readonly
clean
8436DCE000
unkown
page read and write
clean
7FF5B3AFE000
unkown image
page readonly
clean
161E4E7B000
unkown
page read and write
clean
7FF5B3F19000
unkown image
page readonly
clean
7DF596060000
unkown image
page readonly
clean
7FF566682000
unkown image
page readonly
clean
34AB000
unkown
page read and write
clean
4E00000
unkown
page read and write
clean
40000
unkown image
page readonly
clean
7FF5B3F41000
unkown image
page readonly
clean
7FF522EEE000
unkown image
page readonly
clean
161E4E78000
unkown
page read and write
clean
1C73B5E0000
unkown
page read and write
clean
1C3C3987000
unkown
page read and write
clean
7FF5B3E53000
unkown image
page readonly
clean
7FF522EE3000
unkown image
page readonly
clean
67A3CA000
unkown
page read and write
clean
7FF5668A7000
unkown image
page readonly
clean
7FF5668DE000
unkown image
page readonly
clean
1C3C397A000
unkown
page read and write
clean
7FF566927000
unkown image
page readonly
clean
4E3C000
unkown
page read and write
clean
7DF574622000
unkown image
page readonly
clean
217B066E000
unkown
page read and write
clean
1C3C397A000
unkown
page read and write
clean
7FF5666F4000
unkown image
page readonly
clean
7FF542C89000
unkown image
page readonly
clean
7FF56688A000
unkown image
page readonly
clean
7FF5667C2000
unkown image
page readonly
clean
161E4E61000
unkown
page read and write
clean
3443000
unkown
page read and write
clean
217B0450000
unkown image
page read and write
clean
3470000
unkown
page read and write
clean
7FF566736000
unkown image
page readonly
clean
7FF588317000
unkown image
page readonly
clean
1C3C397F000
unkown
page read and write
clean
1C3C3102000
unkown
page read and write
clean
1C3C39B3000
unkown
page read and write
clean
1C3C399E000
unkown
page read and write
clean
31D8000
unkown image
page readonly
clean
1C3C3993000
unkown
page read and write
clean
161E4D00000
unkown image
page readonly
clean
501E000
unkown
page read and write
clean
7FF566805000
unkown image
page readonly
clean
7FF542CA7000
unkown image
page readonly
clean
7FF50C7DF000
unkown image
page readonly
clean
1A0000
unkown image
page readonly
clean
1C3C3981000
unkown
page read and write
clean
161E4F70000
unkown image
page readonly
clean
7FF542D64000
unkown image
page readonly
clean
7FF5B3E56000
unkown image
page readonly
clean
1AA97260000
unkown image
page readonly
clean
67A6FE000
unkown
page read and write
clean
1C3C2FF0000
unkown
page read and write
clean
161E4CE0000
unkown image
page read and write
clean
7FF542A7C000
unkown image
page readonly
clean
7FF5B3793000
unkown image
page readonly
clean
7FF588261000
unkown image
page readonly
clean
1C3C30AF000
unkown
page read and write
clean
7FF5B3E4F000
unkown image
page readonly
clean
1C3C39A1000
unkown
page read and write
clean
1C3C303C000
unkown
page read and write
clean
1C73B5D0000
unkown
page read and write
clean
843767E000
unkown
page read and write
clean
1C3C3989000
unkown
page read and write
clean
7FF566519000
unkown image
page readonly
clean
1C3C3200000
unkown image
page readonly
clean
18517A3C000
unkown
page read and write
clean
1C3C397F000
unkown
page read and write
clean
7FFC0000
unkown image
page readonly
clean
1C3C30F9000
unkown
page read and write
clean
217B0708000
unkown
page read and write
clean
1C3C3993000
unkown
page read and write
clean
1C73A85B000
unkown
page read and write
clean
420000
unkown image
page readonly
clean
7FF5883C4000
unkown image
page readonly
clean
1C3C36B0000
unkown image
page read and write
clean
7DF51A532000
unkown image
page readonly
clean
7FF5882F3000
unkown image
page readonly
clean
1AA97513000
unkown
page read and write
clean
1AA9743C000
unkown
page read and write
clean
7DF530C20000
unkown image
page readonly
clean
67A67E000
unkown
page read and write
clean
1C3C3972000
unkown
page read and write
clean
7DF5509E0000
unkown image
page readonly
clean
1AA97270000
unkown image
page readonly
clean
34AB000
unkown
page read and write
clean
608F000
unkown
page read and write
clean
406000
unkown image
page execute and read and write
clean
1C3C3E6A000
unkown
page read and write
clean
217B05C0000
unkown
page read and write
clean
1AA97450000
unkown
page read and write
clean
1C3C30E6000
unkown
page read and write
clean
1C73A847000
heap default
page read and write
clean
4E00000
unkown
page read and write
clean
1C3C397F000
unkown
page read and write
clean
18517A66000
unkown
page read and write
clean
7FF5B3D57000
unkown image
page readonly
clean
161E4E7A000
unkown
page read and write
clean
7FF5883D1000
unkown image
page readonly
clean
18517A64000
unkown
page read and write
clean
1C3C39C7000
unkown
page read and write
clean
1C3C39A2000
unkown
page read and write
clean
7FF566701000
unkown image
page readonly
clean
4E00000
unkown
page read and write
clean
18517A52000
unkown
page read and write
clean
1C3C3051000
unkown
page read and write
clean
7DF44E8B0000
unkown image
page readonly
clean
1C73AA90000
unkown image
page readonly
clean
1C3C2E80000
heap default
page read and write
clean
7FF588065000
unkown image
page readonly
clean
1C3C3E19000
unkown
page read and write
clean
4F6F000
unkown image
page readonly
clean
7DF596040000
unkown image
page readonly
clean
7FF5B3E8B000
unkown image
page readonly
clean
400000
unkown image
page execute and read and write
clean
7FF522F13000
unkown image
page readonly
clean
7FF5881AD000
unkown image
page readonly
clean
7FF542C05000
unkown image
page readonly
clean
7FF58830E000
unkown image
page readonly
clean
4FA0000
unkown
page read and write
clean
7FF542D71000
unkown image
page readonly
clean
7DF51A532000
unkown image
page readonly
clean
1C3C3988000
unkown
page read and write
clean
7FF566158000
unkown image
page readonly
clean
7FF5B3E9E000
unkown image
page readonly
clean
1C3C39BA000
unkown
page read and write
clean
7FF5883CA000
unkown image
page readonly
clean
F4E65FE000
unkown
page read and write
clean
3860000
unkown image
page readonly
clean
1AA97413000
unkown
page read and write
clean
1C3C39BA000
unkown
page read and write
clean
1C3C3989000
unkown
page read and write
clean
7FF5B3E4D000
unkown image
page readonly
clean
161E4E6C000
unkown
page read and write
clean
52B0000
heap private
page read and write
clean
7FF5882D7000
unkown image
page readonly
clean
1AA97240000
unkown image
page readonly
clean
7FF5B3CDA000
unkown image
page readonly
clean
7FF542861000
unkown image
page readonly
clean
7FF566497000
unkown image
page readonly
clean
7FF5882ED000
unkown image
page readonly
clean
1C3C391E000
unkown
page read and write
clean
1C3C398C000
unkown
page read and write
clean
7FF587EC7000
unkown image
page readonly
clean
7FF50C3B7000
unkown image
page readonly
clean
1C3C3993000
unkown
page read and write
clean
7DF5C1BA2000
unkown image
page readonly
clean
1C3C2FA0000
unkown image
page readonly
clean
34A5000
unkown
page read and write
clean
1C3C3116000
unkown
page read and write
clean
7FF522FC1000
unkown image
page readonly
clean
7FFB0000
unkown image
page readonly
clean
7FF522FA4000
unkown image
page readonly
clean
7FF5668D3000
unkown image
page readonly
clean
1C3C3982000
unkown
page read and write
clean
1C73B630000
unkown
page read and write
clean
7FF522ED3000
unkown image
page readonly
clean
1C3C30BE000
unkown
page read and write
clean
7FF566635000
unkown image
page readonly
clean
1AA97390000
unkown
page read and write
clean
1C3C39A9000
unkown
page read and write
clean
31E287C000
unkown
page read and write
clean
7DF530C30000
unkown image
page readonly
clean
1C3C398B000
unkown
page read and write
clean
5A80000
heap private
page read and write
clean
7FF5B3F24000
unkown image
page readonly
clean
250000
unkown
page read and write
clean
7FF542867000
unkown image
page readonly
clean
1C3C39A1000
unkown
page read and write
clean
7FF542D6A000
unkown image
page readonly
clean
7FF5668BD000
unkown image
page readonly
clean
217B05A0000
unkown image
page readonly
clean
1C3C3013000
unkown
page read and write
clean
7FF542C8F000
unkown image
page readonly
clean
7FF50C7D9000
unkown image
page readonly
clean
7FF56632C000
unkown image
page readonly
clean
1C3C39AA000
unkown
page read and write
clean
7FF50C823000
unkown image
page readonly
clean
1C3C3964000
unkown
page read and write
clean
7DF5C1BB0000
unkown image
page readonly
clean
7DF530C40000
unkown image
page readonly
clean
F4E5FEE000
unkown
page read and write
clean
7FF50C8B4000
unkown image
page readonly
clean
1C3C394B000
unkown
page read and write
clean
7DF596052000
unkown image
page readonly
clean
7FF588191000
unkown image
page readonly
clean
F4E66FE000
unkown
page read and write
clean
1C73B360000
unkown
page read and write
clean
1AA9744B000
unkown
page read and write
clean
7DF5C1BC0000
unkown image
page readonly
clean
7FF522EE0000
unkown image
page readonly
clean
7FFC2000
unkown image
page readonly
clean
161E5100000
unkown image
page readonly
clean
217B0490000
unkown image
page readonly
clean
1C3C2FF0000
unkown
page read and write
clean
7FF5B3F31000
unkown image
page readonly
clean
185179A0000
unkown
page read and write
clean
7DF51A540000
unkown image
page readonly
clean
7FF56615C000
unkown image
page readonly
clean
18518202000
unkown
page read and write
clean
7FF50C8D1000
unkown image
page readonly
clean
1AA97230000
heap private
page read and write
clean
1AA97800000
unkown image
page readonly
clean
7FF5668FB000
unkown image
page readonly
clean
7FF566780000
unkown image
page readonly
clean
1C3C397F000
unkown
page read and write
clean
7FF5667C7000
unkown image
page readonly
clean
7FF542D52000
unkown image
page readonly
clean
7FF50C751000
unkown image
page readonly
clean
1C3C3580000
unkown image
page readonly
clean
1C73AAE0000
unkown
page read and write
clean
1AA9747E000
unkown
page read and write
clean
7FF542B06000
unkown image
page readonly
clean
1C3C39B4000
unkown
page read and write
clean
7FF566517000
unkown image
page readonly
clean
217B0683000
unkown
page read and write
clean
7FF542B6B000
unkown image
page readonly
clean
7FF50C8CA000
unkown image
page readonly
clean
7DF596042000
unkown image
page readonly
clean
7DF574612000
unkown image
page readonly
clean
7FF542BEC000
unkown image
page readonly
clean
1C3C398B000
unkown
page read and write
clean
1C3C39AB000
unkown
page read and write
clean
1C3C3660000
unkown image
page write copy
clean
217B0E02000
unkown
page read and write
clean
1C3C397A000
unkown
page read and write
clean
7DF550A00000
unkown image
page readonly
clean
7FF50C6DF000
unkown image
page readonly
clean
7FF542CCB000
unkown image
page readonly
clean
1C3C304F000
unkown
page read and write
clean
18517A5F000
unkown
page read and write
clean
1C3C39C7000
unkown
page read and write
clean
7FF50C8A2000
unkown image
page readonly
clean
1C3C3993000
unkown
page read and write
clean
7FF5668E7000
unkown image
page readonly
clean
1C3C398D000
unkown
page read and write
clean
7DF574620000
unkown image
page readonly
clean
7FF56677D000
unkown image
page readonly
clean
7FF566903000
unkown image
page readonly
clean
161E4E30000
heap default
page read and write
clean
F4E637C000
unkown
page read and write
clean
7FF56680B000
unkown image
page readonly
clean
7FF542C93000
unkown image
page readonly
clean
7FF566491000
unkown image
page readonly
clean
161E4E3B000
heap default
page read and write
clean
19B000
unkown
page read and write
clean
7FF5669B0000
unkown image
page readonly
clean
7FF5883B2000
unkown image
page readonly
clean
1C3C3E02000
unkown
page read and write
clean
4F61000
unkown image
page execute read
clean
7FF5B3F3A000
unkown image
page readonly
clean
1C3C3998000
unkown
page read and write
clean
7FEB0000
unkown image
page readonly
clean
7FF5B3B3B000
unkown image
page readonly
clean
7FF566769000
unkown image
page readonly
clean
7FF588307000
unkown image
page readonly
clean
1C73A6A0000
unkown image
page readonly
clean
7FF58835D000
unkown image
page readonly
clean
1C3C3E02000
unkown
page read and write
clean
7FF522F92000
unkown image
page readonly
clean
7FF5B3B00000
unkown image
page readonly
clean
178A59D000
unkown
page read and write
clean
7DF51A530000
unkown image
page readonly
clean
7FF566989000
unkown image
page readonly
clean
7FF56699A000
unkown image
page readonly
clean
1C3C3982000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
7DF550A00000
unkown image
page readonly
clean
7FF522FB5000
unkown image
page readonly
clean
1C3C39A3000
unkown
page read and write
clean
1C3C3998000
unkown
page read and write
clean
7DF5509F0000
unkown image
page readonly
clean
7FF50C555000
unkown image
page readonly
clean
1C3C3087000
unkown
page read and write
clean
7FFB2000
unkown image
page readonly
clean
7FF542D7A000
unkown image
page readonly
clean
18517A99000
unkown
page read and write
clean
1C73B300000
unkown
page read and write
clean
217B0713000
unkown
page read and write
clean
7FF50C69D000
unkown image
page readonly
clean
31E29FE000
unkown
page read and write
clean
1C3C3E02000
unkown
page read and write
clean
7FF566872000
unkown image
page readonly
clean
7FF566584000
unkown image
page readonly
clean
7FF56692A000
unkown image
page readonly
clean
18517A61000
unkown
page read and write
clean
7FF5B3F41000
unkown image
page readonly
clean
7FF5666BB000
unkown image
page readonly
clean
7FF5666F6000
unkown image
page readonly
clean
7FF50C8A9000
unkown image
page readonly
clean
1C3C3E02000
unkown
page read and write
clean
1C3C3987000
unkown
page read and write
clean
1C3C39D0000
unkown
page read and write
clean
1C3C3989000
unkown
page read and write
clean
7FF566761000
unkown image
page readonly
clean
1C3C30E9000
unkown
page read and write
clean
7FF50C82E000
unkown image
page readonly
clean
7FF542CAE000
unkown image
page readonly
clean
3495000
unkown
page read and write
clean
1C3C39AF000
unkown
page read and write
clean
217B0613000
unkown
page read and write
clean
1C3C3987000
unkown
page read and write
clean
1C3C39AF000
unkown
page read and write
clean
7FF5881CB000
unkown image
page readonly
clean
18517A13000
unkown
page read and write
clean
7DF5C1BB2000
unkown image
page readonly
clean
1C3C2E30000
unkown image
page readonly
clean
7FF542A05000
unkown image
page readonly
clean
1C3C39A1000
unkown
page read and write
clean
18517870000
unkown image
page readonly
clean
7FF5883E1000
unkown image
page readonly
clean
18517E00000
unkown image
page readonly
clean
40F000
unkown image
page execute read
clean
4F4B000
unkown
page read and write
clean
1C3C3E02000
unkown
page read and write
clean
1C3C3978000
unkown
page read and write
clean
7FF522ED6000
unkown image
page readonly
clean
7FF566765000
unkown image
page readonly
clean
7FF50C84A000
unkown image
page readonly
clean
161E4E41000
unkown
page read and write
clean
1C3C3E02000
unkown
page read and write
clean
217B0652000
unkown
page read and write
clean
7FF5B3F12000
unkown image
page readonly
clean
4E00000
unkown
page read and write
clean
7FF56682B000
unkown image
page readonly
clean
161E4F60000
unkown image
page readonly
clean
7FFD0000
unkown image
page readonly
clean
7FF5B3F2A000
unkown image
page readonly
clean
1C3C2E10000
unkown image
page read and write
clean
7DF574612000
unkown image
page readonly
clean
7FF5B37C9000
unkown image
page readonly
clean
31E2CFF000
unkown
page read and write
clean
56A8000
heap private
page read and write
clean
1AA97489000
unkown
page read and write
clean
7DF5C1BA2000
unkown image
page readonly
clean
401000
unkown image
page execute read
clean
30000
unkown image
page read and write
clean
1C73A7E0000
unkown image
page readonly
clean
1C3C3972000
unkown
page read and write
clean
3420000
heap default
page read and write
clean
7DF530C32000
unkown image
page readonly
clean
7FF52276C000
unkown image
page readonly
clean
18517A8A000
unkown
page read and write
clean
1F0000
unkown
page read and write
clean
7FF566994000
unkown image
page readonly
clean
31E277E000
unkown
page read and write
clean
1C73A680000
unkown image
page readonly
clean
7DF574610000
unkown image
page readonly
clean
7FF50C7DD000
unkown image
page readonly
clean
7FF522ECD000
unkown image
page readonly
clean
7FF5B3DAC000
unkown image
page readonly
clean
161E50F5000
heap private
page read and write
clean
7FFC2000
unkown image
page readonly
clean
1C3C3990000
unkown
page read and write
clean
4F6D000
unkown image
page read and write
clean
7DF5509F0000
unkown image
page readonly
clean
7FF50C73C000
unkown image
page readonly
clean
217B0800000
unkown image
page readonly
clean
7FF587C4C000
unkown image
page readonly
clean
34AB000
unkown
page read and write
clean
7FF5882EF000
unkown image
page readonly
clean
7FF542CF7000
unkown image
page readonly
clean
7FF59FE51000
unkown image
page readonly
clean
1AA97500000
unkown
page read and write
clean
7DF530C40000
unkown image
page readonly
clean
31E297B000
unkown
page read and write
clean
7FF522F0B000
unkown image
page readonly
clean
7FF5668D0000
unkown image
page readonly
clean
18517B13000
unkown
page read and write
clean
217B04A0000
unkown image
page readonly
clean
1C73A6B0000
unkown image
page readonly
clean
7FF5B379B000
unkown image
page readonly
clean
1C3C398D000
unkown
page read and write
clean
4D1A7C000
unkown
page read and write
clean
4D18F7000
unkown
page read and write
clean
4D17FF000
unkown
page read and write
clean
1C3C3055000
unkown
page read and write
clean
1C3C398C000
unkown
page read and write
clean
1C3C3E19000
unkown
page read and write
clean
F4E6577000
unkown
page read and write
clean
7FF522FBA000
unkown image
page readonly
clean
1C3C39B5000
unkown
page read and write
clean
1C73A863000
unkown
page read and write
clean
1C73AAC0000
unkown
page read and write
clean
7DF596050000
unkown image
page readonly
clean
7FF566982000
unkown image
page readonly
clean
4F60000
unkown image
page read and write
clean
18517850000
unkown image
page readonly
clean
7FF5B3EBD000
unkown image
page readonly
clean
7DF596040000
unkown image
page readonly
clean
7FF566861000
unkown image
page readonly
clean
7FFB2000
unkown image
page readonly
clean
7FF566835000
unkown image
page readonly
clean
1AA97449000
unkown
page read and write
clean
7FF50C8D1000
unkown image
page readonly
clean
1C3C39AB000
unkown
page read and write
clean
1C3C3E02000
unkown
page read and write
clean
7FF542C77000
unkown image
page readonly
clean
7FF5881EF000
unkown image
page readonly
clean
1C3C3E00000
unkown
page read and write
clean
7DF596050000
unkown image
page readonly
clean
5E7A000
heap private
page read and write
clean
1C73A7C0000
unkown
page read and write
clean
7FF56685F000
unkown image
page readonly
clean
1AA97429000
unkown
page read and write
clean
7FF56692D000
unkown image
page readonly
clean
161E5480000
unkown image
page readonly
clean
7FF56681C000
unkown image
page readonly
clean
1C3C39B6000
unkown
page read and write
clean
1C73A670000
unkown
page read and write
clean
8437377000
unkown
page read and write
clean
18517F80000
unkown image
page readonly
clean
1C3C39CF000
unkown
page read and write
clean
51D0000
heap private
page read and write
clean
1C3C3E1E000
unkown
page read and write
clean
217B068E000
unkown
page read and write
clean
1C73A680000
unkown image
page readonly
clean
7FF50C13C000
unkown image
page readonly
clean
4D15FB000
unkown
page read and write
clean
1C3C3987000
unkown
page read and write
clean
7FF522F99000
unkown image
page readonly
clean
1C3C39AC000
unkown
page read and write
clean
161E4D20000
unkown image
page readonly
clean
9D000
unkown
page read and write
clean
F4E68FE000
unkown
page read and write
clean
1C3C3915000
unkown
page read and write
clean
217B0700000
unkown
page read and write
clean
1C3C39C0000
unkown
page read and write
clean
1C3C3991000
unkown
page read and write
clean
7DF51A542000
unkown image
page readonly
clean
7DF530C32000
unkown image
page readonly
clean
420000
unkown image
page readonly
clean
7DF5509E0000
unkown image
page readonly
clean
7DF574630000
unkown image
page readonly
clean
1AA97600000
unkown image
page readonly
clean
1C3C3981000
unkown
page read and write
clean
7FF5B3D52000
unkown image
page readonly
clean
1AA97220000
unkown image
page read and write
clean
7FF542BD5000
unkown image
page readonly
clean
7DF5509F2000
unkown image
page readonly
clean
7FF5883E1000
unkown image
page readonly
clean
7FF58824C000
unkown image
page readonly
clean
1C3C3990000
unkown
page read and write
clean
7FF522768000
unkown image
page readonly
clean
7DF596052000
unkown image
page readonly
clean
4D111E000
unkown
page read and write
clean
7DF5C1BC0000
unkown image
page readonly
clean
7DF574622000
unkown image
page readonly
clean
1C3C3070000
unkown
page read and write
clean
217B063C000
unkown
page read and write
clean
F4E67FC000
unkown
page read and write
clean
1C3C3981000
unkown
page read and write
clean
7FF5B3E92000
unkown image
page readonly
clean
7FF542B31000
unkown image
page readonly
clean
7FF5B3EBA000
unkown image
page readonly
clean
1C3C3976000
unkown
page read and write
clean
7DF574620000
unkown image
page readonly
clean
7FF5668B9000
unkown image
page readonly
clean
7DF51A530000
unkown image
page readonly
clean
1AA97470000
unkown
page read and write
clean
7FFB0000
unkown image
page readonly
clean
4D16F7000
unkown
page read and write
clean
1AA97980000
unkown image
page readonly
clean
1AA97240000
unkown image
page readonly
clean
7FF50C8C1000
unkown image
page readonly
clean
7FF566893000
unkown image
page readonly
clean
7FF5B3E46000
unkown image
page readonly
clean
1C3C397F000
unkown
page read and write
clean
843727B000
unkown
page read and write
clean
7FF5882E9000
unkown image
page readonly
clean
1C73A910000
unkown image
page readonly
clean
7DF530C30000
unkown image
page readonly
clean
1C3C39B1000
unkown
page read and write
clean
1C3C3080000
unkown
page read and write
clean
1C3C3996000
unkown
page read and write
clean
1C3C30C5000
unkown
page read and write
clean
18517B02000
unkown
page read and write
clean
18517840000
heap private
page read and write
clean
4D14FC000
unkown
page read and write
clean
31E2AF7000
unkown
page read and write
clean
1C3C3998000
unkown
page read and write
clean
1C3C3980000
unkown
page read and write
clean
1C73B370000
unkown
page read and write
clean
161E4E61000
unkown
page read and write
clean
4E40000
heap private
page read and write
clean
1C3C3053000
unkown
page read and write
clean
7FF522D73000
unkown image
page readonly
clean
7DF51A550000
unkown image
page readonly
clean
7FF588166000
unkown image
page readonly
clean
7FF5B3F35000
unkown image
page readonly
clean
1C3C304A000
unkown
page read and write
clean
67A87F000
unkown
page read and write
clean
7DF42EAF0000
unkown image
page readonly
clean
7FF56690E000
unkown image
page readonly
clean
1C3C39C1000
unkown
page read and write
clean
1C3C2E30000
unkown image
page readonly
clean
7DF5C1BA0000
unkown image
page readonly
clean
161E4E6C000
unkown
page read and write
clean
161E4E55000
unkown
page read and write
clean
7FF50C7F7000
unkown image
page readonly
clean
7FF56631B000
unkown image
page readonly
clean
67A77E000
unkown
page read and write
clean
1C3C396D000
unkown
page read and write
clean
1C73AAD5000
heap private
page read and write
clean
1C3C3E63000
unkown
page read and write
clean
1AA97455000
unkown
page read and write
clean
1C3C2E60000
unkown image
page readonly
clean
There are 791 hidden memdumps, click here to show them.