Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Covid narrative 6.20 8.21 to bank.docx
|
Microsoft Word 2007+
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\88F4BA73-E444-42C8-A779-335BD740D924
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{8247A381-7F11-4245-93FB-912B508B9663}.tmp
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL
|
XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL
|
XML 1.0 document, UTF-8 Unicode text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL
|
XML 1.0 document, UTF-8 Unicode text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl
|
XML 1.0 document, UTF-8 Unicode text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl
|
XML 1.0 document, UTF-8 Unicode text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO1033.acl
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Covid narrative 6.20 8.21 to bank.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:27:00
2020, mtime=Fri Aug 20 12:34:07 2021, atime=Fri Aug 20 12:34:03 2021, length=13120, window=hide
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Fri Aug 20 12:34:05
2021, mtime=Fri Aug 20 12:35:09 2021, atime=Fri Aug 20 12:35:09 2021, length=0, window=hide
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
|
Little-endian UTF-16 Unicode text, with no line terminators
|
dropped
|
|
|
|
C:\Users\user\Desktop\~$vid narrative 6.20 8.21 to bank.docx
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{03EBD8D7-10B9-4A25-A35B-CDE7E003844A}.tmp
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E1A454EA-72A2-4470-89E8-B7D87A58E0E0}.tmp
|
data
|
dropped
|
|
There are 16 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.diagnosticssdf.office.com
|
unknown
|
|
|
|
https://login.microsoftonline.com/
|
unknown
|
|
|
|
https://shell.suite.office.com:1443
|
unknown
|
|
|
|
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
|
unknown
|
|
|
|
https://autodiscover-s.outlook.com/
|
unknown
|
|
|
|
https://roaming.edog.
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
|
unknown
|
|
|
|
https://cdn.entity.
|
unknown
|
|
|
|
https://api.addins.omex.office.net/appinfo/query
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/tenantassociationkey
|
unknown
|
|
|
|
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
|
unknown
|
|
|
|
https://powerlift.acompli.net
|
unknown
|
|
|
|
https://rpsticket.partnerservices.getmicrosoftkey.com
|
unknown
|
|
|
|
https://lookup.onenote.com/lookup/geolocation/v1
|
unknown
|
|
|
|
https://cortana.ai
|
unknown
|
|
|
|
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
|
|
|
https://cloudfiles.onenote.com/upload.aspx
|
unknown
|
|
|
|
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
|
|
|
https://entitlement.diagnosticssdf.office.com
|
unknown
|
|
|
|
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
|
unknown
|
|
|
|
https://api.aadrm.com/
|
unknown
|
|
|
|
https://ofcrecsvcapi-int.azurewebsites.net/
|
unknown
|
|
|
|
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
|
unknown
|
|
|
|
https://api.microsoftstream.com/api/
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
|
unknown
|
|
|
|
https://cr.office.com
|
unknown
|
|
|
|
https://portal.office.com/account/?ref=ClientMeControl
|
unknown
|
|
|
|
https://graph.ppe.windows.net
|
unknown
|
|
|
|
https://res.getmicrosoftkey.com/api/redemptionevents
|
unknown
|
|
|
|
https://powerlift-frontdesk.acompli.net
|
unknown
|
|
|
|
https://tasks.office.com
|
unknown
|
|
|
|
https://officeci.azurewebsites.net/api/
|
unknown
|
|
|
|
https://sr.outlook.office.net/ws/speech/recognize/assistant/work
|
unknown
|
|
|
|
https://store.office.cn/addinstemplate
|
unknown
|
|
|
|
https://outlook.office.com/autosuggest/api/v1/init?cvid=
|
unknown
|
|
|
|
https://globaldisco.crm.dynamics.com
|
unknown
|
|
|
|
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
|
|
|
https://store.officeppe.com/addinstemplate
|
unknown
|
|
|
|
https://dev0-api.acompli.net/autodetect
|
unknown
|
|
|
|
https://www.odwebp.svc.ms
|
unknown
|
|
|
|
https://api.powerbi.com/v1.0/myorg/groups
|
unknown
|
|
|
|
https://web.microsoftstream.com/video/
|
unknown
|
|
|
|
https://graph.windows.net
|
unknown
|
|
|
|
https://dataservice.o365filtering.com/
|
unknown
|
|
|
|
https://officesetup.getmicrosoftkey.com
|
unknown
|
|
|
|
https://analysis.windows.net/powerbi/api
|
unknown
|
|
|
|
https://prod-global-autodetect.acompli.net/autodetect
|
unknown
|
|
|
|
https://outlook.office365.com/autodiscover/autodiscover.json
|
unknown
|
|
|
|
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
|
unknown
|
|
|
|
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
|
|
|
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
|
unknown
|
|
|
|
https://ncus.contentsync.
|
unknown
|
|
|
|
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
|
unknown
|
|
|
|
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
|
unknown
|
|
|
|
http://weather.service.msn.com/data.aspx
|
unknown
|
|
|
|
https://apis.live.net/v5.0/
|
unknown
|
|
|
|
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
|
unknown
|
|
|
|
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
|
unknown
|
|
|
|
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
|
unknown
|
|
|
|
https://management.azure.com
|
unknown
|
|
|
|
https://wus2.contentsync.
|
unknown
|
|
|
|
https://incidents.diagnostics.office.com
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/ios
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/odc/insertmedia
|
unknown
|
|
|
|
https://o365auditrealtimeingestion.manage.office.com
|
unknown
|
|
|
|
https://outlook.office365.com/api/v1.0/me/Activities
|
unknown
|
|
|
|
https://api.office.net
|
unknown
|
|
|
|
https://incidents.diagnosticssdf.office.com
|
unknown
|
|
|
|
https://asgsmsproxyapi.azurewebsites.net/
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/android/policies
|
unknown
|
|
|
|
https://entitlement.diagnostics.office.com
|
unknown
|
|
|
|
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
|
unknown
|
|
|
|
https://substrate.office.com/search/api/v2/init
|
unknown
|
|
|
|
https://outlook.office.com/
|
unknown
|
|
|
|
https://storage.live.com/clientlogs/uploadlocation
|
unknown
|
|
|
|
https://outlook.office365.com/
|
unknown
|
|
|
|
https://webshell.suite.office.com
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
|
unknown
|
|
|
|
https://substrate.office.com/search/api/v1/SearchHistory
|
unknown
|
|
|
|
https://management.azure.com/
|
unknown
|
|
|
|
https://login.windows.net/common/oauth2/authorize
|
unknown
|
|
|
|
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
|
|
|
https://graph.windows.net/
|
unknown
|
|
|
|
https://api.powerbi.com/beta/myorg/imports
|
unknown
|
|
|
|
https://devnull.onenote.com
|
unknown
|
|
|
|
https://ncus.pagecontentsync.
|
unknown
|
|
|
|
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
|
unknown
|
|
|
|
https://messaging.office.com/
|
unknown
|
|
|
|
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
|
|
|
https://augloop.office.com/v2
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
|
unknown
|
|
|
|
https://skyapi.live.net/Activity/
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/mac
|
unknown
|
|
|
|
https://dataservice.o365filtering.com
|
unknown
|
|
|
|
https://api.cortana.ai
|
unknown
|
|
|
|
https://onedrive.live.com
|
unknown
|
|
|
|
https://ovisualuiapp.azurewebsites.net/pbiagave/
|
unknown
|
|
|
|
https://visio.uservoice.com/forums/368202-visio-on-devices
|
unknown
|
|
|
|
https://directory.services.
|
unknown
|
|
|
|
https://login.windows-ppe.net/common/oauth2/authorize
|
unknown
|
|
There are 90 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
{$9
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
|$9
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
PageSize
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Template
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
FirstRunOnRTM
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
RemoteClearDate
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Last
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
FilePath
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
StartDate
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
EndDate
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Properties
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Url
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
LastClean
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
DisableWinHttpCertAuth
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
DisableIsOwnerRegex
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
DisableSessionAwareHttpClose
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
DisableADALForExtendedApps
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
DisableADALSetSilentAuth
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
msoridDisableGuestCredProvider
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
msoridDisableOstringReplace
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
LastBootTime
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
1+9
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
ReviewToken
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
27CF7
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
VBAFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
MSForms
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
MSComctlLib
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Options Version
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Name
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Data
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Name
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Data
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Name
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Path
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Extensions
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Cambria Math
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Calibri
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
2EF97
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
File Path
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Datetime
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Position
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Toolbars
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Microsoft Word
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Times New Roman
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Calibri Light
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Wingdings
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
DefaultFormat
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Settings
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
VisiFlm
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
VisiForceField
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
IgnoreFilenamesEmailAliases
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
AutoSpell
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
NoContextSpell
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
AutosaveInterval
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
InsPic
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SoundFeedback
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
PreferredView
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
BkgrndPag
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
ATUserAdded
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
AccentOnUpper
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
AppWindowPos
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
en-US
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
en-US
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
WORDFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
LastBootTime
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
RoamingConfigurableSettings
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
RoamingLastSyncTime
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
RoamingLastWriteTime
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Name
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Path
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Extensions
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Name
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Path
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Extensions
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
2EF97
|
|
|
|
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
|
Datetime
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
rq9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MTTT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
zr9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
rt9
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
ReviewToken
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
EC14C
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
VBAFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Arial Unicode MS
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Batang
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@BatangChe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@DFKai-SB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Dotum
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@DotumChe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@FangSong
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Gulim
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@GulimChe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Gungsuh
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@GungsuhChe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@KaiTi
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Malgun Gothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Meiryo
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Meiryo UI
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Microsoft JhengHei
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@Microsoft YaHei
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@MingLiU
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@MingLiU_HKSCS
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@MingLiU_HKSCS-ExtB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@MingLiU-ExtB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@MS Gothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@MS Mincho
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@MS PGothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@MS PMincho
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@MS UI Gothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@NSimSun
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@PMingLiU
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@PMingLiU-ExtB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@SimHei
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@SimSun
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
@SimSun-ExtB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Agency FB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Aharoni
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Algerian
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Andalus
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Angsana New
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
AngsanaUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Aparajita
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Arabic Typesetting
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Arial
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Arial Black
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Arial Narrow
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Arial Rounded MT Bold
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Arial Unicode MS
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Baskerville Old Face
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Batang
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
BatangChe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bauhaus 93
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bell MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Berlin Sans FB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Berlin Sans FB Demi
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bernard MT Condensed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Blackadder ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bodoni MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bodoni MT Black
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bodoni MT Condensed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bodoni MT Poster Compressed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Book Antiqua
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bookman Old Style
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bookshelf Symbol 7
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Bradley Hand ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Britannic Bold
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Broadway
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Browallia New
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
BrowalliaUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Brush Script MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Calibri
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Calibri Light
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Californian FB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Calisto MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Cambria
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Cambria Math
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Candara
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Castellar
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Centaur
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Century
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Century Gothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Century Schoolbook
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Chiller
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Colonna MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Comic Sans MS
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Consolas
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Constantia
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Cooper Black
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Copperplate Gothic Bold
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Copperplate Gothic Light
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Corbel
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Cordia New
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
CordiaUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Courier New
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Curlz MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
DaunPenh
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
David
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
DFKai-SB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
DilleniaUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
DokChampa
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Dotum
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
DotumChe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Ebrima
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Edwardian Script ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Elephant
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Engravers MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Eras Bold ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Eras Demi ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Eras Light ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Eras Medium ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Estrangelo Edessa
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
EucrosiaUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Euphemia
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
FangSong
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Felix Titling
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Footlight MT Light
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Forte
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Franklin Gothic Book
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Franklin Gothic Demi
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Franklin Gothic Demi Cond
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Franklin Gothic Heavy
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Franklin Gothic Medium
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Franklin Gothic Medium Cond
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
FrankRuehl
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
FreesiaUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Freestyle Script
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
French Script MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gabriola
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Garamond
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gautami
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Georgia
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gigi
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gill Sans MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gill Sans MT Condensed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gill Sans MT Ext Condensed Bold
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gill Sans Ultra Bold
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gill Sans Ultra Bold Condensed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gisha
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gloucester MT Extra Condensed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Goudy Old Style
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Goudy Stout
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gulim
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
GulimChe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Gungsuh
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
GungsuhChe
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Haettenschweiler
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Harlow Solid Italic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Harrington
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
High Tower Text
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Impact
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Imprint MT Shadow
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Informal Roman
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
IrisUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Iskoola Pota
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
JasmineUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Jokerman
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Juice ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
KaiTi
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Kalinga
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Kartika
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Khmer UI
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
KodchiangUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Kokila
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Kristen ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Kunstler Script
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Lao UI
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Latha
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Leelawadee
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Levenim MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
LilyUPC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Lucida Bright
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Lucida Calligraphy
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Lucida Console
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Lucida Fax
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Lucida Handwriting
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Lucida Sans
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Lucida Sans Typewriter
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Lucida Sans Unicode
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Magneto
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Maiandra GD
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Malgun Gothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Mangal
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Marlett
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Matura MT Script Capitals
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Meiryo
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Meiryo UI
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Microsoft Himalaya
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Microsoft JhengHei
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Microsoft New Tai Lue
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Microsoft PhagsPa
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Microsoft Sans Serif
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Microsoft Tai Le
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Microsoft Uighur
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Microsoft YaHei
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Microsoft Yi Baiti
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MingLiU
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MingLiU_HKSCS
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MingLiU_HKSCS-ExtB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MingLiU-ExtB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Miriam
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Miriam Fixed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Mistral
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Modern No. 20
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Mongolian Baiti
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Monotype Corsiva
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MoolBoran
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MS Gothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MS Mincho
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MS Outlook
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MS PGothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MS PMincho
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MS Reference Sans Serif
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MS Reference Specialty
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MS UI Gothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MT Extra
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MV Boli
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Narkisim
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Niagara Engraved
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Niagara Solid
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
NSimSun
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Nyala
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
OCR A Extended
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Old English Text MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Onyx
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Palace Script MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Palatino Linotype
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Papyrus
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Parchment
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Perpetua
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Perpetua Titling MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Plantagenet Cherokee
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Playbill
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
PMingLiU
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
PMingLiU-ExtB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Poor Richard
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Pristina
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Raavi
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Rage Italic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Ravie
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Rockwell
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Rockwell Condensed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Rockwell Extra Bold
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Rod
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Sakkal Majalla
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Script MT Bold
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Segoe Print
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Segoe Script
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Segoe UI
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Segoe UI Light
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Segoe UI Semibold
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Segoe UI Symbol
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Shonar Bangla
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Showcard Gothic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Shruti
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SimHei
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Simplified Arabic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Simplified Arabic Fixed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SimSun
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SimSun-ExtB
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Snap ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Stencil
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Sylfaen
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Symbol
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Tahoma
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Tempus Sans ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Times New Roman
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Traditional Arabic
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Trebuchet MS
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Tunga
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Tw Cen MT
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Tw Cen MT Condensed
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Tw Cen MT Condensed Extra Bold
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Utsaah
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Vani
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Verdana
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Vijaya
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Viner Hand ITC
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Vivaldi
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Vladimir Script
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Vrinda
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Webdings
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Wide Latin
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Wingdings
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Wingdings 2
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Wingdings 3
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
F3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
LastPurgeTime
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
WORDFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1036
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
SpellingAndGrammarFiles_1033
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
F3082
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
Settings
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
ZoomApp
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
ProductFiles
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MTTF
|
|
|
|
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
|
MTTA
|
|
There are 408 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7FF5A3ADD000
|
unkown
|
page readonly
|
|
|
|
7FF559E5F000
|
unkown
|
page readonly
|
|
|
|
26AC1D40000
|
unkown
|
page readonly
|
|
|
|
7FF4F68B4000
|
unkown
|
page readonly
|
|
|
|
7FF55A163000
|
unkown
|
page readonly
|
|
|
|
1CCCED90000
|
unkown
|
page readonly
|
|
|
|
2AE84A02000
|
unkown
|
page read and write
|
|
|
|
2AE84555000
|
unkown
|
page read and write
|
|
|
|
C2DE177000
|
unkown
|
page read and write
|
|
|
|
2AE845B6000
|
unkown
|
page read and write
|
|
|
|
7FF5E46F3000
|
unkown
|
page readonly
|
|
|
|
7FF5C11D4000
|
unkown
|
page readonly
|
|
|
|
2AE845A3000
|
unkown
|
page read and write
|
|
|
|
2AE845A9000
|
unkown
|
page read and write
|
|
|
|
7FF55A3A5000
|
unkown
|
page readonly
|
|
|
|
7FF55A363000
|
unkown
|
page readonly
|
|
|
|
1E182C30000
|
unkown
|
page readonly
|
|
|
|
2AE84960000
|
unkown
|
page read and write
|
|
|
|
7FF5A3671000
|
unkown
|
page readonly
|
|
|
|
527BB7A000
|
unkown
|
page read and write
|
|
|
|
26AC6180000
|
unkown
|
page read and write
|
|
|
|
26AC1415000
|
unkown
|
page read and write
|
|
|
|
2AE8459F000
|
unkown
|
page read and write
|
|
|
|
7FF598CF6000
|
unkown
|
page readonly
|
|
|
|
26AC0E9F000
|
unkown
|
page read and write
|
|
|
|
7FF5C1517000
|
unkown
|
page readonly
|
|
|
|
1CCCEA0A000
|
unkown
|
page read and write
|
|
|
|
1EF49B40000
|
unkown
|
page readonly
|
|
|
|
7FF55A6A7000
|
unkown
|
page readonly
|
|
|
|
1EF4A600000
|
unkown
|
page readonly
|
|
|
|
15B14A70000
|
unkown
|
page read and write
|
|
|
|
7FF598E26000
|
unkown
|
page readonly
|
|
|
|
7FF55A5F3000
|
unkown
|
page readonly
|
|
|
|
7FF5A3987000
|
unkown
|
page readonly
|
|
|
|
7CE377E000
|
unkown
|
page read and write
|
|
|
|
7FF5C1512000
|
unkown
|
page readonly
|
|
|
|
7FF4F65D5000
|
unkown
|
page readonly
|
|
|
|
26AC0DF0000
|
unkown
|
page read and write
|
|
|
|
2AE84535000
|
unkown
|
page read and write
|
|
|
|
7FF4F68B7000
|
unkown
|
page readonly
|
|
|
|
2AE83BA0000
|
heap private
|
page read and write
|
|
|
|
CEA4BAE000
|
unkown
|
page read and write
|
|
|
|
CEA4F77000
|
unkown
|
page read and write
|
|
|
|
15B14D70000
|
unkown
|
page readonly
|
|
|
|
26AC628E000
|
unkown
|
page read and write
|
|
|
|
15B14DA5000
|
heap private
|
page read and write
|
|
|
|
527BA7B000
|
unkown
|
page read and write
|
|
|
|
7FF5A39D0000
|
unkown
|
page readonly
|
|
|
|
7FF5C141F000
|
unkown
|
page readonly
|
|
|
|
7FF5C1306000
|
unkown
|
page readonly
|
|
|
|
7FF4F66D7000
|
unkown
|
page readonly
|
|
|
|
7FF55A3B5000
|
unkown
|
page readonly
|
|
|
|
7FF5989B7000
|
unkown
|
page readonly
|
|
|
|
7FF50D271000
|
unkown
|
page readonly
|
|
|
|
C2DE078000
|
unkown
|
page read and write
|
|
|
|
7FF559F79000
|
unkown
|
page readonly
|
|
|
|
7FF55A48D000
|
unkown
|
page readonly
|
|
|
|
2AE83EA6000
|
unkown
|
page read and write
|
|
|
|
7FF55A639000
|
unkown
|
page readonly
|
|
|
|
7FF4F6785000
|
unkown
|
page readonly
|
|
|
|
A1F5C7F000
|
unkown
|
page read and write
|
|
|
|
2AE84A55000
|
unkown
|
page read and write
|
|
|
|
7FF55A5EF000
|
unkown
|
page readonly
|
|
|
|
15B14B8F000
|
unkown
|
page read and write
|
|
|
|
7FF55A565000
|
unkown
|
page readonly
|
|
|
|
7FF598E32000
|
unkown
|
page readonly
|
|
|
|
26AC63E0000
|
unkown
|
page read and write
|
|
|
|
2AE83EE3000
|
unkown
|
page read and write
|
|
|
|
2AE84565000
|
unkown
|
page read and write
|
|
|
|
26AC6390000
|
unkown
|
page read and write
|
|
|
|
7FF55A691000
|
unkown
|
page readonly
|
|
|
|
7FF4F67E4000
|
unkown
|
page readonly
|
|
|
|
7FF55A5C4000
|
unkown
|
page readonly
|
|
|
|
1EF49A60000
|
heap default
|
page read and write
|
|
|
|
7FF5C12E7000
|
unkown
|
page readonly
|
|
|
|
7FF4F68C7000
|
unkown
|
page readonly
|
|
|
|
2666C47A000
|
unkown
|
page read and write
|
|
|
|
2AE84513000
|
unkown
|
page read and write
|
|
|
|
26AC63A0000
|
unkown
|
page read and write
|
|
|
|
7FF4F65DF000
|
unkown
|
page readonly
|
|
|
|
1EF4A402000
|
unkown
|
page read and write
|
|
|
|
2AE845A3000
|
unkown
|
page read and write
|
|
|
|
1E182F13000
|
unkown
|
page read and write
|
|
|
|
1CCCE9FF000
|
heap default
|
page read and write
|
|
|
|
26AC0EFC000
|
unkown
|
page read and write
|
|
|
|
7FF598BC4000
|
unkown
|
page readonly
|
|
|
|
7FF4F216B000
|
unkown
|
page readonly
|
|
|
|
7FF5C12D7000
|
unkown
|
page readonly
|
|
|
|
7FF4F680F000
|
unkown
|
page readonly
|
|
|
|
7FF4F65BA000
|
unkown
|
page readonly
|
|
|
|
1EF49C70000
|
unkown
|
page read and write
|
|
|
|
527BC77000
|
unkown
|
page read and write
|
|
|
|
7FF598EF6000
|
unkown
|
page readonly
|
|
|
|
26AC1D50000
|
unkown
|
page readonly
|
|
|
|
2AE8459B000
|
unkown
|
page read and write
|
|
|
|
2666C483000
|
unkown
|
page read and write
|
|
|
|
2AE83EBD000
|
unkown
|
page read and write
|
|
|
|
7FF55A197000
|
unkown
|
page readonly
|
|
|
|
26AC13F3000
|
unkown
|
page read and write
|
|
|
|
7FF5C1358000
|
unkown
|
page readonly
|
|
|
|
1EF49B60000
|
unkown
|
page read and write
|
|
|
|
7FF4F6432000
|
unkown
|
page readonly
|
|
|
|
1E182E2A000
|
unkown
|
page read and write
|
|
|
|
26AC1513000
|
unkown
|
page read and write
|
|
|
|
2AE845A8000
|
unkown
|
page read and write
|
|
|
|
15B14DA0000
|
heap private
|
page read and write
|
|
|
|
7FF55A5D4000
|
unkown
|
page readonly
|
|
|
|
2AE845A9000
|
unkown
|
page read and write
|
|
|
|
1E182F08000
|
unkown
|
page read and write
|
|
|
|
2AE84592000
|
unkown
|
page read and write
|
|
|
|
26AC0E00000
|
unkown
|
page read and write
|
|
|
|
7FF5A3B0D000
|
unkown
|
page readonly
|
|
|
|
2AE83E82000
|
unkown
|
page read and write
|
|
|
|
7FF5C1181000
|
unkown
|
page readonly
|
|
|
|
26AC62A1000
|
unkown
|
page read and write
|
|
|
|
CEA5C7B000
|
unkown
|
page read and write
|
|
|
|
7FF50D219000
|
unkown
|
page readonly
|
|
|
|
4F60EFB000
|
unkown
|
page read and write
|
|
|
|
7FF598E57000
|
unkown
|
page readonly
|
|
|
|
26AC6280000
|
unkown
|
page read and write
|
|
|
|
26AC6620000
|
unkown
|
page readonly
|
|
|
|
7FF598D18000
|
unkown
|
page readonly
|
|
|
|
26AC0EAD000
|
unkown
|
page read and write
|
|
|
|
2AE84594000
|
unkown
|
page read and write
|
|
|
|
7FF598E01000
|
unkown
|
page readonly
|
|
|
|
7FF598EC4000
|
unkown
|
page readonly
|
|
|
|
7FF50CA4E000
|
unkown
|
page readonly
|
|
|
|
A1F53CC000
|
unkown
|
page read and write
|
|
|
|
26AC6387000
|
unkown
|
page write copy
|
|
|
|
2AE84594000
|
unkown
|
page read and write
|
|
|
|
2AE83CE0000
|
unkown
|
page readonly
|
|
|
|
2AE84535000
|
unkown
|
page read and write
|
|
|
|
4F60E7E000
|
unkown
|
page read and write
|
|
|
|
26AC0F02000
|
unkown
|
page read and write
|
|
|
|
2666C3D0000
|
unkown
|
page read and write
|
|
|
|
2AE84592000
|
unkown
|
page read and write
|
|
|
|
1EF49C29000
|
unkown
|
page read and write
|
|
|
|
1EF49D00000
|
unkown
|
page read and write
|
|
|
|
7FF50D101000
|
unkown
|
page readonly
|
|
|
|
7FF4F664B000
|
unkown
|
page readonly
|
|
|
|
26AC20E0000
|
unkown
|
page read and write
|
|
|
|
7FF50D0F1000
|
unkown
|
page readonly
|
|
|
|
7FF5C142D000
|
unkown
|
page readonly
|
|
|
|
7FF50D0D8000
|
unkown
|
page readonly
|
|
|
|
7FF4F6902000
|
unkown
|
page readonly
|
|
|
|
7FF4F658A000
|
unkown
|
page readonly
|
|
|
|
7FF4F68F3000
|
unkown
|
page readonly
|
|
|
|
26AC60E0000
|
unkown
|
page read and write
|
|
|
|
7CE337B000
|
unkown
|
page read and write
|
|
|
|
7FF4F65AD000
|
unkown
|
page readonly
|
|
|
|
7FF5A3B74000
|
unkown
|
page readonly
|
|
|
|
2666CE00000
|
unkown
|
page readonly
|
|
|
|
7FF5A3B77000
|
unkown
|
page readonly
|
|
|
|
1CCCE9E7000
|
heap default
|
page read and write
|
|
|
|
7FF4F60C9000
|
unkown
|
page readonly
|
|
|
|
C2DE27F000
|
unkown
|
page read and write
|
|
|
|
7FF55A5C0000
|
unkown
|
page readonly
|
|
|
|
2666C429000
|
unkown
|
page read and write
|
|
|
|
26AC0BC0000
|
heap private
|
page read and write
|
|
|
|
7FF5E46F5000
|
unkown
|
page readonly
|
|
|
|
7FF5C1436000
|
unkown
|
page readonly
|
|
|
|
2AE84535000
|
unkown
|
page read and write
|
|
|
|
2AE84564000
|
unkown
|
page read and write
|
|
|
|
7FF50D04C000
|
unkown
|
page readonly
|
|
|
|
7FF598EB7000
|
unkown
|
page readonly
|
|
|
|
7FF5A3831000
|
unkown
|
page readonly
|
|
|
|
7FF5C1411000
|
unkown
|
page readonly
|
|
|
|
7FF598EDA000
|
unkown
|
page readonly
|
|
|
|
26AC6350000
|
unkown
|
page read and write
|
|
|
|
7FF4F67C8000
|
unkown
|
page readonly
|
|
|
|
1EF49C00000
|
unkown
|
page read and write
|
|
|
|
7FF4F663E000
|
unkown
|
page readonly
|
|
|
|
2AE83E4F000
|
unkown
|
page read and write
|
|
|
|
26AC1402000
|
unkown
|
page read and write
|
|
|
|
7FF5E47E7000
|
unkown
|
page readonly
|
|
|
|
1E182E8A000
|
unkown
|
page read and write
|
|
|
|
7FF5C140F000
|
unkown
|
page readonly
|
|
|
|
7FF55A242000
|
unkown
|
page readonly
|
|
|
|
7FF4F62BA000
|
unkown
|
page readonly
|
|
|
|
7FF5E4739000
|
unkown
|
page readonly
|
|
|
|
7FF5C1325000
|
unkown
|
page readonly
|
|
|
|
2666C478000
|
unkown
|
page read and write
|
|
|
|
1EF49D02000
|
unkown
|
page read and write
|
|
|
|
CEA517D000
|
unkown
|
page read and write
|
|
|
|
2AE84594000
|
unkown
|
page read and write
|
|
|
|
15B14AA0000
|
unkown
|
page readonly
|
|
|
|
7FF55A60A000
|
unkown
|
page readonly
|
|
|
|
26AC6354000
|
unkown
|
page readonly
|
|
|
|
2AE83C10000
|
unkown
|
page readonly
|
|
|
|
2AE83EA7000
|
unkown
|
page read and write
|
|
|
|
7FF598D10000
|
unkown
|
page readonly
|
|
|
|
7FF5A3ABF000
|
unkown
|
page readonly
|
|
|
|
2AE84960000
|
unkown
|
page read and write
|
|
|
|
26AC648B000
|
unkown
|
page read and write
|
|
|
|
7FF5A395A000
|
unkown
|
page readonly
|
|
|
|
7FF5C14C7000
|
unkown
|
page readonly
|
|
|
|
2AE83F08000
|
unkown
|
page read and write
|
|
|
|
7FF5A3B19000
|
unkown
|
page readonly
|
|
|
|
A1F5B7E000
|
unkown
|
page read and write
|
|
|
|
2AE83E4B000
|
unkown
|
page read and write
|
|
|
|
7FF55A4F0000
|
unkown
|
page readonly
|
|
|
|
2AE83EF0000
|
unkown
|
page read and write
|
|
|
|
2AE845B5000
|
unkown
|
page read and write
|
|
|
|
527B8FE000
|
unkown
|
page read and write
|
|
|
|
2AE83EED000
|
unkown
|
page read and write
|
|
|
|
2AE83C00000
|
heap default
|
page read and write
|
|
|
|
7FF55A6E7000
|
unkown
|
page readonly
|
|
|
|
2AE845D5000
|
unkown
|
page read and write
|
|
|
|
CEA4B2C000
|
unkown
|
page read and write
|
|
|
|
2AE83E00000
|
unkown
|
page read and write
|
|
|
|
26AC1C60000
|
unkown
|
page read and write
|
|
|
|
26AC64A2000
|
unkown
|
page read and write
|
|
|
|
15B14A90000
|
unkown
|
page readonly
|
|
|
|
1E182E4A000
|
unkown
|
page read and write
|
|
|
|
7FF50D274000
|
unkown
|
page readonly
|
|
|
|
26AC64B2000
|
unkown
|
page read and write
|
|
|
|
26AC13F0000
|
unkown
|
page read and write
|
|
|
|
2AE84594000
|
unkown
|
page read and write
|
|
|
|
7FF50D2B6000
|
unkown
|
page readonly
|
|
|
|
26AC0E8D000
|
unkown
|
page read and write
|
|
|
|
CEA547F000
|
unkown
|
page read and write
|
|
|
|
7FF5E4706000
|
unkown
|
page readonly
|
|
|
|
7FF4F68DA000
|
unkown
|
page readonly
|
|
|
|
7FF4F6604000
|
unkown
|
page readonly
|
|
|
|
26AC64AD000
|
unkown
|
page read and write
|
|
|
|
1E183402000
|
unkown
|
page read and write
|
|
|
|
26AC6288000
|
unkown
|
page read and write
|
|
|
|
7FF5E4797000
|
unkown
|
page readonly
|
|
|
|
26AC1D70000
|
unkown
|
page readonly
|
|
|
|
A1F56FD000
|
unkown
|
page read and write
|
|
|
|
2AE84B00000
|
unkown
|
page read and write
|
|
|
|
CEA53FE000
|
unkown
|
page read and write
|
|
|
|
7FF55A6E2000
|
unkown
|
page readonly
|
|
|
|
7FF4F681D000
|
unkown
|
page readonly
|
|
|
|
7FF5E47D3000
|
unkown
|
page readonly
|
|
|
|
26AC0E7A000
|
unkown
|
page read and write
|
|
|
|
2AE84A63000
|
unkown
|
page read and write
|
|
|
|
26AC0E56000
|
unkown
|
page read and write
|
|
|
|
A1F58FB000
|
unkown
|
page read and write
|
|
|
|
7FF4F6489000
|
unkown
|
page readonly
|
|
|
|
2AE84575000
|
unkown
|
page read and write
|
|
|
|
4F609CB000
|
unkown
|
page read and write
|
|
|
|
7FF5E4726000
|
unkown
|
page readonly
|
|
|
|
7FF4F6606000
|
unkown
|
page readonly
|
|
|
|
2AE84A02000
|
unkown
|
page read and write
|
|
|
|
7FF4F669A000
|
unkown
|
page readonly
|
|
|
|
A1F597F000
|
unkown
|
page read and write
|
|
|
|
7FF559EB9000
|
unkown
|
page readonly
|
|
|
|
2AE84554000
|
unkown
|
page read and write
|
|
|
|
7FF5A3AC1000
|
unkown
|
page readonly
|
|
|
|
7FF55A528000
|
unkown
|
page readonly
|
|
|
|
1EF49C51000
|
unkown
|
page read and write
|
|
|
|
2AE84960000
|
unkown
|
page read and write
|
|
|
|
527B87B000
|
unkown
|
page read and write
|
|
|
|
26AC0E13000
|
unkown
|
page read and write
|
|
|
|
7FF5C14C1000
|
unkown
|
page readonly
|
|
|
|
7FF4F684D000
|
unkown
|
page readonly
|
|
|
|
7CE357D000
|
unkown
|
page read and write
|
|
|
|
2666C43C000
|
unkown
|
page read and write
|
|
|
|
2AE84564000
|
unkown
|
page read and write
|
|
|
|
7FF55A606000
|
unkown
|
page readonly
|
|
|
|
7FF5A3AE6000
|
unkown
|
page readonly
|
|
|
|
7FF55A595000
|
unkown
|
page readonly
|
|
|
|
2AE843B0000
|
unkown
|
page write copy
|
|
|
|
26AC6350000
|
unkown
|
page write copy
|
|
|
|
7FF55A3F0000
|
unkown
|
page readonly
|
|
|
|
26AC1B80000
|
unkown
|
page read and write
|
|
|
|
2AE84575000
|
unkown
|
page read and write
|
|
|
|
7FF4F6617000
|
unkown
|
page readonly
|
|
|
|
26AC63E0000
|
unkown
|
page read and write
|
|
|
|
2AE845A0000
|
unkown
|
page read and write
|
|
|
|
26AC62B0000
|
unkown
|
page read and write
|
|
|
|
2AE845A2000
|
unkown
|
page read and write
|
|
|
|
2AE83E13000
|
unkown
|
page read and write
|
|
|
|
7FF5A3B17000
|
unkown
|
page readonly
|
|
|
|
7FF5C1503000
|
unkown
|
page readonly
|
|
|
|
2AE8452C000
|
unkown
|
page read and write
|
|
|
|
7FF4F67B5000
|
unkown
|
page readonly
|
|
|
|
7FF5C1467000
|
unkown
|
page readonly
|
|
|
|
2666C2E0000
|
unkown
|
page readonly
|
|
|
|
7FF5E4737000
|
unkown
|
page readonly
|
|
|
|
2AE845A3000
|
unkown
|
page read and write
|
|
|
|
7FF50CA40000
|
unkown
|
page readonly
|
|
|
|
7FF598F02000
|
unkown
|
page readonly
|
|
|
|
C2DDBBF000
|
unkown
|
page read and write
|
|
|
|
26AC6489000
|
unkown
|
page read and write
|
|
|
|
26AC0E70000
|
unkown
|
page read and write
|
|
|
|
1CCCEA0E000
|
unkown
|
page read and write
|
|
|
|
26AC0F13000
|
unkown
|
page read and write
|
|
|
|
15B14B40000
|
heap default
|
page read and write
|
|
|
|
7FF5A3BC2000
|
unkown
|
page readonly
|
|
|
|
CEA5B7F000
|
unkown
|
page read and write
|
|
|
|
7FF50D287000
|
unkown
|
page readonly
|
|
|
|
26AC62A4000
|
unkown
|
page read and write
|
|
|
|
26AC66E0000
|
unkown
|
page readonly
|
|
|
|
26AC64B2000
|
unkown
|
page read and write
|
|
|
|
15B14B77000
|
heap default
|
page read and write
|
|
|
|
1EF49B50000
|
unkown
|
page readonly
|
|
|
|
7FF4F65F2000
|
unkown
|
page readonly
|
|
|
|
15B14D60000
|
unkown
|
page read and write
|
|
|
|
7FF4F6771000
|
unkown
|
page readonly
|
|
|
|
7FF5A3AEA000
|
unkown
|
page readonly
|
|
|
|
26AC62B0000
|
unkown
|
page read and write
|
|
|
|
7FF5A3B06000
|
unkown
|
page readonly
|
|
|
|
2AE84554000
|
unkown
|
page read and write
|
|
|
|
26AC1390000
|
unkown
|
page read and write
|
|
|
|
7FF4F67F4000
|
unkown
|
page readonly
|
|
|
|
15B14B8F000
|
unkown
|
page read and write
|
|
|
|
2666C451000
|
unkown
|
page read and write
|
|
|
|
2AE8459F000
|
unkown
|
page read and write
|
|
|
|
7FF50D29A000
|
unkown
|
page readonly
|
|
|
|
7FF4F647C000
|
unkown
|
page readonly
|
|
|
|
7FF4F65C8000
|
unkown
|
page readonly
|
|
|
|
7FF5C1328000
|
unkown
|
page readonly
|
|
|
|
7FF55A5FD000
|
unkown
|
page readonly
|
|
|
|
7FF5A3B8B000
|
unkown
|
page readonly
|
|
|
|
7FF55A697000
|
unkown
|
page readonly
|
|
|
|
2AE83E4C000
|
unkown
|
page read and write
|
|
|
|
7FF50CA49000
|
unkown
|
page readonly
|
|
|
|
26AC62C0000
|
unkown
|
page read and write
|
|
|
|
15B158A0000
|
unkown
|
page read and write
|
|
|
|
2AE83F13000
|
unkown
|
page read and write
|
|
|
|
7FF55A69D000
|
unkown
|
page readonly
|
|
|
|
7FF50D1BF000
|
unkown
|
page readonly
|
|
|
|
2666C500000
|
unkown
|
page read and write
|
|
|
|
2AE84950000
|
unkown
|
page readonly
|
|
|
|
2AE84A02000
|
unkown
|
page read and write
|
|
|
|
1EF49A70000
|
unkown
|
page readonly
|
|
|
|
7FF55A444000
|
unkown
|
page readonly
|
|
|
|
26AC6377000
|
unkown
|
page readonly
|
|
|
|
A1F5A77000
|
unkown
|
page read and write
|
|
|
|
1E182E4E000
|
unkown
|
page read and write
|
|
|
|
1E182DF0000
|
unkown
|
page read and write
|
|
|
|
1CCCEAD0000
|
unkown
|
page readonly
|
|
|
|
7FF50D20D000
|
unkown
|
page readonly
|
|
|
|
7FF55A612000
|
unkown
|
page readonly
|
|
|
|
2AE84554000
|
unkown
|
page read and write
|
|
|
|
1E182C20000
|
heap default
|
page read and write
|
|
|
|
2AE845A3000
|
unkown
|
page read and write
|
|
|
|
7FF5A3BB3000
|
unkown
|
page readonly
|
|
|
|
CEA527F000
|
unkown
|
page read and write
|
|
|
|
7FF5E47BA000
|
unkown
|
page readonly
|
|
|
|
15B14B00000
|
unkown
|
page read and write
|
|
|
|
7FF4F6859000
|
unkown
|
page readonly
|
|
|
|
7FF4F66B3000
|
unkown
|
page readonly
|
|
|
|
7FF5C0FC7000
|
unkown
|
page readonly
|
|
|
|
7FF5A3677000
|
unkown
|
page readonly
|
|
|
|
26AC1D80000
|
unkown
|
page readonly
|
|
|
|
7FF4F685E000
|
unkown
|
page readonly
|
|
|
|
1E182D00000
|
unkown
|
page readonly
|
|
|
|
2AE83E3C000
|
unkown
|
page read and write
|
|
|
|
7FF5A333F000
|
unkown
|
page readonly
|
|
|
|
7FF55A351000
|
unkown
|
page readonly
|
|
|
|
7FF4F682A000
|
unkown
|
page readonly
|
|
|
|
1EF49D13000
|
unkown
|
page read and write
|
|
|
|
26AC64AF000
|
unkown
|
page read and write
|
|
|
|
7FF50D108000
|
unkown
|
page readonly
|
|
|
|
1E182E55000
|
unkown
|
page read and write
|
|
|
|
44BF979000
|
unkown
|
page read and write
|
|
|
|
44BF8FF000
|
unkown
|
page read and write
|
|
|
|
7FF4F6462000
|
unkown
|
page readonly
|
|
|
|
7FF55A4F8000
|
unkown
|
page readonly
|
|
|
|
2666C447000
|
unkown
|
page read and write
|
|
|
|
7FF598C9A000
|
unkown
|
page readonly
|
|
|
|
26AC1559000
|
unkown
|
page read and write
|
|
|
|
15B14980000
|
unkown
|
page readonly
|
|
|
|
7FF598EBD000
|
unkown
|
page readonly
|
|
|
|
15B14B87000
|
unkown
|
page read and write
|
|
|
|
7FF4F6664000
|
unkown
|
page readonly
|
|
|
|
7FF4F68BD000
|
unkown
|
page readonly
|
|
|
|
CEA577F000
|
unkown
|
page read and write
|
|
|
|
7FF5C1469000
|
unkown
|
page readonly
|
|
|
|
2AE83EC4000
|
unkown
|
page read and write
|
|
|
|
7FF4F66A7000
|
unkown
|
page readonly
|
|
|
|
7FF598DFF000
|
unkown
|
page readonly
|
|
|
|
7FF5E3FB9000
|
unkown
|
page readonly
|
|
|
|
2AE845C7000
|
unkown
|
page read and write
|
|
|
|
15B14B8F000
|
unkown
|
page read and write
|
|
|
|
4F60CFE000
|
unkown
|
page read and write
|
|
|
|
CEA507B000
|
unkown
|
page read and write
|
|
|
|
1E182E13000
|
unkown
|
page read and write
|
|
|
|
2AE83F16000
|
unkown
|
page read and write
|
|
|
|
26AC0D10000
|
unkown
|
page readonly
|
|
|
|
7FF5A3B7D000
|
unkown
|
page readonly
|
|
|
|
7FF55A4A7000
|
unkown
|
page readonly
|
|
|
|
7FF4F6801000
|
unkown
|
page readonly
|
|
|
|
CEA4E7E000
|
unkown
|
page read and write
|
|
|
|
15B15690000
|
unkown
|
page read and write
|
|
|
|
7CE307E000
|
unkown
|
page read and write
|
|
|
|
4F60DFD000
|
unkown
|
page read and write
|
|
|
|
7FF598D15000
|
unkown
|
page readonly
|
|
|
|
7FF5A39D8000
|
unkown
|
page readonly
|
|
|
|
C2DE4FF000
|
unkown
|
page read and write
|
|
|
|
2AE83EF0000
|
unkown
|
page read and write
|
|
|
|
CEA54FE000
|
unkown
|
page read and write
|
|
|
|
1E183000000
|
unkown
|
page readonly
|
|
|
|
7FF4F66AD000
|
unkown
|
page readonly
|
|
|
|
2666CC02000
|
unkown
|
page read and write
|
|
|
|
7FF5C1506000
|
unkown
|
page readonly
|
|
|
|
26AC1D60000
|
unkown
|
page readonly
|
|
|
|
C2DE5F9000
|
unkown
|
page read and write
|
|
|
|
7FF5E46FE000
|
unkown
|
page readonly
|
|
|
|
7FF50CAF1000
|
unkown
|
page readonly
|
|
|
|
26AC0C20000
|
heap default
|
page read and write
|
|
|
|
7FF5A3884000
|
unkown
|
page readonly
|
|
|
|
15B14DA9000
|
heap private
|
page read and write
|
|
|
|
CEA567A000
|
unkown
|
page read and write
|
|
|
|
26AC0E9D000
|
unkown
|
page read and write
|
|
|
|
44BF5AA000
|
unkown
|
page read and write
|
|
|
|
26AC0E54000
|
unkown
|
page read and write
|
|
|
|
26AC6384000
|
unkown
|
page write copy
|
|
|
|
7FF55A47A000
|
unkown
|
page readonly
|
|
|
|
2666C513000
|
unkown
|
page read and write
|
|
|
|
2AE84980000
|
unkown
|
page readonly
|
|
|
|
1CCCEBA0000
|
unkown
|
page readonly
|
|
|
|
26AC1DA0000
|
unkown
|
page readonly
|
|
|
|
7FF55A637000
|
unkown
|
page readonly
|
|
|
|
2AE8459B000
|
unkown
|
page read and write
|
|
|
|
2666C600000
|
unkown
|
page readonly
|
|
|
|
26AC0C30000
|
unkown
|
page readonly
|
|
|
|
15B14FC0000
|
unkown
|
page readonly
|
|
|
|
2666C270000
|
heap private
|
page read and write
|
|
|
|
26AC62C4000
|
unkown
|
page read and write
|
|
|
|
7CE3477000
|
unkown
|
page read and write
|
|
|
|
4F60D79000
|
unkown
|
page read and write
|
|
|
|
7FF4F68C4000
|
unkown
|
page readonly
|
|
|
|
7FF4F6640000
|
unkown
|
page readonly
|
|
|
|
1EF49C4E000
|
unkown
|
page read and write
|
|
|
|
7FF598E13000
|
unkown
|
page readonly
|
|
|
|
7FF5A39B6000
|
unkown
|
page readonly
|
|
|
|
7FF598F07000
|
unkown
|
page readonly
|
|
|
|
2666C455000
|
unkown
|
page read and write
|
|
|
|
2AE84564000
|
unkown
|
page read and write
|
|
|
|
26AC1502000
|
unkown
|
page read and write
|
|
|
|
7FF5A3BC7000
|
unkown
|
page readonly
|
|
|
|
15B14A50000
|
unkown
|
page read and write
|
|
|
|
2AE8457E000
|
unkown
|
page read and write
|
|
|
|
CEA557F000
|
unkown
|
page read and write
|
|
|
|
26AC64B3000
|
unkown
|
page read and write
|
|
|
|
7FF598E46000
|
unkown
|
page readonly
|
|
|
|
7CE367F000
|
unkown
|
page read and write
|
|
|
|
7FF4F68B1000
|
unkown
|
page readonly
|
|
|
|
2AE83EB1000
|
unkown
|
page read and write
|
|
|
|
7FF4F67E9000
|
unkown
|
page readonly
|
|
|
|
2666C3B0000
|
unkown
|
page readonly
|
|
|
|
1CCCE9FF000
|
unkown
|
page read and write
|
|
|
|
7FF598EC7000
|
unkown
|
page readonly
|
|
|
|
7FF5A3BB6000
|
unkown
|
page readonly
|
|
|
|
7FF4F6741000
|
unkown
|
page readonly
|
|
|
|
2AE845A3000
|
unkown
|
page read and write
|
|
|
|
7FF4F67D7000
|
unkown
|
page readonly
|
|
|
|
26AC63B0000
|
unkown
|
page read and write
|
|
|
|
2AE84A02000
|
unkown
|
page read and write
|
|
|
|
7FF4F6857000
|
unkown
|
page readonly
|
|
|
|
7FF598EF3000
|
unkown
|
page readonly
|
|
|
|
7FF5A3339000
|
unkown
|
page readonly
|
|
|
|
C2DE6F9000
|
unkown
|
page read and write
|
|
|
|
2AE84581000
|
unkown
|
page read and write
|
|
|
|
7FF5C12AA000
|
unkown
|
page readonly
|
|
|
|
7FF5C14C4000
|
unkown
|
page readonly
|
|
|
|
1EF49C3C000
|
unkown
|
page read and write
|
|
|
|
26AC0E77000
|
unkown
|
page read and write
|
|
|
|
7FF598CD7000
|
unkown
|
page readonly
|
|
|
|
7FF5C1320000
|
unkown
|
page readonly
|
|
|
|
7FF598E59000
|
unkown
|
page readonly
|
|
|
|
7FF5C0C89000
|
unkown
|
page readonly
|
|
|
|
4F60C7D000
|
unkown
|
page read and write
|
|
|
|
2AE84600000
|
unkown
|
page readonly
|
|
|
|
7FF50CB48000
|
unkown
|
page readonly
|
|
|
|
2AE845A9000
|
unkown
|
page read and write
|
|
|
|
7FF5E4794000
|
unkown
|
page readonly
|
|
|
|
26AC1B61000
|
unkown
|
page read and write
|
|
|
|
2AE84A02000
|
unkown
|
page read and write
|
|
|
|
2AE84940000
|
unkown
|
page readonly
|
|
|
|
1CCCED80000
|
heap private
|
page read and write
|
|
|
|
7FF55A626000
|
unkown
|
page readonly
|
|
|
|
7FF4F6826000
|
unkown
|
page readonly
|
|
|
|
2AE83DF0000
|
unkown
|
page readonly
|
|
|
|
15B158E0000
|
unkown
|
page read and write
|
|
|
|
7FF5C0C8F000
|
unkown
|
page readonly
|
|
|
|
26AC6460000
|
unkown
|
page read and write
|
|
|
|
15B14B48000
|
heap default
|
page read and write
|
|
|
|
7FF50D27D000
|
unkown
|
page readonly
|
|
|
|
26AC6700000
|
unkown
|
page readonly
|
|
|
|
1E182F00000
|
unkown
|
page read and write
|
|
|
|
2AE83E4D000
|
unkown
|
page read and write
|
|
|
|
7FF5C1456000
|
unkown
|
page readonly
|
|
|
|
26AC6414000
|
unkown
|
page read and write
|
|
|
|
7FF55A5C9000
|
unkown
|
page readonly
|
|
|
|
26AC641F000
|
unkown
|
page read and write
|
|
|
|
7FF5E47AB000
|
unkown
|
page readonly
|
|
|
|
7FF4F68F6000
|
unkown
|
page readonly
|
|
|
|
26AC62A0000
|
unkown
|
page read and write
|
|
|
|
1E182E00000
|
unkown
|
page read and write
|
|
|
|
7CE327E000
|
unkown
|
page read and write
|
|
|
|
2AE84A29000
|
unkown
|
page read and write
|
|
|
|
CEA537B000
|
unkown
|
page read and write
|
|
|
|
15B14D80000
|
unkown
|
page read and write
|
|
|
|
1EF49C4C000
|
unkown
|
page read and write
|
|
|
|
7FF598CC7000
|
unkown
|
page readonly
|
|
|
|
7FF5E47A7000
|
unkown
|
page readonly
|
|
|
|
2AE84960000
|
unkown
|
page readonly
|
|
|
|
7CE31FC000
|
unkown
|
page read and write
|
|
|
|
2AE84564000
|
unkown
|
page read and write
|
|
|
|
2AE83EFA000
|
unkown
|
page read and write
|
|
|
|
7FF5C1423000
|
unkown
|
page readonly
|
|
|
|
44BF87F000
|
unkown
|
page read and write
|
|
|
|
26AC6160000
|
unkown
|
page read and write
|
|
|
|
2AE84564000
|
unkown
|
page read and write
|
|
|
|
2AE8459B000
|
unkown
|
page read and write
|
|
|
|
7CE30FE000
|
unkown
|
page read and write
|
|
|
|
7FF55A6A4000
|
unkown
|
page readonly
|
|
|
|
7FF5E47E7000
|
unkown
|
page readonly
|
|
|
|
7FF5C14D4000
|
unkown
|
page readonly
|
|
|
|
7FF4F6907000
|
unkown
|
page readonly
|
|
|
|
7FF50CB41000
|
unkown
|
page readonly
|
|
|
|
527BE7E000
|
unkown
|
page read and write
|
|
|
|
26AC0DE0000
|
unkown
|
page readonly
|
|
|
|
26AC6130000
|
unkown
|
page readonly
|
|
|
|
7FF598E1D000
|
unkown
|
page readonly
|
|
|
|
C2DDE7F000
|
unkown
|
page read and write
|
|
|
|
15B14C40000
|
unkown
|
page readonly
|
|
|
|
7FF55A42B000
|
unkown
|
page readonly
|
|
|
|
1EF49E00000
|
unkown
|
page readonly
|
|
|
|
2AE845A3000
|
unkown
|
page read and write
|
|
|
|
7FF5E479D000
|
unkown
|
page readonly
|
|
|
|
2AE83F02000
|
unkown
|
page read and write
|
|
|
|
7FF4F6832000
|
unkown
|
page readonly
|
|
|
|
1CCCE970000
|
unkown
|
page read and write
|
|
|
|
2AE84577000
|
unkown
|
page read and write
|
|
|
|
2AE8459C000
|
unkown
|
page read and write
|
|
|
|
7FF5E47D6000
|
unkown
|
page readonly
|
|
|
|
2AE84A63000
|
unkown
|
page read and write
|
|
|
|
C2DE477000
|
unkown
|
page read and write
|
|
|
|
C2DDB3B000
|
unkown
|
page read and write
|
|
|
|
7FF55A166000
|
unkown
|
page readonly
|
|
|
|
7FF55A493000
|
unkown
|
page readonly
|
|
|
|
7FF4F6846000
|
unkown
|
page readonly
|
|
|
|
2AE84594000
|
unkown
|
page read and write
|
|
|
|
1CCCE9D0000
|
heap default
|
page read and write
|
|
|
|
7FF50D2C7000
|
unkown
|
page readonly
|
|
|
|
7FF55A6BA000
|
unkown
|
page readonly
|
|
|
|
7CE2D8B000
|
unkown
|
page read and write
|
|
|
|
26AC63D0000
|
unkown
|
page read and write
|
|
|
|
7FF5A3AF2000
|
unkown
|
page readonly
|
|
|
|
7FF5A3A08000
|
unkown
|
page readonly
|
|
|
|
26AC642D000
|
unkown
|
page read and write
|
|
|
|
26AC6280000
|
unkown
|
page read and write
|
|
|
|
7FF5C0FC1000
|
unkown
|
page readonly
|
|
|
|
2666C44F000
|
unkown
|
page read and write
|
|
|
|
1EF49C02000
|
unkown
|
page read and write
|
|
|
|
2666C2D0000
|
heap default
|
page read and write
|
|
|
|
2AE8459C000
|
unkown
|
page read and write
|
|
|
|
2AE83DC0000
|
unkown
|
page readonly
|
|
|
|
7FF55A191000
|
unkown
|
page readonly
|
|
|
|
2AE84A00000
|
unkown
|
page read and write
|
|
|
|
7FF5A3AD3000
|
unkown
|
page readonly
|
|
|
|
7FF598E2A000
|
unkown
|
page readonly
|
|
|
|
26AC0E8B000
|
unkown
|
page read and write
|
|
|
|
2AE8457D000
|
unkown
|
page read and write
|
|
|
|
26AC0F25000
|
unkown
|
page read and write
|
|
|
|
7FF559F75000
|
unkown
|
page readonly
|
|
|
|
2AE845A4000
|
unkown
|
page read and write
|
|
|
|
15B14AF0000
|
unkown
|
page read and write
|
|
|
|
7FF55A41E000
|
unkown
|
page readonly
|
|
|
|
7FF598E0F000
|
unkown
|
page readonly
|
|
|
|
7FF598ECB000
|
unkown
|
page readonly
|
|
|
|
2666C470000
|
unkown
|
page read and write
|
|
|
|
26AC63E0000
|
unkown
|
page read and write
|
|
|
|
2666C502000
|
unkown
|
page read and write
|
|
|
|
7FF50D277000
|
unkown
|
page readonly
|
|
|
|
7FF5A3B87000
|
unkown
|
page readonly
|
|
|
|
2AE84970000
|
unkown
|
page read and write
|
|
|
|
7FF5C14EA000
|
unkown
|
page readonly
|
|
|
|
7FF5C1442000
|
unkown
|
page readonly
|
|
|
|
2666C400000
|
unkown
|
page read and write
|
|
|
|
7FF50D28B000
|
unkown
|
page readonly
|
|
|
|
7FF5A3A45000
|
unkown
|
page readonly
|
|
|
|
2AE845A3000
|
unkown
|
page read and write
|
|
|
|
26AC1400000
|
unkown
|
page read and write
|
|
|
|
1E182BC0000
|
heap private
|
page read and write
|
|
|
|
26AC63E0000
|
unkown
|
page read and write
|
|
|
|
7FF4F67D4000
|
unkown
|
page readonly
|
|
|
|
7FF5C1395000
|
unkown
|
page readonly
|
|
|
|
C2DE379000
|
unkown
|
page read and write
|
|
|
|
1EF49C8D000
|
unkown
|
page read and write
|
|
|
|
1E183600000
|
unkown
|
page readonly
|
|
|
|
7FF4F65F9000
|
unkown
|
page readonly
|
|
|
|
7FF5C143A000
|
unkown
|
page readonly
|
|
|
|
2666C44D000
|
unkown
|
page read and write
|
|
|
|
26AC1518000
|
unkown
|
page read and write
|
|
|
|
2AE84583000
|
unkown
|
page read and write
|
|
|
|
7FF5A3ACF000
|
unkown
|
page readonly
|
|
|
|
7FF55A6D3000
|
unkown
|
page readonly
|
|
|
|
26AC0E75000
|
unkown
|
page read and write
|
|
|
|
26AC6170000
|
unkown
|
page read and write
|
|
|
|
7FF55A62D000
|
unkown
|
page readonly
|
|
|
|
2AE84554000
|
unkown
|
page read and write
|
|
|
|
44BF9FA000
|
unkown
|
page read and write
|
|
|
|
7FF598F07000
|
unkown
|
page readonly
|
|
|
|
7FF5E47A4000
|
unkown
|
page readonly
|
|
|
|
7FF4F6610000
|
unkown
|
page readonly
|
|
|
|
7FF5E472D000
|
unkown
|
page readonly
|
|
|
|
2AE84555000
|
unkown
|
page read and write
|
|
|
|
2AE84A02000
|
unkown
|
page read and write
|
|
|
|
1EF49C56000
|
unkown
|
page read and write
|
|
|
|
26AC0E92000
|
unkown
|
page read and write
|
|
|
|
26AC6449000
|
unkown
|
page read and write
|
|
|
|
2AE8457F000
|
unkown
|
page read and write
|
|
|
|
1E182F02000
|
unkown
|
page read and write
|
|
|
|
7FF55A4B7000
|
unkown
|
page readonly
|
|
|
|
7FF5C14CD000
|
unkown
|
page readonly
|
|
|
|
7FF4F67E0000
|
unkown
|
page readonly
|
|
|
|
7FF598E4D000
|
unkown
|
page readonly
|
|
|
|
1CCCE9E2000
|
unkown
|
page read and write
|
|
|
|
1E182E3C000
|
unkown
|
page read and write
|
|
|
|
15B15350000
|
unkown
|
page readonly
|
|
|
|
7FF4F62BF000
|
unkown
|
page readonly
|
|
|
|
527BD7F000
|
unkown
|
page read and write
|
|
|
|
7FF4F60A0000
|
unkown
|
page readonly
|
|
|
|
C2DE7FA000
|
unkown
|
page read and write
|
|
|
|
7FF55A4D6000
|
unkown
|
page readonly
|
|
|
|
7FF55A5DF000
|
unkown
|
page readonly
|
|
|
|
7FF4F67FF000
|
unkown
|
page readonly
|
|
|
|
7FF5A3BC7000
|
unkown
|
page readonly
|
|
|
|
7FF55A3BF000
|
unkown
|
page readonly
|
|
|
|
7FF50CA47000
|
unkown
|
page readonly
|
|
|
|
7FF598D85000
|
unkown
|
page readonly
|
|
|
|
7FF4F66AA000
|
unkown
|
page readonly
|
|
|
|
2666C413000
|
unkown
|
page read and write
|
|
|
|
26AC60F0000
|
unkown
|
page read and write
|
|
|
|
1CCCE9DB000
|
heap default
|
page read and write
|
|
|
|
2AE83E70000
|
unkown
|
page read and write
|
|
|
|
7FF4F6748000
|
unkown
|
page readonly
|
|
|
|
2666C3C0000
|
unkown
|
page readonly
|
|
|
|
527B97D000
|
unkown
|
page read and write
|
|
|
|
7FF4F6813000
|
unkown
|
page readonly
|
|
|
|
7FF5E4463000
|
unkown
|
page readonly
|
|
|
|
26AC64B0000
|
unkown
|
page read and write
|
|
|
|
1EF49A00000
|
heap private
|
page read and write
|
|
|
|
26AC6630000
|
unkown
|
page readonly
|
|
|
|
26AC0E2A000
|
unkown
|
page read and write
|
|
|
|
26AC63E0000
|
unkown
|
page readonly
|
|
|
|
7FF4F65B3000
|
unkown
|
page readonly
|
|
|
|
2AE84535000
|
unkown
|
page read and write
|
|
|
|
7FF50D1D4000
|
unkown
|
page readonly
|
|
|
|
26AC0D00000
|
unkown
|
page readonly
|
|
|
|
1CCCE990000
|
unkown
|
page read and write
|
|
|
|
1CCCED40000
|
unkown
|
page read and write
|
|
|
|
7FF559E59000
|
unkown
|
page readonly
|
|
|
|
7FF55A597000
|
unkown
|
page readonly
|
|
|
|
26AC1D90000
|
unkown
|
page readonly
|
|
|
|
44BFA7E000
|
unkown
|
page read and write
|
|
|
|
2AE83DD0000
|
unkown
|
page read and write
|
|
|
|
26AC6640000
|
unkown
|
page readonly
|
|
|
|
1E182DE0000
|
unkown
|
page readonly
|
|
|
|
1EF49C13000
|
unkown
|
page read and write
|
|
|
|
26AC0E3D000
|
unkown
|
page read and write
|
|
|
|
2AE84554000
|
unkown
|
page read and write
|
|
|
|
2AE84542000
|
unkown
|
page read and write
|
|
|
|
7FF5C1517000
|
unkown
|
page readonly
|
|
|
|
7FF4F65C6000
|
unkown
|
page readonly
|
|
|
|
26AC6400000
|
unkown
|
page read and write
|
|
|
|
7FF5E4791000
|
unkown
|
page readonly
|
|
|
|
26AC1518000
|
unkown
|
page read and write
|
|
|
|
7FF5A3B71000
|
unkown
|
page readonly
|
|
|
|
7FF5A39D5000
|
unkown
|
page readonly
|
|
|
|
2AE8457D000
|
unkown
|
page read and write
|
|
|
|
7FF598B71000
|
unkown
|
page readonly
|
|
|
|
7FF55A48F000
|
unkown
|
page readonly
|
|
|
|
26AC66C0000
|
unkown
|
page readonly
|
|
|
|
7FF4F660A000
|
unkown
|
page readonly
|
|
|
|
2AE84A02000
|
unkown
|
page read and write
|
|
|
|
1EF49C8A000
|
unkown
|
page read and write
|
|
|
|
2AE84575000
|
unkown
|
page read and write
|
|
|
|
1CCCE9C0000
|
unkown
|
page readonly
|
|
|
|
2AE84580000
|
unkown
|
page read and write
|
|
|
|
26AC63C0000
|
unkown
|
page read and write
|
|
|
|
7FF4F66C3000
|
unkown
|
page readonly
|
|
|
|
15B14AE0000
|
unkown
|
page read and write
|
|
|
|
2AE84580000
|
unkown
|
page read and write
|
|
|
|
7FF5A3B9A000
|
unkown
|
page readonly
|
|
|
|
44BFAFF000
|
unkown
|
page read and write
|
|
|
|
2666C449000
|
unkown
|
page read and write
|
|
|
|
7FF50D206000
|
unkown
|
page readonly
|
|
|
|
26AC6374000
|
unkown
|
page readonly
|
|
|
|
7FF55A420000
|
unkown
|
page readonly
|
|
|
|
2AE84554000
|
unkown
|
page read and write
|
|
|
|
15B14920000
|
unkown
|
page read and write
|
|
|
|
1EF49D08000
|
unkown
|
page read and write
|
|
|
|
26AC1559000
|
unkown
|
page read and write
|
|
|
|
7FF4F216B000
|
unkown
|
page readonly
|
|
|
|
2666C508000
|
unkown
|
page read and write
|
|
|
|
7FF55A5E1000
|
unkown
|
page readonly
|
|
|
|
7FF598EB1000
|
unkown
|
page readonly
|
|
|
|
7FF5A3997000
|
unkown
|
page readonly
|
|
|
|
7FF50CB4A000
|
unkown
|
page readonly
|
|
|
|
C2DE8FE000
|
unkown
|
page read and write
|
|
|
|
7FF598D48000
|
unkown
|
page readonly
|
|
|
|
2AE84B02000
|
unkown
|
page read and write
|
|
|
|
2AE84500000
|
unkown
|
page read and write
|
|
|
|
1E182E7F000
|
unkown
|
page read and write
|
|
|
|
7FF50D2C7000
|
unkown
|
page readonly
|
|
|
|
26AC6485000
|
unkown
|
page read and write
|
|
|
|
26AC1500000
|
unkown
|
page read and write
|
|
|
|
2AE845A3000
|
unkown
|
page read and write
|
|
|
|
7FF50D2B3000
|
unkown
|
page readonly
|
|
|
|
CEA587F000
|
unkown
|
page read and write
|
|
|
|
7FF5989B1000
|
unkown
|
page readonly
|
|
|
|
7FF5C14D7000
|
unkown
|
page readonly
|
|
|
|
2AE83EDA000
|
unkown
|
page read and write
|
|
|
|
7FF4F66AF000
|
unkown
|
page readonly
|
|
|
|
2AE83E29000
|
unkown
|
page read and write
|
|
|
|
7FF50D1E6000
|
unkown
|
page readonly
|
|
|
|
7FF598EB4000
|
unkown
|
page readonly
|
|
|
|
1CCCED85000
|
heap private
|
page read and write
|
|
|
|
1CCCEA0A000
|
heap default
|
page read and write
|
|
|
|
7FF5C14DB000
|
unkown
|
page readonly
|
|
|
|
15B14DB0000
|
unkown
|
page read and write
|
|
|
|
7FF55A6E7000
|
unkown
|
page readonly
|
|
|
|
7FF55A6D6000
|
unkown
|
page readonly
|
|
|
|
26AC643C000
|
unkown
|
page read and write
|
|
|
|
2AE84A43000
|
unkown
|
page read and write
|
|
|
|
2AE84000000
|
unkown
|
page readonly
|
|
|
|
A1F567E000
|
unkown
|
page read and write
|
|
|
|
1E182E50000
|
unkown
|
page read and write
|
|
|
|
2AE84402000
|
unkown
|
page read and write
|
|
|
|
A1F57FC000
|
unkown
|
page read and write
|
|
|
|
7FF5A3B84000
|
unkown
|
page readonly
|
|
|
|
7FF55A4F5000
|
unkown
|
page readonly
|
|
|
|
7FF50D284000
|
unkown
|
page readonly
|
|
|
|
1E182E71000
|
unkown
|
page read and write
|
|
|
|
7FF5C145D000
|
unkown
|
page readonly
|
|
|
|
1EF49C7C000
|
unkown
|
page read and write
|
|
|
|
7FF50D217000
|
unkown
|
page readonly
|
|
|
|
CEA597A000
|
unkown
|
page read and write
|
|
|
|
7FF55A694000
|
unkown
|
page readonly
|
|
|
|
26AC1000000
|
unkown
|
page readonly
|
|
|
|
CEA56FF000
|
unkown
|
page read and write
|
|
|
|
2AE84595000
|
unkown
|
page read and write
|
|
There are 730 hidden memdumps, click here to show them.