Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Compensation-54975366-09272021.xls
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Test, Last Saved By:
Test, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:17:20 2015, Last Saved Time/Date: Mon
Sep 27 10:38:52 2021, Security: 0
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8F1C1CDD-A965-428A-9384-8100063EB692
|
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\VBE\RefEdit.exd
|
data
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
|
'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
regsvr32 -silent ..\Drezd.red
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
regsvr32 -silent ..\Drezd1.red
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
regsvr32 -silent ..\Drezd2.red
|
|
|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
regsvr32 -silent ..\Drezd.red
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
regsvr32 -silent ..\Drezd1.red
|
|
|
|
C:\Windows\System32\regsvr32.exe
|
regsvr32 -silent ..\Drezd2.red
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://185.183.96.67/
|
unknown
|
|
|
|
http://185.250.148.213/
|
unknown
|
|
|
|
https://api.diagnosticssdf.office.com
|
unknown
|
|
|
|
https://login.microsoftonline.com/
|
unknown
|
|
|
|
https://shell.suite.office.com:1443
|
unknown
|
|
|
|
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
|
unknown
|
|
|
|
https://autodiscover-s.outlook.com/
|
unknown
|
|
|
|
https://roaming.edog.
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
|
unknown
|
|
|
|
https://cdn.entity.
|
unknown
|
|
|
|
https://api.addins.omex.office.net/appinfo/query
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/tenantassociationkey
|
unknown
|
|
|
|
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
|
unknown
|
|
|
|
https://powerlift.acompli.net
|
unknown
|
|
|
|
https://rpsticket.partnerservices.getmicrosoftkey.com
|
unknown
|
|
|
|
https://lookup.onenote.com/lookup/geolocation/v1
|
unknown
|
|
|
|
https://cortana.ai
|
unknown
|
|
|
|
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
|
|
|
https://cloudfiles.onenote.com/upload.aspx
|
unknown
|
|
|
|
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
|
|
|
https://entitlement.diagnosticssdf.office.com
|
unknown
|
|
|
|
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
|
unknown
|
|
|
|
https://api.aadrm.com/
|
unknown
|
|
|
|
https://ofcrecsvcapi-int.azurewebsites.net/
|
unknown
|
|
|
|
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
|
unknown
|
|
|
|
https://api.microsoftstream.com/api/
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
|
unknown
|
|
|
|
https://cr.office.com
|
unknown
|
|
|
|
https://portal.office.com/account/?ref=ClientMeControl
|
unknown
|
|
|
|
https://graph.ppe.windows.net
|
unknown
|
|
|
|
https://res.getmicrosoftkey.com/api/redemptionevents
|
unknown
|
|
|
|
https://powerlift-frontdesk.acompli.net
|
unknown
|
|
|
|
https://tasks.office.com
|
unknown
|
|
|
|
https://officeci.azurewebsites.net/api/
|
unknown
|
|
|
|
https://sr.outlook.office.net/ws/speech/recognize/assistant/work
|
unknown
|
|
|
|
https://store.office.cn/addinstemplate
|
unknown
|
|
|
|
https://outlook.office.com/autosuggest/api/v1/init?cvid=
|
unknown
|
|
|
|
https://globaldisco.crm.dynamics.com
|
unknown
|
|
|
|
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
|
|
|
https://store.officeppe.com/addinstemplate
|
unknown
|
|
|
|
https://dev0-api.acompli.net/autodetect
|
unknown
|
|
|
|
https://www.odwebp.svc.ms
|
unknown
|
|
|
|
https://api.powerbi.com/v1.0/myorg/groups
|
unknown
|
|
|
|
https://web.microsoftstream.com/video/
|
unknown
|
|
|
|
https://graph.windows.net
|
unknown
|
|
|
|
https://dataservice.o365filtering.com/
|
unknown
|
|
|
|
https://officesetup.getmicrosoftkey.com
|
unknown
|
|
|
|
https://analysis.windows.net/powerbi/api
|
unknown
|
|
|
|
https://prod-global-autodetect.acompli.net/autodetect
|
unknown
|
|
|
|
https://outlook.office365.com/autodiscover/autodiscover.json
|
unknown
|
|
|
|
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
|
unknown
|
|
|
|
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
|
|
|
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
|
unknown
|
|
|
|
https://ncus.contentsync.
|
unknown
|
|
|
|
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
|
unknown
|
|
|
|
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
|
unknown
|
|
|
|
http://weather.service.msn.com/data.aspx
|
unknown
|
|
|
|
https://apis.live.net/v5.0/
|
unknown
|
|
|
|
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
|
unknown
|
|
|
|
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
|
unknown
|
|
|
|
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
|
unknown
|
|
|
|
https://management.azure.com
|
unknown
|
|
|
|
https://outlook.office365.com
|
unknown
|
|
|
|
http://190.14.37.178/
|
unknown
|
|
|
|
https://wus2.contentsync.
|
unknown
|
|
|
|
https://incidents.diagnostics.office.com
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/ios
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/odc/insertmedia
|
unknown
|
|
|
|
https://o365auditrealtimeingestion.manage.office.com
|
unknown
|
|
|
|
https://outlook.office365.com/api/v1.0/me/Activities
|
unknown
|
|
|
|
https://api.office.net
|
unknown
|
|
|
|
https://incidents.diagnosticssdf.office.com
|
unknown
|
|
|
|
https://asgsmsproxyapi.azurewebsites.net/
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/android/policies
|
unknown
|
|
|
|
https://entitlement.diagnostics.office.com
|
unknown
|
|
|
|
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
|
unknown
|
|
|
|
https://substrate.office.com/search/api/v2/init
|
unknown
|
|
|
|
https://outlook.office.com/
|
unknown
|
|
|
|
https://storage.live.com/clientlogs/uploadlocation
|
unknown
|
|
|
|
https://outlook.office365.com/
|
unknown
|
|
|
|
https://webshell.suite.office.com
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
|
unknown
|
|
|
|
https://substrate.office.com/search/api/v1/SearchHistory
|
unknown
|
|
|
|
https://management.azure.com/
|
unknown
|
|
|
|
https://login.windows.net/common/oauth2/authorize
|
unknown
|
|
|
|
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
|
|
|
https://graph.windows.net/
|
unknown
|
|
|
|
https://api.powerbi.com/beta/myorg/imports
|
unknown
|
|
|
|
https://devnull.onenote.com
|
unknown
|
|
|
|
https://ncus.pagecontentsync.
|
unknown
|
|
|
|
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
|
unknown
|
|
|
|
https://messaging.office.com/
|
unknown
|
|
|
|
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
|
|
|
https://augloop.office.com/v2
|
unknown
|
|
|
|
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
|
unknown
|
|
|
|
https://skyapi.live.net/Activity/
|
unknown
|
|
|
|
https://clients.config.office.net/user/v1.0/mac
|
unknown
|
|
|
|
https://dataservice.o365filtering.com
|
unknown
|
|
|
|
https://api.cortana.ai
|
unknown
|
|
|
|
https://onedrive.live.com
|
unknown
|
|
|
|
http://servername/isapibackend.dll
|
unknown
|
|
There are 91 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
clientconfig.passport.net
|
unknown
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
185.183.96.67
|
unknown
|
Netherlands
|
|
|
|
190.14.37.178
|
unknown
|
Panama
|
|
|
|
185.250.148.213
|
unknown
|
Russian Federation
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
|
(<<
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
|
)<<
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache
|
RemoteClearDate
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3
|
Last
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
FilePath
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
StartDate
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
EndDate
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
Properties
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.4954&crev=3\0
|
Url
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\internet\WebServiceCache
|
LastClean
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableWinHttpCertAuth
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableIsOwnerRegex
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableSessionAwareHttpClose
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableADALForExtendedApps
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
DisableADALSetSilentAuth
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
msoridDisableGuestCredProvider
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
|
msoridDisableOstringReplace
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\IOAV
|
LastBootTime
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
VBAFiles
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ExdCache\Excel8.0
|
MSForms
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ExdCache\Excel8.0
|
MSComctlLib
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ReviewCycle
|
ReviewToken
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\4C4F3
|
4C4F3
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BF4F5CAA-1C7D-4566-B956-AC3B1381839D}\2.0
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BF4F5CAA-1C7D-4566-B956-AC3B1381839D}\2.0\FLAGS
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BF4F5CAA-1C7D-4566-B956-AC3B1381839D}\2.0\0\win32
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BF4F5CAA-1C7D-4566-B956-AC3B1381839D}\2.0\HELPDIR
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\TypeLib\{BF4F5CAA-1C7D-4566-B956-AC3B1381839D}\2.0
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\TypeLib\{BF4F5CAA-1C7D-4566-B956-AC3B1381839D}\2.0\FLAGS
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\TypeLib\{BF4F5CAA-1C7D-4566-B956-AC3B1381839D}\2.0\0\win32
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\TypeLib\{BF4F5CAA-1C7D-4566-B956-AC3B1381839D}\2.0\HELPDIR
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{40B2FCB7-3A5A-4476-B78F-A966D52E0E57}\1.2
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{40B2FCB7-3A5A-4476-B78F-A966D52E0E57}\1.2\FLAGS
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{40B2FCB7-3A5A-4476-B78F-A966D52E0E57}\1.2\0\win32
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{40B2FCB7-3A5A-4476-B78F-A966D52E0E57}\1.2\HELPDIR
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00024518-0000-0000-C000-000000000046}
|
NULL
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
|
~-<
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109E60090400000000000F01FEC\Usage
|
VBAFilesIntl_1033
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\69A8E
|
69A8E
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\69CB1
|
69CB1
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\General
|
FileFormatBallotBoxAppIDBootedOnce
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
ProductFiles
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-US
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-US
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109110000000000000000F01FEC\Usage
|
EXCELFiles
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
|
RoamingConfigurableSettings
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
|
RoamingLastSyncTime
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Roaming
|
RoamingLastWriteTime
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\IOAV
|
LastBootTime
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_Classes\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
'2'
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
|
MTTT
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
VBAFiles
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
|
ReviewToken
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\2F25A
|
2F25A
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{429B5F8E-D9CC-4F23-918D-5D39916FC4CA}\2.0
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{429B5F8E-D9CC-4F23-918D-5D39916FC4CA}\2.0\FLAGS
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{429B5F8E-D9CC-4F23-918D-5D39916FC4CA}\2.0\0\win32
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{429B5F8E-D9CC-4F23-918D-5D39916FC4CA}\2.0\HELPDIR
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\TypeLib\{429B5F8E-D9CC-4F23-918D-5D39916FC4CA}\2.0
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\TypeLib\{429B5F8E-D9CC-4F23-918D-5D39916FC4CA}\2.0\FLAGS
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\TypeLib\{429B5F8E-D9CC-4F23-918D-5D39916FC4CA}\2.0\0\win32
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\TypeLib\{429B5F8E-D9CC-4F23-918D-5D39916FC4CA}\2.0\HELPDIR
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{37F00971-2C94-4CB8-99AA-06D4569D8594}\1.2
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{37F00971-2C94-4CB8-99AA-06D4569D8594}\1.2\FLAGS
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{37F00971-2C94-4CB8-99AA-06D4569D8594}\1.2\0\win32
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{37F00971-2C94-4CB8-99AA-06D4569D8594}\1.2\HELPDIR
|
NULL
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00024518-0000-0000-C000-000000000046}
|
NULL
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
&>'
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\5499E
|
5499E
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\54C2D
|
54C2D
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
EXCELFiles
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
|
NULL
|
|
|
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
|
There are 373 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7DF5625F2000
|
unkown image
|
page readonly
|
|
|
|
2F0B000
|
unkown
|
page read and write
|
|
|
|
28EA000
|
unkown image
|
page readonly
|
|
|
|
7FF52F7B7000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BA9000
|
unkown
|
page read and write
|
|
|
|
1A8C7B6E000
|
unkown
|
page read and write
|
|
|
|
2B33000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8CE4000
|
unkown image
|
page readonly
|
|
|
|
2700000
|
unkown image
|
page readonly
|
|
|
|
7DF544FD2000
|
unkown image
|
page readonly
|
|
|
|
1A258760000
|
unkown image
|
page read and write
|
|
|
|
2D6E9FF000
|
unkown
|
page read and write
|
|
|
|
27AF2290000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8CF8000
|
unkown image
|
page readonly
|
|
|
|
34B0000
|
unkown image
|
page readonly
|
|
|
|
2868000
|
unkown image
|
page readonly
|
|
|
|
7FC10000
|
unkown image
|
page readonly
|
|
|
|
2BE4000
|
unkown image
|
page readonly
|
|
|
|
7DF562600000
|
unkown image
|
page readonly
|
|
|
|
7DF562600000
|
unkown image
|
page readonly
|
|
|
|
7FF90000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B82000
|
unkown
|
page read and write
|
|
|
|
7FF54D3CD000
|
unkown image
|
page readonly
|
|
|
|
1A8C8002000
|
unkown
|
page read and write
|
|
|
|
7FF54D48B000
|
unkown image
|
page readonly
|
|
|
|
7FF54D040000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF64A000
|
unkown image
|
page readonly
|
|
|
|
2B03000
|
unkown image
|
page readonly
|
|
|
|
39F0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B95000
|
unkown
|
page read and write
|
|
|
|
1A8C7B9A000
|
unkown
|
page read and write
|
|
|
|
2955000
|
unkown image
|
page readonly
|
|
|
|
7FC12000
|
unkown image
|
page readonly
|
|
|
|
27AF22F6000
|
unkown
|
page read and write
|
|
|
|
7DF5625F0000
|
unkown image
|
page readonly
|
|
|
|
3130000
|
unkown image
|
page readonly
|
|
|
|
28901A85000
|
unkown
|
page read and write
|
|
|
|
1A8C7B7A000
|
unkown
|
page read and write
|
|
|
|
2983000
|
unkown image
|
page readonly
|
|
|
|
250CAE60000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
7FCB2000
|
unkown image
|
page readonly
|
|
|
|
28901B02000
|
unkown
|
page read and write
|
|
|
|
7FF54D454000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B81000
|
unkown
|
page read and write
|
|
|
|
27AF231C000
|
unkown
|
page read and write
|
|
|
|
7FF5077C1000
|
unkown image
|
page readonly
|
|
|
|
28EF000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
66C3C7F000
|
unkown
|
page read and write
|
|
|
|
E54E6FB000
|
unkown
|
page read and write
|
|
|
|
1A8C7B92000
|
unkown
|
page read and write
|
|
|
|
7FCC0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B7E000
|
unkown
|
page read and write
|
|
|
|
7FF52FED9000
|
unkown image
|
page readonly
|
|
|
|
28DF000
|
unkown image
|
page readonly
|
|
|
|
7FC10000
|
unkown image
|
page readonly
|
|
|
|
1A8C7255000
|
unkown
|
page read and write
|
|
|
|
7DF544FF0000
|
unkown image
|
page readonly
|
|
|
|
2AF2000
|
unkown image
|
page readonly
|
|
|
|
287C000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
7DF544FE2000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BBB000
|
unkown
|
page read and write
|
|
|
|
2AE4000
|
unkown image
|
page readonly
|
|
|
|
7FF54D433000
|
unkown image
|
page readonly
|
|
|
|
250CAF00000
|
unkown
|
page read and write
|
|
|
|
7DF51C852000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
1A8C7B1E000
|
unkown
|
page read and write
|
|
|
|
7FF5AF751000
|
unkown image
|
page readonly
|
|
|
|
7FF5076D0000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF55E000
|
unkown image
|
page readonly
|
|
|
|
1A258829000
|
unkown
|
page read and write
|
|
|
|
7FF5076E7000
|
unkown image
|
page readonly
|
|
|
|
250CAC10000
|
unkown image
|
page readonly
|
|
|
|
1A8C7257000
|
unkown
|
page read and write
|
|
|
|
1A258913000
|
unkown
|
page read and write
|
|
|
|
7FF52FEBE000
|
unkown image
|
page readonly
|
|
|
|
2A25000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
2883000
|
unkown image
|
page readonly
|
|
|
|
289018F0000
|
unkown image
|
page readonly
|
|
|
|
2B6F000
|
unkown image
|
page readonly
|
|
|
|
2951000
|
unkown image
|
page readonly
|
|
|
|
7FC02000
|
unkown image
|
page readonly
|
|
|
|
7DF442EA0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BA8000
|
unkown
|
page read and write
|
|
|
|
7FF5AF541000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BC8000
|
unkown
|
page read and write
|
|
|
|
1A8C7B6B000
|
unkown
|
page read and write
|
|
|
|
7FF5B8BFC000
|
unkown image
|
page readonly
|
|
|
|
2BD1000
|
unkown image
|
page readonly
|
|
|
|
7FF50772F000
|
unkown image
|
page readonly
|
|
|
|
28901A50000
|
unkown
|
page read and write
|
|
|
|
314A000
|
heap default
|
page read and write
|
|
|
|
1A8C7920000
|
unkown
|
page read and write
|
|
|
|
7FF5AF6B4000
|
unkown image
|
page readonly
|
|
|
|
1A25886F000
|
unkown
|
page read and write
|
|
|
|
2E70000
|
unkown image
|
page readonly
|
|
|
|
7FF54D37B000
|
unkown image
|
page readonly
|
|
|
|
7FF507573000
|
unkown image
|
page readonly
|
|
|
|
250CAE02000
|
unkown
|
page read and write
|
|
|
|
7DF5625F0000
|
unkown image
|
page readonly
|
|
|
|
1A258856000
|
unkown
|
page read and write
|
|
|
|
7FF5AF68C000
|
unkown image
|
page readonly
|
|
|
|
2C03000
|
unkown image
|
page readonly
|
|
|
|
7FF507290000
|
unkown image
|
page readonly
|
|
|
|
1A25884C000
|
unkown
|
page read and write
|
|
|
|
7DF51C840000
|
unkown image
|
page readonly
|
|
|
|
1A258902000
|
unkown
|
page read and write
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
7FF52FF51000
|
unkown image
|
page readonly
|
|
|
|
2E84000
|
unkown
|
page read and write
|
|
|
|
2D60000
|
unkown image
|
page read and write
|
|
|
|
1A8C7200000
|
unkown
|
page read and write
|
|
|
|
2BF2000
|
unkown image
|
page readonly
|
|
|
|
289018D0000
|
unkown image
|
page readonly
|
|
|
|
7FF54D4EE000
|
unkown image
|
page readonly
|
|
|
|
27AF2250000
|
unkown
|
page read and write
|
|
|
|
27AF21F0000
|
unkown image
|
page readonly
|
|
|
|
1A8C8002000
|
unkown
|
page read and write
|
|
|
|
1A8C7B88000
|
unkown
|
page read and write
|
|
|
|
1A8C7B97000
|
unkown
|
page read and write
|
|
|
|
27AF22F1000
|
unkown
|
page read and write
|
|
|
|
7FF5B8A07000
|
unkown image
|
page readonly
|
|
|
|
7FF54D3EC000
|
unkown image
|
page readonly
|
|
|
|
1A8C72A5000
|
unkown
|
page read and write
|
|
|
|
2E50000
|
heap default
|
page read and write
|
|
|
|
7DF5C47E2000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF5B3000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8B51000
|
unkown image
|
page readonly
|
|
|
|
7FF50763C000
|
unkown image
|
page readonly
|
|
|
|
66C3D7F000
|
unkown
|
page read and write
|
|
|
|
1A8C7313000
|
unkown
|
page read and write
|
|
|
|
1A8C7B80000
|
unkown
|
page read and write
|
|
|
|
7FF5076FC000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8CA7000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
AD0000
|
unkown
|
page read and write
|
|
|
|
9C0000
|
unkown image
|
page read and write
|
|
|
|
1A8C7B9C000
|
unkown
|
page read and write
|
|
|
|
1A258CD0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8F000
|
unkown
|
page read and write
|
|
|
|
1A8C7B7D000
|
unkown
|
page read and write
|
|
|
|
27AF2610000
|
heap private
|
page read and write
|
|
|
|
1A8C7213000
|
unkown
|
page read and write
|
|
|
|
7FC20000
|
unkown image
|
page readonly
|
|
|
|
289018C0000
|
heap private
|
page read and write
|
|
|
|
7FF5072A5000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF4B1000
|
unkown image
|
page readonly
|
|
|
|
2D6EC7E000
|
unkown
|
page read and write
|
|
|
|
7FF5B83B8000
|
unkown image
|
page readonly
|
|
|
|
289018B0000
|
unkown image
|
page read and write
|
|
|
|
250CAC00000
|
heap private
|
page read and write
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
7FF5075B1000
|
unkown image
|
page readonly
|
|
|
|
1A2587B0000
|
unkown image
|
page readonly
|
|
|
|
2B0A000
|
unkown image
|
page readonly
|
|
|
|
7DF41A710000
|
unkown image
|
page readonly
|
|
|
|
2A49000
|
unkown image
|
page readonly
|
|
|
|
250CAD40000
|
unkown image
|
page readonly
|
|
|
|
7FF54D095000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BA9000
|
unkown
|
page read and write
|
|
|
|
7DF4CBCD0000
|
unkown image
|
page readonly
|
|
|
|
66C352B000
|
unkown
|
page read and write
|
|
|
|
1A8C7B7B000
|
unkown
|
page read and write
|
|
|
|
7FF5AF6AA000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B82000
|
unkown
|
page read and write
|
|
|
|
1A8C7308000
|
unkown
|
page read and write
|
|
|
|
7FF52FEAA000
|
unkown image
|
page readonly
|
|
|
|
7FF80000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8C000
|
unkown
|
page read and write
|
|
|
|
27AF2321000
|
unkown
|
page read and write
|
|
|
|
7FF52FEC8000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D74000
|
unkown image
|
page readonly
|
|
|
|
2AF9000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BAF000
|
unkown
|
page read and write
|
|
|
|
9D0000
|
unkown image
|
page readonly
|
|
|
|
1A8C724E000
|
unkown
|
page read and write
|
|
|
|
2A6F000
|
unkown image
|
page readonly
|
|
|
|
7FF5075CE000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BD0000
|
unkown
|
page read and write
|
|
|
|
7FF54D388000
|
unkown image
|
page readonly
|
|
|
|
1A258F30000
|
unkown
|
page read and write
|
|
|
|
1A25888D000
|
unkown
|
page read and write
|
|
|
|
250CB380000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B87000
|
unkown
|
page read and write
|
|
|
|
E54EA7E000
|
unkown
|
page read and write
|
|
|
|
1A8C7B7C000
|
unkown
|
page read and write
|
|
|
|
1A8C7B84000
|
unkown
|
page read and write
|
|
|
|
1A8C7B97000
|
unkown
|
page read and write
|
|
|
|
7FF54D420000
|
unkown image
|
page readonly
|
|
|
|
7FC12000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF5C4000
|
unkown image
|
page readonly
|
|
|
|
3310000
|
unkown image
|
page readonly
|
|
|
|
250CAE29000
|
unkown
|
page read and write
|
|
|
|
7FF5076BA000
|
unkown image
|
page readonly
|
|
|
|
2DD0000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF660000
|
unkown image
|
page readonly
|
|
|
|
2B5F000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8CD4000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8CBF000
|
unkown image
|
page readonly
|
|
|
|
1A8C724A000
|
unkown
|
page read and write
|
|
|
|
7FF5B8BE3000
|
unkown image
|
page readonly
|
|
|
|
7FF54D4E8000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B80000
|
unkown
|
page read and write
|
|
|
|
7FF5B8B27000
|
unkown image
|
page readonly
|
|
|
|
28901C00000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BB9000
|
unkown
|
page read and write
|
|
|
|
250CAC60000
|
heap default
|
page read and write
|
|
|
|
1A8C7B84000
|
unkown
|
page read and write
|
|
|
|
7FCA0000
|
unkown image
|
page readonly
|
|
|
|
1A8C8003000
|
unkown
|
page read and write
|
|
|
|
7FF507623000
|
unkown image
|
page readonly
|
|
|
|
2B40000
|
unkown image
|
page readonly
|
|
|
|
28A5000
|
unkown image
|
page readonly
|
|
|
|
1A8C8063000
|
unkown
|
page read and write
|
|
|
|
2972000
|
unkown image
|
page readonly
|
|
|
|
7FF5AED88000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D09000
|
unkown image
|
page readonly
|
|
|
|
2E70000
|
unkown image
|
page readonly
|
|
|
|
7FF54D1F7000
|
unkown image
|
page readonly
|
|
|
|
773B77F000
|
unkown
|
page read and write
|
|
|
|
7FF5AF6BF000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8C95000
|
unkown image
|
page readonly
|
|
|
|
66C397B000
|
unkown
|
page read and write
|
|
|
|
2902000
|
unkown image
|
page readonly
|
|
|
|
7FCA2000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8C7C000
|
unkown image
|
page readonly
|
|
|
|
7FF52FE60000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B7C000
|
unkown
|
page read and write
|
|
|
|
7FF5AF65A000
|
unkown image
|
page readonly
|
|
|
|
7FF52FF4A000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8E000
|
unkown
|
page read and write
|
|
|
|
7FC00000
|
unkown image
|
page readonly
|
|
|
|
28901A4A000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
7DF5CDE12000
|
unkown image
|
page readonly
|
|
|
|
E54E3DE000
|
unkown
|
page read and write
|
|
|
|
1A8C7B84000
|
unkown
|
page read and write
|
|
|
|
7FF54D2D1000
|
unkown image
|
page readonly
|
|
|
|
2A5F000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B97000
|
unkown
|
page read and write
|
|
|
|
7FCA2000
|
unkown image
|
page readonly
|
|
|
|
3130000
|
heap default
|
page read and write
|
|
|
|
7FF507707000
|
unkown image
|
page readonly
|
|
|
|
7DF5CDE02000
|
unkown image
|
page readonly
|
|
|
|
2A6A000
|
unkown image
|
page readonly
|
|
|
|
7FF54D323000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D82000
|
unkown image
|
page readonly
|
|
|
|
2B25000
|
unkown image
|
page readonly
|
|
|
|
7FF54D383000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8B33000
|
unkown image
|
page readonly
|
|
|
|
66C3A7B000
|
unkown
|
page read and write
|
|
|
|
2ECC000
|
unkown
|
page read and write
|
|
|
|
1A8C7B9C000
|
unkown
|
page read and write
|
|
|
|
27AF22E0000
|
heap default
|
page read and write
|
|
|
|
1A8C8002000
|
unkown
|
page read and write
|
|
|
|
28F1000
|
unkown image
|
page readonly
|
|
|
|
290B000
|
unkown image
|
page readonly
|
|
|
|
3870000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF752000
|
unkown image
|
page readonly
|
|
|
|
2BD5000
|
unkown image
|
page readonly
|
|
|
|
2B03000
|
unkown image
|
page readonly
|
|
|
|
1A8C7250000
|
unkown
|
page read and write
|
|
|
|
2AFC000
|
unkown image
|
page readonly
|
|
|
|
2F70000
|
unkown
|
page read and write
|
|
|
|
1A8C7B84000
|
unkown
|
page read and write
|
|
|
|
7FF54D341000
|
unkown image
|
page readonly
|
|
|
|
1A8C806A000
|
unkown
|
page read and write
|
|
|
|
29E8000
|
unkown image
|
page readonly
|
|
|
|
2B71000
|
unkown image
|
page readonly
|
|
|
|
7FF50774D000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8C8A000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B75000
|
unkown
|
page read and write
|
|
|
|
2D6E8F7000
|
unkown
|
page read and write
|
|
|
|
28B3000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B85000
|
unkown
|
page read and write
|
|
|
|
1A8C7B6F000
|
unkown
|
page read and write
|
|
|
|
250CAE66000
|
unkown
|
page read and write
|
|
|
|
27AF2280000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8CBC000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BC8000
|
unkown
|
page read and write
|
|
|
|
7DF5C47F0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B84000
|
unkown
|
page read and write
|
|
|
|
7FF5077C2000
|
unkown image
|
page readonly
|
|
|
|
30E9000
|
unkown
|
page read and write
|
|
|
|
7FF54D4AC000
|
unkown image
|
page readonly
|
|
|
|
773AF1E000
|
unkown
|
page read and write
|
|
|
|
250CAE80000
|
unkown
|
page read and write
|
|
|
|
2BF8000
|
unkown image
|
page readonly
|
|
|
|
2A40000
|
unkown image
|
page readonly
|
|
|
|
B40000
|
heap default
|
page read and write
|
|
|
|
2F20000
|
unkown image
|
page readonly
|
|
|
|
7FF54D23B000
|
unkown image
|
page readonly
|
|
|
|
7FF52FEA4000
|
unkown image
|
page readonly
|
|
|
|
7FB00000
|
unkown image
|
page readonly
|
|
|
|
7FF54D046000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8865000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8B71000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D06000
|
unkown image
|
page readonly
|
|
|
|
2AD1000
|
unkown image
|
page readonly
|
|
|
|
303B000
|
unkown
|
page read and write
|
|
|
|
2A57000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
7FF5B8D7A000
|
unkown image
|
page readonly
|
|
|
|
7FF50761D000
|
unkown image
|
page readonly
|
|
|
|
1A258AD0000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8B8E000
|
unkown image
|
page readonly
|
|
|
|
1A8C7253000
|
unkown
|
page read and write
|
|
|
|
7FF507738000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF744000
|
unkown image
|
page readonly
|
|
|
|
1A2587D0000
|
heap default
|
page read and write
|
|
|
|
1A8C72AF000
|
unkown
|
page read and write
|
|
|
|
250CAC10000
|
unkown image
|
page readonly
|
|
|
|
250CAE7E000
|
unkown
|
page read and write
|
|
|
|
E54E977000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
7FF5AF6D9000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B81000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8A000
|
unkown
|
page read and write
|
|
|
|
2A3C000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B7E000
|
unkown
|
page read and write
|
|
|
|
2978000
|
unkown image
|
page readonly
|
|
|
|
2A8B000
|
unkown image
|
page readonly
|
|
|
|
7FF54D45F000
|
unkown image
|
page readonly
|
|
|
|
1A8C7302000
|
unkown
|
page read and write
|
|
|
|
7DF5CDE20000
|
unkown image
|
page readonly
|
|
|
|
7FF54D47A000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
1A8C7B86000
|
unkown
|
page read and write
|
|
|
|
7FF54D480000
|
unkown image
|
page readonly
|
|
|
|
7FF5076D5000
|
unkown image
|
page readonly
|
|
|
|
1A258770000
|
heap private
|
page read and write
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
66C3B77000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
7FF5076BC000
|
unkown image
|
page readonly
|
|
|
|
7FF507567000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF5AD000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B80000
|
unkown
|
page read and write
|
|
|
|
1A8C70D0000
|
unkown image
|
page readonly
|
|
|
|
7FF54CBA8000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF226000
|
unkown image
|
page readonly
|
|
|
|
7DF51C860000
|
unkown image
|
page readonly
|
|
|
|
7FF54D3D3000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B95000
|
unkown
|
page read and write
|
|
|
|
1A25884F000
|
unkown
|
page read and write
|
|
|
|
7FF54CFEE000
|
unkown image
|
page readonly
|
|
|
|
288A000
|
unkown image
|
page readonly
|
|
|
|
7FF507521000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF6DD000
|
unkown image
|
page readonly
|
|
|
|
1A8C72BF000
|
unkown
|
page read and write
|
|
|
|
7FF52FEDD000
|
unkown image
|
page readonly
|
|
|
|
1A2587E0000
|
unkown image
|
page readonly
|
|
|
|
773B37E000
|
unkown
|
page read and write
|
|
|
|
7FF5AF5CC000
|
unkown image
|
page readonly
|
|
|
|
1A8C7316000
|
unkown
|
page read and write
|
|
|
|
1A8C7920000
|
unkown
|
page read and write
|
|
|
|
3120000
|
heap private
|
page read and write
|
|
|
|
7FF5AF74A000
|
unkown image
|
page readonly
|
|
|
|
7FF54D3E4000
|
unkown image
|
page readonly
|
|
|
|
7FF52FF44000
|
unkown image
|
page readonly
|
|
|
|
7FF54CFE2000
|
unkown image
|
page readonly
|
|
|
|
7FF54D32A000
|
unkown image
|
page readonly
|
|
|
|
2D6EBFA000
|
unkown
|
page read and write
|
|
|
|
7FF507749000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B83000
|
unkown
|
page read and write
|
|
|
|
7FF54D280000
|
unkown image
|
page readonly
|
|
|
|
30ED000
|
unkown
|
page read and write
|
|
|
|
773B67F000
|
unkown
|
page read and write
|
|
|
|
1A258E50000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8BF4000
|
unkown image
|
page readonly
|
|
|
|
7FF54CDD7000
|
unkown image
|
page readonly
|
|
|
|
1A8C72EA000
|
unkown
|
page read and write
|
|
|
|
7DF562610000
|
unkown image
|
page readonly
|
|
|
|
2B03000
|
unkown image
|
page readonly
|
|
|
|
1A258853000
|
unkown
|
page read and write
|
|
|
|
27AF2210000
|
unkown image
|
page readonly
|
|
|
|
7DF5CDE02000
|
unkown image
|
page readonly
|
|
|
|
1A8C7A02000
|
unkown
|
page read and write
|
|
|
|
7DF51C842000
|
unkown image
|
page readonly
|
|
|
|
1A8C7281000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8A000
|
unkown
|
page read and write
|
|
|
|
2D70000
|
unkown image
|
page readonly
|
|
|
|
1A8C7259000
|
unkown
|
page read and write
|
|
|
|
7FF52F7B3000
|
unkown image
|
page readonly
|
|
|
|
2B2C000
|
unkown image
|
page readonly
|
|
|
|
1A8C70B0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BA9000
|
unkown
|
page read and write
|
|
|
|
7FF72000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF64C000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B81000
|
unkown
|
page read and write
|
|
|
|
27AF2615000
|
heap private
|
page read and write
|
|
|
|
7FF82000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BC8000
|
unkown
|
page read and write
|
|
|
|
28901A55000
|
unkown
|
page read and write
|
|
|
|
30E0000
|
heap private
|
page read and write
|
|
|
|
1A8C7B7A000
|
unkown
|
page read and write
|
|
|
|
2800000
|
unkown image
|
page readonly
|
|
|
|
2C03000
|
unkown image
|
page readonly
|
|
|
|
1A258908000
|
unkown
|
page read and write
|
|
|
|
1A8C7249000
|
unkown
|
page read and write
|
|
|
|
7DF5625F2000
|
unkown image
|
page readonly
|
|
|
|
3140000
|
heap default
|
page read and write
|
|
|
|
7FF54D2B4000
|
unkown image
|
page readonly
|
|
|
|
7FF54D097000
|
unkown image
|
page readonly
|
|
|
|
7FF506DF2000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8B8B000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B84000
|
unkown
|
page read and write
|
|
|
|
1A8C7930000
|
unkown image
|
page read and write
|
|
|
|
7FF50771A000
|
unkown image
|
page readonly
|
|
|
|
7FF5076FF000
|
unkown image
|
page readonly
|
|
|
|
7DF5C47E0000
|
unkown image
|
page readonly
|
|
|
|
E54E87F000
|
unkown
|
page read and write
|
|
|
|
7FF5B8CC7000
|
unkown image
|
page readonly
|
|
|
|
1A8C724B000
|
unkown
|
page read and write
|
|
|
|
1A258802000
|
unkown
|
page read and write
|
|
|
|
1A8C7600000
|
unkown image
|
page readonly
|
|
|
|
7FC02000
|
unkown image
|
page readonly
|
|
|
|
3390000
|
heap private
|
page read and write
|
|
|
|
1A8C7B76000
|
unkown
|
page read and write
|
|
|
|
1A8C7B72000
|
unkown
|
page read and write
|
|
|
|
2A33000
|
unkown image
|
page readonly
|
|
|
|
2AF8000
|
unkown image
|
page readonly
|
|
|
|
7FF507714000
|
unkown image
|
page readonly
|
|
|
|
3480000
|
heap private
|
page read and write
|
|
|
|
250CAE8B000
|
unkown
|
page read and write
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
250CAC40000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF4F7000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B86000
|
unkown
|
page read and write
|
|
|
|
3330000
|
unkown image
|
page readonly
|
|
|
|
2B3C000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B7C000
|
unkown
|
page read and write
|
|
|
|
7FF507634000
|
unkown image
|
page readonly
|
|
|
|
27AF2305000
|
unkown
|
page read and write
|
|
|
|
1A258780000
|
unkown image
|
page readonly
|
|
|
|
27AF21F0000
|
unkown image
|
page readonly
|
|
|
|
FF4C39A000
|
unkown
|
page read and write
|
|
|
|
1A8C7B6C000
|
unkown
|
page read and write
|
|
|
|
2A71000
|
unkown image
|
page readonly
|
|
|
|
1A8C7400000
|
unkown image
|
page readonly
|
|
|
|
7FF80000
|
unkown image
|
page readonly
|
|
|
|
2964000
|
unkown image
|
page readonly
|
|
|
|
1A8C70B0000
|
unkown image
|
page readonly
|
|
|
|
7FF54D246000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
7FF54D46C000
|
unkown image
|
page readonly
|
|
|
|
2B5D000
|
unkown image
|
page readonly
|
|
|
|
7DF51C842000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B7E000
|
unkown
|
page read and write
|
|
|
|
1A8C71E0000
|
unkown image
|
page readonly
|
|
|
|
2A2C000
|
unkown image
|
page readonly
|
|
|
|
28BC000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B7A000
|
unkown
|
page read and write
|
|
|
|
1A8C7BBB000
|
unkown
|
page read and write
|
|
|
|
7FF54D4C4000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B73000
|
unkown
|
page read and write
|
|
|
|
1A8C7090000
|
unkown image
|
page read and write
|
|
|
|
28901A13000
|
unkown
|
page read and write
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
2879000
|
unkown image
|
page readonly
|
|
|
|
AF0000
|
unkown image
|
page readonly
|
|
|
|
1A258800000
|
unkown
|
page read and write
|
|
|
|
28902202000
|
unkown
|
page read and write
|
|
|
|
7FF54D4DF000
|
unkown image
|
page readonly
|
|
|
|
7DF5C47D2000
|
unkown image
|
page readonly
|
|
|
|
7FF72000
|
unkown image
|
page readonly
|
|
|
|
FF4C67F000
|
unkown
|
page read and write
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
1A8C724F000
|
unkown
|
page read and write
|
|
|
|
1A8C7B75000
|
unkown
|
page read and write
|
|
|
|
7FF54D4CA000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B86000
|
unkown
|
page read and write
|
|
|
|
1A8C7B85000
|
unkown
|
page read and write
|
|
|
|
2906000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BD6000
|
unkown
|
page read and write
|
|
|
|
7FF5B8AE1000
|
unkown image
|
page readonly
|
|
|
|
2580000
|
unkown image
|
page readonly
|
|
|
|
28901A02000
|
unkown
|
page read and write
|
|
|
|
27AF21D0000
|
unkown image
|
page read and write
|
|
|
|
7FF54D4F9000
|
unkown image
|
page readonly
|
|
|
|
7FF52FECE000
|
unkown image
|
page readonly
|
|
|
|
1A8C72A5000
|
unkown
|
page read and write
|
|
|
|
7FC20000
|
unkown image
|
page readonly
|
|
|
|
A70000
|
unkown image
|
page readonly
|
|
|
|
7FF5076CE000
|
unkown image
|
page readonly
|
|
|
|
29F9000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B95000
|
unkown
|
page read and write
|
|
|
|
28902080000
|
unkown
|
page read and write
|
|
|
|
7FF54D4B7000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D0D000
|
unkown image
|
page readonly
|
|
|
|
773B2FB000
|
unkown
|
page read and write
|
|
|
|
1A8C7BCD000
|
unkown
|
page read and write
|
|
|
|
7FF54D361000
|
unkown image
|
page readonly
|
|
|
|
7FF5076DB000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B5A000
|
unkown
|
page read and write
|
|
|
|
FF4C779000
|
unkown
|
page read and write
|
|
|
|
1A8C7BA6000
|
unkown
|
page read and write
|
|
|
|
7FF82000
|
unkown image
|
page readonly
|
|
|
|
66C35AF000
|
unkown
|
page read and write
|
|
|
|
2D70000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
2D6E32E000
|
unkown
|
page read and write
|
|
|
|
7DF544FE0000
|
unkown image
|
page readonly
|
|
|
|
7FF507296000
|
unkown image
|
page readonly
|
|
|
|
2983000
|
unkown image
|
page readonly
|
|
|
|
7FF5AED82000
|
unkown image
|
page readonly
|
|
|
|
7FF54D44B000
|
unkown image
|
page readonly
|
|
|
|
250CABF0000
|
unkown image
|
page read and write
|
|
|
|
1A8C7B7F000
|
unkown
|
page read and write
|
|
|
|
2AE8000
|
unkown image
|
page readonly
|
|
|
|
FF4C8FC000
|
unkown
|
page read and write
|
|
|
|
289018D0000
|
unkown image
|
page readonly
|
|
|
|
28901A7E000
|
unkown
|
page read and write
|
|
|
|
1A8C723C000
|
unkown
|
page read and write
|
|
|
|
1A8C7B95000
|
unkown
|
page read and write
|
|
|
|
7FF507447000
|
unkown image
|
page readonly
|
|
|
|
1A258851000
|
unkown
|
page read and write
|
|
|
|
28901900000
|
unkown image
|
page readonly
|
|
|
|
7FF52FE8F000
|
unkown image
|
page readonly
|
|
|
|
7DF5C47E2000
|
unkown image
|
page readonly
|
|
|
|
7FF54D4AF000
|
unkown image
|
page readonly
|
|
|
|
7DF562602000
|
unkown image
|
page readonly
|
|
|
|
7DF5C47F0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B97000
|
unkown
|
page read and write
|
|
|
|
7FF5AF521000
|
unkown image
|
page readonly
|
|
|
|
2E88000
|
unkown
|
page read and write
|
|
|
|
34D0000
|
heap private
|
page read and write
|
|
|
|
28901A8A000
|
unkown
|
page read and write
|
|
|
|
3570000
|
heap default
|
page read and write
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
7FF5AF55B000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BA2000
|
unkown
|
page read and write
|
|
|
|
7DF5CDE00000
|
unkown image
|
page readonly
|
|
|
|
7FC00000
|
unkown image
|
page readonly
|
|
|
|
2D6E2AB000
|
unkown
|
page read and write
|
|
|
|
FF4C87F000
|
unkown
|
page read and write
|
|
|
|
1A8C7BCC000
|
unkown
|
page read and write
|
|
|
|
7FF5AF697000
|
unkown image
|
page readonly
|
|
|
|
2F90000
|
unkown image
|
page readonly
|
|
|
|
2A03000
|
unkown image
|
page readonly
|
|
|
|
A6B000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
28901A4D000
|
unkown
|
page read and write
|
|
|
|
2B6A000
|
unkown image
|
page readonly
|
|
|
|
7FF5076CA000
|
unkown image
|
page readonly
|
|
|
|
2D6ECFE000
|
unkown
|
page read and write
|
|
|
|
2A0A000
|
unkown image
|
page readonly
|
|
|
|
1A259002000
|
unkown
|
page read and write
|
|
|
|
2A5D000
|
unkown image
|
page readonly
|
|
|
|
773AE9B000
|
unkown
|
page read and write
|
|
|
|
28C0000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF65E000
|
unkown image
|
page readonly
|
|
|
|
3670000
|
unkown image
|
page readonly
|
|
|
|
2B82000
|
unkown image
|
page readonly
|
|
|
|
7DF5CDE12000
|
unkown image
|
page readonly
|
|
|
|
28901A3C000
|
unkown
|
page read and write
|
|
|
|
66C387E000
|
unkown
|
page read and write
|
|
|
|
2D62000
|
unkown
|
page read and write
|
|
|
|
7FF5B8CDA000
|
unkown image
|
page readonly
|
|
|
|
7FF70000
|
unkown image
|
page readonly
|
|
|
|
1A258900000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
E54E7FB000
|
unkown
|
page read and write
|
|
|
|
1A8C7B86000
|
unkown
|
page read and write
|
|
|
|
7FF507591000
|
unkown image
|
page readonly
|
|
|
|
27AF2820000
|
unkown image
|
page readonly
|
|
|
|
3070000
|
unkown
|
page read and write
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
1A8C7B7C000
|
unkown
|
page read and write
|
|
|
|
28901B08000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8A000
|
unkown
|
page read and write
|
|
|
|
2D6E3AE000
|
unkown
|
page read and write
|
|
|
|
27AF2620000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
250CAF02000
|
unkown
|
page read and write
|
|
|
|
7FF90000
|
unkown image
|
page readonly
|
|
|
|
7FF5075CB000
|
unkown image
|
page readonly
|
|
|
|
2D6E7FB000
|
unkown
|
page read and write
|
|
|
|
1A8C7B55000
|
unkown
|
page read and write
|
|
|
|
2B86000
|
unkown image
|
page readonly
|
|
|
|
7FF54D497000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
3490000
|
unkown image
|
page readonly
|
|
|
|
28901A65000
|
unkown
|
page read and write
|
|
|
|
7FF5B8BDD000
|
unkown image
|
page readonly
|
|
|
|
7DF562602000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BB7000
|
unkown
|
page read and write
|
|
|
|
27AF2306000
|
unkown
|
page read and write
|
|
|
|
250CAE54000
|
unkown
|
page read and write
|
|
|
|
1A8C70A0000
|
heap private
|
page read and write
|
|
|
|
7FF52FE6B000
|
unkown image
|
page readonly
|
|
|
|
1A8C726F000
|
unkown
|
page read and write
|
|
|
|
27AF2322000
|
unkown
|
page read and write
|
|
|
|
7FF54D055000
|
unkown image
|
page readonly
|
|
|
|
7FF54D422000
|
unkown image
|
page readonly
|
|
|
|
28DD000
|
unkown image
|
page readonly
|
|
|
|
4C10000
|
heap private
|
page read and write
|
|
|
|
7DF544FD2000
|
unkown image
|
page readonly
|
|
|
|
2A86000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B9E000
|
unkown
|
page read and write
|
|
|
|
7DF544FE2000
|
unkown image
|
page readonly
|
|
|
|
250CAF08000
|
unkown
|
page read and write
|
|
|
|
1A8C7B80000
|
unkown
|
page read and write
|
|
|
|
28901B00000
|
unkown
|
page read and write
|
|
|
|
28901A6F000
|
unkown
|
page read and write
|
|
|
|
7FF507724000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8856000
|
unkown image
|
page readonly
|
|
|
|
28901F90000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B96000
|
unkown
|
page read and write
|
|
|
|
1A8C724D000
|
unkown
|
page read and write
|
|
|
|
3090000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BA8000
|
unkown
|
page read and write
|
|
|
|
7FF5B8C7A000
|
unkown image
|
page readonly
|
|
|
|
7FF5077B4000
|
unkown image
|
page readonly
|
|
|
|
1A8C78B0000
|
unkown image
|
page write copy
|
|
|
|
7FF5B8C9B000
|
unkown image
|
page readonly
|
|
|
|
250CB602000
|
unkown
|
page read and write
|
|
|
|
1A8C7B15000
|
unkown
|
page read and write
|
|
|
|
2A82000
|
unkown image
|
page readonly
|
|
|
|
7DF51C840000
|
unkown image
|
page readonly
|
|
|
|
28901A00000
|
unkown
|
page read and write
|
|
|
|
7DF5CDE00000
|
unkown image
|
page readonly
|
|
|
|
7FF54D56A000
|
unkown image
|
page readonly
|
|
|
|
7FF54D2C1000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
250CB200000
|
unkown image
|
page readonly
|
|
|
|
27AF2230000
|
unkown
|
page read and write
|
|
|
|
7FF54CF5E000
|
unkown image
|
page readonly
|
|
|
|
1A258881000
|
unkown
|
page read and write
|
|
|
|
1A258813000
|
unkown
|
page read and write
|
|
|
|
E54E35D000
|
unkown
|
page read and write
|
|
|
|
28901E00000
|
unkown image
|
page readonly
|
|
|
|
7FF54CDD3000
|
unkown image
|
page readonly
|
|
|
|
7DF51C852000
|
unkown image
|
page readonly
|
|
|
|
2E60000
|
unkown image
|
page read and write
|
|
|
|
34E0000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF6D6000
|
unkown image
|
page readonly
|
|
|
|
1A8C7780000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B78000
|
unkown
|
page read and write
|
|
|
|
1A8C7100000
|
heap default
|
page read and write
|
|
|
|
1A25884A000
|
unkown
|
page read and write
|
|
|
|
250CB000000
|
unkown image
|
page readonly
|
|
|
|
1A258825000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
27AF231B000
|
unkown
|
page read and write
|
|
|
|
7FF5B8C8E000
|
unkown image
|
page readonly
|
|
|
|
7FF52FE8C000
|
unkown image
|
page readonly
|
|
|
|
7DF562610000
|
unkown image
|
page readonly
|
|
|
|
7FF507746000
|
unkown image
|
page readonly
|
|
|
|
2D66000
|
unkown
|
page read and write
|
|
|
|
7FCB0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
1A8C7B7E000
|
unkown
|
page read and write
|
|
|
|
27AF230F000
|
unkown
|
page read and write
|
|
|
|
2DE0000
|
unkown image
|
page readonly
|
|
|
|
1A258780000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8D81000
|
unkown image
|
page readonly
|
|
|
|
1A8C72E0000
|
unkown
|
page read and write
|
|
|
|
7FF5AF3D7000
|
unkown image
|
page readonly
|
|
|
|
9D0000
|
unkown image
|
page readonly
|
|
|
|
7DF5C47D0000
|
unkown image
|
page readonly
|
|
|
|
7FCB2000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B80000
|
unkown
|
page read and write
|
|
|
|
7FF54D44F000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8CEF000
|
unkown image
|
page readonly
|
|
|
|
28E3000
|
unkown image
|
page readonly
|
|
|
|
1A8C801D000
|
unkown
|
page read and write
|
|
|
|
7FF54D37E000
|
unkown image
|
page readonly
|
|
|
|
28901E10000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BA6000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8B000
|
unkown
|
page read and write
|
|
|
|
7DF51C850000
|
unkown image
|
page readonly
|
|
|
|
1A8C72E5000
|
unkown
|
page read and write
|
|
|
|
1A8C7B45000
|
unkown
|
page read and write
|
|
|
|
7FF52FE98000
|
unkown image
|
page readonly
|
|
|
|
FF4C6FF000
|
unkown
|
page read and write
|
|
|
|
1A8C7B7E000
|
unkown
|
page read and write
|
|
|
|
29FC000
|
unkown image
|
page readonly
|
|
|
|
FF4C7FA000
|
unkown
|
page read and write
|
|
|
|
7DF544FD0000
|
unkown image
|
page readonly
|
|
|
|
2B55000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
7FF52FE65000
|
unkown image
|
page readonly
|
|
|
|
1A2587A0000
|
unkown image
|
page readonly
|
|
|
|
7DF51C850000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B84000
|
unkown
|
page read and write
|
|
|
|
1A8C70E0000
|
unkown image
|
page readonly
|
|
|
|
7FCA0000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF6CE000
|
unkown image
|
page readonly
|
|
|
|
28D5000
|
unkown image
|
page readonly
|
|
|
|
7DF5CDE10000
|
unkown image
|
page readonly
|
|
|
|
1A25883C000
|
unkown
|
page read and write
|
|
|
|
7FF5AF235000
|
unkown image
|
page readonly
|
|
|
|
7DF544FF0000
|
unkown image
|
page readonly
|
|
|
|
27AF230F000
|
unkown
|
page read and write
|
|
|
|
7DF5C47E0000
|
unkown image
|
page readonly
|
|
|
|
7FF54D200000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B78000
|
unkown
|
page read and write
|
|
|
|
7FF54D571000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF6C8000
|
unkown image
|
page readonly
|
|
|
|
7FF50773E000
|
unkown image
|
page readonly
|
|
|
|
7FF506DF8000
|
unkown image
|
page readonly
|
|
|
|
A80000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B7D000
|
unkown
|
page read and write
|
|
|
|
7FF5077BA000
|
unkown image
|
page readonly
|
|
|
|
1A8C7920000
|
unkown
|
page read and write
|
|
|
|
7FBA0000
|
unkown image
|
page readonly
|
|
|
|
7DF4C26A0000
|
unkown image
|
page readonly
|
|
|
|
2A55000
|
unkown image
|
page readonly
|
|
|
|
7FF54D47E000
|
unkown image
|
page readonly
|
|
|
|
28901A2A000
|
unkown
|
page read and write
|
|
|
|
250CAE3C000
|
unkown
|
page read and write
|
|
|
|
357A000
|
heap default
|
page read and write
|
|
|
|
7FF5AF6A4000
|
unkown image
|
page readonly
|
|
|
|
2D6EAFA000
|
unkown
|
page read and write
|
|
|
|
2E5A000
|
heap default
|
page read and write
|
|
|
|
7FF54D4F6000
|
unkown image
|
page readonly
|
|
|
|
33A0000
|
heap default
|
page read and write
|
|
|
|
7FF54D2B6000
|
unkown image
|
page readonly
|
|
|
|
7FCC0000
|
unkown image
|
page readonly
|
|
|
|
1A8C8002000
|
unkown
|
page read and write
|
|
|
|
1A8C7229000
|
unkown
|
page read and write
|
|
|
|
7FF54CD82000
|
unkown image
|
page readonly
|
|
|
|
7FF5B8850000
|
unkown image
|
page readonly
|
|
|
|
7DF4604C0000
|
unkown image
|
page readonly
|
|
|
|
7FF54D4D4000
|
unkown image
|
page readonly
|
|
|
|
7FF54CFF2000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B86000
|
unkown
|
page read and write
|
|
|
|
773AF9E000
|
unkown
|
page read and write
|
|
|
|
7FF70000
|
unkown image
|
page readonly
|
|
|
|
7FE70000
|
unkown image
|
page readonly
|
|
|
|
2B57000
|
unkown image
|
page readonly
|
|
|
|
7DF5C47D0000
|
unkown image
|
page readonly
|
|
|
|
1A8C8002000
|
unkown
|
page read and write
|
|
|
|
2B8B000
|
unkown image
|
page readonly
|
|
|
|
250CAF13000
|
unkown
|
page read and write
|
|
|
|
2B63000
|
unkown image
|
page readonly
|
|
|
|
7FF54D572000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B7E000
|
unkown
|
page read and write
|
|
|
|
1A8C7B78000
|
unkown
|
page read and write
|
|
|
|
1A8C8000000
|
unkown
|
page read and write
|
|
|
|
1A8C7B47000
|
unkown
|
page read and write
|
|
|
|
7FF5AF68F000
|
unkown image
|
page readonly
|
|
|
|
2F10000
|
unkown image
|
page readonly
|
|
|
|
7FF54CBA2000
|
unkown image
|
page readonly
|
|
|
|
E54EB7F000
|
unkown
|
page read and write
|
|
|
|
7FF52FF52000
|
unkown image
|
page readonly
|
|
|
|
7FF52FBE0000
|
unkown image
|
page readonly
|
|
|
|
7FF54D564000
|
unkown image
|
page readonly
|
|
|
|
27AF29A0000
|
unkown image
|
page readonly
|
|
|
|
A2C000
|
unkown
|
page read and write
|
|
|
|
2AD5000
|
unkown image
|
page readonly
|
|
|
|
1A8C7880000
|
unkown image
|
page readonly
|
|
|
|
E54E2DC000
|
unkown
|
page read and write
|
|
|
|
1A8C7B8D000
|
unkown
|
page read and write
|
|
|
|
7DF51C860000
|
unkown image
|
page readonly
|
|
|
|
7FF54D485000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF503000
|
unkown image
|
page readonly
|
|
|
|
7FF54D317000
|
unkown image
|
page readonly
|
|
|
|
250CAC30000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B89000
|
unkown
|
page read and write
|
|
|
|
2DCC000
|
unkown
|
page read and write
|
|
|
|
1A8C72F8000
|
unkown
|
page read and write
|
|
|
|
7FF5AF677000
|
unkown image
|
page readonly
|
|
|
|
27AF230F000
|
unkown
|
page read and write
|
|
|
|
7FF52FEB4000
|
unkown image
|
page readonly
|
|
|
|
28D7000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BC8000
|
unkown
|
page read and write
|
|
|
|
7FF5AF665000
|
unkown image
|
page readonly
|
|
|
|
250CAE7E000
|
unkown
|
page read and write
|
|
|
|
28901B13000
|
unkown
|
page read and write
|
|
|
|
7DF5CDE20000
|
unkown image
|
page readonly
|
|
|
|
27AF22F6000
|
heap default
|
page read and write
|
|
|
|
1A8C7B7E000
|
unkown
|
page read and write
|
|
|
|
1A8C7B72000
|
unkown
|
page read and write
|
|
|
|
2B49000
|
unkown image
|
page readonly
|
|
|
|
1A8C72C6000
|
unkown
|
page read and write
|
|
|
|
250CAD60000
|
unkown
|
page read and write
|
|
|
|
7FF5B8CFE000
|
unkown image
|
page readonly
|
|
|
|
28901A65000
|
unkown
|
page read and write
|
|
|
|
1A8C7B97000
|
unkown
|
page read and write
|
|
|
|
28AC000
|
unkown image
|
page readonly
|
|
|
|
28901920000
|
heap default
|
page read and write
|
|
|
|
773B577000
|
unkown
|
page read and write
|
|
|
|
1A8C72E8000
|
unkown
|
page read and write
|
|
|
|
7DF544FD0000
|
unkown image
|
page readonly
|
|
|
|
7DF544FE0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B00000
|
unkown
|
page read and write
|
|
|
|
7FF5AF220000
|
unkown image
|
page readonly
|
|
|
|
7DF5CDE10000
|
unkown image
|
page readonly
|
|
|
|
250CAE13000
|
unkown
|
page read and write
|
|
|
|
1A8C7B6C000
|
unkown
|
page read and write
|
|
|
|
2A63000
|
unkown image
|
page readonly
|
|
|
|
773B47B000
|
unkown
|
page read and write
|
|
|
|
250CAE00000
|
unkown
|
page read and write
|
|
|
|
7FCB0000
|
unkown image
|
page readonly
|
|
|
|
1A8C7BD8000
|
unkown
|
page read and write
|
|
|
|
2D6E6FB000
|
unkown
|
page read and write
|
|
|
|
28C9000
|
unkown image
|
page readonly
|
|
|
|
7DF5C47D2000
|
unkown image
|
page readonly
|
|
|
|
1A8C7860000
|
unkown
|
page read and write
|
|
|
|
7FF5B8C90000
|
unkown image
|
page readonly
|
|
|
|
7FF5AF66B000
|
unkown image
|
page readonly
|
|
|
|
1A8C7B8F000
|
unkown
|
page read and write
|
|
|
|
1A8C7B84000
|
unkown
|
page read and write
|
|
|
|
7FF54D46A000
|
unkown image
|
page readonly
|
|
There are 802 hidden memdumps, click here to show them.