IOC Report
DHL_AWB.docx

loading gif

Files

File Path
Type
Category
Malicious
DHL_AWB.docx
Microsoft Word 2007+
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\vbc[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
downloaded
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\doc_200[1].doc
data
downloaded
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\694BA9C1.doc
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{61C0FE69-632E-42B0-9EAB-CB8720AB2605}.tmp
Composite Document File V2 Document, Cannot read section info
dropped
 malicious
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{32AF6775-ED8D-404B-A66E-CD25BD6BBD8D}.FSD
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{F4637C4C-84C5-48D5-B5F6-DBF781800F91}.FSD
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\125384CE.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4C4AC313.png
PNG image data, 731 x 704, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\67C004A6.png
PNG image data, 731 x 704, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{88266991-B66B-4B67-A090-087BD104DE9E}.tmp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8E9606C5-2F7B-41CF-A346-056DD4AB9308}.tmp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{ADD09414-4C0B-48D8-B1C9-FBE697880796}.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\{3AB18AF9-D831-436F-81B4-5DCFDD3A591A}
data
dropped
C:\Users\user\AppData\Local\Temp\{4820A152-87F7-4CDD-BC04-BD9F9E14497A}
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\DHL_AWB.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:45:53 2022, mtime=Tue Mar 8 15:45:53 2022, atime=Fri Aug 5 22:36:11 2022, length=73762, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\doc_200.doc.url
MS Windows 95 Internet shortcut text (URL=<http://198.23.207.54/shp/doc_200.doc>), ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\shp on 198.23.207.54.url
MS Windows 95 Internet shortcut text (URL=<http://198.23.207.54/shp/>), ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
C:\Users\user\Desktop\~$HL_AWB.docx
data
dropped
There are 16 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
 malicious
C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
malicious
C:\Users\Public\vbc.exe
C:\Users\Public\vbc.exe
 malicious
C:\Users\Public\vbc.exe
C:\Users\Public\vbc.exe
 malicious
C:\Users\Public\vbc.exe
C:\Users\Public\vbc.exe
 malicious
C:\Users\Public\vbc.exe
C:\Users\Public\vbc.exe
 malicious
C:\Users\Public\vbc.exe
C:\Users\Public\vbc.exe
 malicious
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding

URLs

Name
IP
Malicious
http://198.23.207.54/shp/doc_200.doc
198.23.207.54
 malicious
http://198.23.207.54/200/vbc.exe
198.23.207.54
 malicious
http://198.23.207.54/shp/
unknown
 malicious
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
unknown
http://198.23.207.54/200/vbc.exehhC:
unknown
http://198.23.207.54/200/vbc.exej
unknown
https://api.telegram.org/bot1900392974:AAEB_yGGlWksNcNC4Dg08OgUSlmDON2w098/
unknown

IPs

IP
Domain
Country
Malicious
198.23.207.54
unknown
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
-}+
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
% +
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
'a+
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache
Version
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache
Count
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://198.23.207.54/shp/
Type
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://198.23.207.54/shp/
Protocol
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://198.23.207.54/shp/
Version
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://198.23.207.54/shp/
Flags
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://198.23.207.54/shp/
CobaltMajorVersion
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://198.23.207.54/shp/
CobaltMinorVersion
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://198.23.207.54/shp/
MsDavExt
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://198.23.207.54/shp/
Expiration
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet\Server Cache\http://198.23.207.54/shp/
EnableBHO
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
l)+
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\6B876
6B876
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Arial Unicode MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Batang
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@BatangChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@DFKai-SB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Dotum
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@DotumChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@FangSong
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Gulim
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@GulimChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Gungsuh
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@GungsuhChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@KaiTi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Malgun Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Meiryo
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Meiryo UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Microsoft JhengHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@Microsoft YaHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU_HKSCS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU_HKSCS-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS Mincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS PGothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS PMincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@MS UI Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@NSimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@PMingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@PMingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@SimHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@SimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
@SimSun-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Agency FB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Aharoni
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Algerian
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Andalus
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Angsana New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
AngsanaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Aparajita
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arabic Typesetting
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Black
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Narrow
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Rounded MT Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Arial Unicode MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Baskerville Old Face
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Batang
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
BatangChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bauhaus 93
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bell MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Berlin Sans FB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Berlin Sans FB Demi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bernard MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Blackadder ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT Black
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bodoni MT Poster Compressed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Book Antiqua
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bookman Old Style
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bookshelf Symbol 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Bradley Hand ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Britannic Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Broadway
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Browallia New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
BrowalliaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Brush Script MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Calibri
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Calibri Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Californian FB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Calisto MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cambria
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cambria Math
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Candara
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Castellar
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Centaur
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Century
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Century Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Century Schoolbook
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Chiller
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Colonna MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Comic Sans MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Consolas
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Constantia
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cooper Black
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Copperplate Gothic Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Copperplate Gothic Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Corbel
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Cordia New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
CordiaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Courier New
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Curlz MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DaunPenh
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
David
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DFKai-SB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DilleniaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DokChampa
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Dotum
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
DotumChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Ebrima
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Edwardian Script ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Elephant
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Engravers MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Bold ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Demi ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Light ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Eras Medium ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Estrangelo Edessa
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
EucrosiaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Euphemia
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
FangSong
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Felix Titling
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Footlight MT Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Forte
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Book
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Demi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Demi Cond
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Heavy
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Medium
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Franklin Gothic Medium Cond
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
FrankRuehl
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
FreesiaUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Freestyle Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
French Script MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gabriola
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Garamond
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gautami
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Georgia
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gigi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans MT Ext Condensed Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans Ultra Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gill Sans Ultra Bold Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gisha
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gloucester MT Extra Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Goudy Old Style
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Goudy Stout
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gulim
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
GulimChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Gungsuh
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
GungsuhChe
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Haettenschweiler
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Harlow Solid Italic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Harrington
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
High Tower Text
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Impact
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Imprint MT Shadow
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Informal Roman
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
IrisUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Iskoola Pota
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
JasmineUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Jokerman
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Juice ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
KaiTi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kalinga
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kartika
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Khmer UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
KodchiangUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kokila
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kristen ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Kunstler Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lao UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Latha
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Leelawadee
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Levenim MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
LilyUPC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Bright
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Calligraphy
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Console
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Fax
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Handwriting
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Sans
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Sans Typewriter
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Lucida Sans Unicode
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Magneto
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Maiandra GD
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Malgun Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Mangal
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Marlett
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Matura MT Script Capitals
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Meiryo
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Meiryo UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Himalaya
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft JhengHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft New Tai Lue
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft PhagsPa
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Sans Serif
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Tai Le
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Uighur
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft YaHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Microsoft Yi Baiti
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU_HKSCS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU_HKSCS-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Miriam
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Miriam Fixed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Mistral
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Modern No. 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Mongolian Baiti
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Monotype Corsiva
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MoolBoran
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Mincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS PGothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS PMincho
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Reference Sans Serif
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS Reference Specialty
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MS UI Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MT Extra
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
MV Boli
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Narkisim
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Niagara Engraved
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Niagara Solid
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
NSimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Nyala
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
OCR A Extended
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Old English Text MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Onyx
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Palace Script MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Palatino Linotype
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Papyrus
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Parchment
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Perpetua
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Perpetua Titling MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Plantagenet Cherokee
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Playbill
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
PMingLiU
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
PMingLiU-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Poor Richard
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Pristina
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Raavi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rage Italic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Ravie
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rockwell
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rockwell Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rockwell Extra Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Rod
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Sakkal Majalla
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Script MT Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe Print
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI Light
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI Semibold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Segoe UI Symbol
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Shonar Bangla
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Showcard Gothic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Shruti
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
SimHei
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Simplified Arabic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Simplified Arabic Fixed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
SimSun
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
SimSun-ExtB
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Snap ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Stencil
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Sylfaen
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Symbol
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tahoma
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tempus Sans ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Times New Roman
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Traditional Arabic
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Trebuchet MS
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tunga
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tw Cen MT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tw Cen MT Condensed
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Tw Cen MT Condensed Extra Bold
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Utsaah
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vani
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Verdana
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vijaya
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Viner Hand ITC
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vivaldi
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vladimir Script
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Vrinda
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Webdings
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wide Latin
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wingdings
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wingdings 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Wingdings 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\73562
73591
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
WORDFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\73562
73591
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Data
Settings
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options
ZoomApp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTF
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
FontCachePath
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
y8/
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTF
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTA
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
:e0
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTF
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTA
There are 349 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
32AE000
trusted library allocation
page read and write
 malicious
2446000
trusted library allocation
page read and write
 malicious
21F1000
trusted library allocation
page read and write
 malicious
68BC000
trusted library allocation
page read and write
61AF000
stack
page read and write
22B000
stack
page read and write
1E78000
trusted library allocation
page read and write
5281000
trusted library allocation
page read and write
29AC000
stack
page read and write
7061000
trusted library allocation
page read and write
3A2000
unkown
page execute read
4C0000
trusted library allocation
page read and write
1FD0000
direct allocation
page read and write
227000
heap
page read and write
635E000
trusted library allocation
page read and write
227E000
stack
page read and write
6B04000
trusted library allocation
page read and write
5DA0000
trusted library allocation
page read and write
4FB6000
trusted library allocation
page read and write
2010000
trusted library allocation
page read and write
25B000
stack
page read and write
63AE000
trusted library allocation
page read and write
200E000
trusted library allocation
page read and write
45F000
heap
page read and write
490000
trusted library allocation
page read and write
1F8A000
trusted library allocation
page read and write
5434000
heap
page read and write
CD000
stack
page read and write
295B000
stack
page read and write
4FA2000
trusted library allocation
page read and write
2000000
trusted library allocation
page read and write
25CF000
stack
page read and write
3CE000
heap
page read and write
411000
heap
page read and write
6B0000
trusted library allocation
page read and write
1FFC000
stack
page read and write
3F4000
heap
page read and write
1F80000
trusted library allocation
page read and write
67A5000
trusted library allocation
page read and write
1FA0000
heap
page read and write
63F2000
trusted library allocation
page read and write
2090000
heap
page read and write
4F5D000
trusted library allocation
page read and write
2285000
heap
page read and write
3FA000
heap
page read and write
1EE000
heap
page read and write
1F30000
heap
page read and write
6741000
trusted library allocation
page read and write
1F2B000
trusted library allocation
page read and write
2EFF000
stack
page read and write
6D39000
trusted library allocation
page read and write
106000
heap
page read and write
6BD7000
trusted library allocation
page read and write
4A9000
heap
page read and write
2060000
trusted library allocation
page read and write
698C000
trusted library allocation
page read and write
18A000
stack
page read and write
610000
trusted library allocation
page read and write
E4000
heap
page read and write
66FA000
trusted library allocation
page read and write
64D0000
trusted library allocation
page read and write
97B000
heap
page read and write
740000
heap
page read and write
2890000
heap
page read and write
6680000
trusted library allocation
page read and write
1F80000
trusted library allocation
page read and write
6BC0000
trusted library allocation
page read and write
6241000
trusted library allocation
page read and write
2870000
heap
page read and write
187000
heap
page read and write
5F0000
trusted library section
page read and write
1F82000
trusted library allocation
page read and write
4E0C000
stack
page read and write
99A000
heap
page read and write
128000
heap
page read and write
5287000
trusted library allocation
page read and write
5A91000
trusted library allocation
page read and write
30D000
heap
page read and write
6C18000
trusted library allocation
page read and write
1D3000
trusted library allocation
page execute and read and write
20D0000
trusted library allocation
page read and write
76AB000
trusted library allocation
page read and write
1F70000
trusted library section
page read and write
223A000
trusted library allocation
page read and write
955000
heap
page read and write
275B000
stack
page read and write
6719000
trusted library allocation
page read and write
400000
heap
page read and write
471000
heap
page read and write
710000
trusted library allocation
page read and write
6B3B000
trusted library allocation
page read and write
8E0000
trusted library section
page readonly
34C000
stack
page read and write
1F20000
trusted library allocation
page read and write
20E0000
trusted library allocation
page read and write
397000
heap
page read and write
429000
heap
page read and write
3A2000
unkown
page execute read
1A0000
heap
page read and write
591000
heap
page read and write
2DD000
heap
page read and write
838E000
stack
page read and write
46A000
heap
page read and write
10000
heap
page read and write
72D000
trusted library allocation
page read and write
210000
heap
page read and write
1BE000
heap
page read and write
29EB000
stack
page read and write
1D8000
heap
page read and write
4FE6000
trusted library allocation
page read and write
6530000
trusted library allocation
page read and write
6C05000
trusted library allocation
page read and write
6372000
trusted library allocation
page read and write
72C000
trusted library allocation
page read and write
655F000
trusted library allocation
page read and write
61AE000
stack
page read and write | page guard
64D5000
trusted library allocation
page read and write
4F78000
trusted library allocation
page read and write
659D000
trusted library allocation
page read and write
1F4000
heap
page read and write
268000
heap
page read and write
600000
trusted library allocation
page read and write
B9F000
stack
page read and write
2D0000
heap
page read and write
530000
heap
page read and write
31B000
heap
page read and write
3CE000
heap
page read and write
365000
heap
page read and write
55FF000
stack
page read and write
986000
heap
page read and write
6DB5000
trusted library allocation
page read and write
2D7F000
stack
page read and write
76C7000
trusted library allocation
page read and write
4D0000
trusted library allocation
page read and write
1FC000
heap
page read and write
62FA000
trusted library allocation
page read and write
3E2000
heap
page read and write
6746000
trusted library allocation
page read and write
641B000
trusted library allocation
page read and write
5430000
heap
page read and write
6978000
trusted library allocation
page read and write
22DF000
stack
page read and write
98F000
heap
page read and write
20D0000
heap
page read and write
52E6000
trusted library allocation
page read and write
67D7000
trusted library allocation
page read and write
407000
heap
page read and write
2E1F000
stack
page read and write
456000
heap
page read and write
60A0000
trusted library allocation
page read and write
6B33000
trusted library allocation
page read and write
6B75000
trusted library allocation
page read and write
67A0000
trusted library allocation
page read and write
446000
heap
page read and write
67A7000
trusted library allocation
page read and write
674D000
trusted library allocation
page read and write
4C0E000
stack
page read and write
5650000
heap
page read and write
2BD0000
heap
page read and write
1C0000
trusted library allocation
page read and write
680000
heap
page read and write
6614000
trusted library allocation
page read and write
731000
trusted library allocation
page read and write
8CE000
stack
page read and write
407000
heap
page read and write
6B0000
trusted library allocation
page read and write
2D8E000
stack
page read and write
5214000
trusted library allocation
page read and write
70CF000
trusted library allocation
page read and write
2060000
trusted library allocation
page read and write
2080000
trusted library allocation
page read and write
1ED0000
trusted library allocation
page read and write
23BD000
stack
page read and write
294000
heap
page read and write
2BD4000
heap
page read and write
21EF000
stack
page read and write
54C0000
heap
page read and write
4FEF000
trusted library allocation
page read and write
3F0000
heap
page read and write
363D000
stack
page read and write
89000
stack
page read and write
7EFE0000
unkown
page readonly
2940000
heap
page read and write
67CF000
trusted library allocation
page read and write
150000
heap
page read and write
588D000
stack
page read and write
2790000
heap
page read and write
6703000
trusted library allocation
page read and write
69BE000
trusted library allocation
page read and write
6267000
trusted library allocation
page read and write
2670000
heap
page read and write
5281000
trusted library allocation
page read and write
2256000
trusted library allocation
page read and write
6706000
trusted library allocation
page read and write
1F90000
trusted library allocation
page read and write
397000
heap
page read and write
679E000
trusted library allocation
page read and write
2ABF000
stack
page read and write
710000
trusted library allocation
page read and write
6C39000
trusted library allocation
page read and write
278000
heap
page read and write
675E000
trusted library allocation
page read and write
73EE000
trusted library allocation
page read and write
688E000
trusted library allocation
page read and write
1F10000
trusted library allocation
page read and write
666E000
trusted library allocation
page read and write
1FAC000
trusted library allocation
page read and write
6B45000
trusted library allocation
page read and write
64BF000
trusted library allocation
page read and write
205B000
heap
page read and write
965000
heap
page read and write
5F0000
trusted library allocation
page read and write
23BE000
stack
page read and write
968000
heap
page read and write
710000
trusted library allocation
page read and write
E0000
heap
page read and write
6786000
trusted library allocation
page read and write
8E4000
trusted library section
page readonly
19B000
stack
page read and write
67EB000
trusted library allocation
page read and write
2730000
heap
page read and write
2A3F000
stack
page read and write
666C000
trusted library allocation
page read and write
823E000
stack
page read and write
6907000
trusted library allocation
page read and write
3F5000
heap
page read and write
52E5000
trusted library allocation
page read and write
6760000
trusted library allocation
page read and write
6590000
trusted library allocation
page read and write
2025000
heap
page read and write
6565000
trusted library allocation
page read and write
720000
trusted library allocation
page execute and read and write
458F000
stack
page read and write
6B3E000
trusted library allocation
page read and write
5070000
heap
page read and write
6211000
trusted library allocation
page read and write
683A000
trusted library allocation
page read and write
512F000
stack
page read and write
380000
heap
page read and write
630000
heap
page read and write
67AC000
trusted library allocation
page read and write
5286000
trusted library allocation
page read and write
1F18000
trusted library allocation
page read and write
6B52000
trusted library allocation
page read and write
914000
heap
page read and write
592000
heap
page read and write
1F1A000
trusted library allocation
page read and write
627F000
trusted library allocation
page read and write
2020000
heap
page execute and read and write
202B000
heap
page read and write
6B0000
trusted library allocation
page read and write
5281000
trusted library allocation
page read and write
4F58000
trusted library allocation
page read and write
4450000
heap
page read and write
72B000
trusted library allocation
page read and write
2B3C000
stack
page read and write
1FF5000
heap
page read and write
6501000
trusted library allocation
page read and write
730000
trusted library allocation
page read and write
8D0000
heap
page read and write
97F000
heap
page read and write
276E000
stack
page read and write
6C41000
trusted library allocation
page read and write
2BD8000
heap
page read and write
6B0000
trusted library allocation
page read and write
280000
heap
page read and write
6C4B000
trusted library allocation
page read and write
674A000
trusted library allocation
page read and write
4F79000
trusted library allocation
page read and write
6D75000
trusted library allocation
page read and write
2010000
trusted library allocation
page read and write
646A000
trusted library allocation
page read and write
310000
heap
page read and write
6BF7000
trusted library allocation
page read and write
258000
heap
page read and write
180000
heap
page read and write
4F0D000
trusted library allocation
page read and write
280C000
stack
page read and write
67E5000
trusted library allocation
page read and write
6B88000
trusted library allocation
page read and write
2B30000
heap
page read and write
28FB000
stack
page read and write
720000
trusted library allocation
page read and write
6711000
trusted library allocation
page read and write
962000
heap
page read and write
6C56000
trusted library allocation
page read and write
6626000
trusted library allocation
page read and write
53C000
heap
page read and write
540000
heap
page read and write
5F0000
trusted library allocation
page read and write
5F0000
trusted library allocation
page read and write
622B000
trusted library allocation
page read and write
228F000
stack
page read and write
4D0000
trusted library allocation
page read and write
2190000
heap
page read and write
4F5C000
trusted library allocation
page read and write
10000
heap
page read and write
354000
heap
page read and write
1F90000
trusted library allocation
page read and write
1F10000
trusted library allocation
page read and write
1F70000
trusted library allocation
page read and write
24CF000
stack
page read and write
730000
trusted library allocation
page read and write
4F77000
trusted library allocation
page read and write
1ED000
trusted library allocation
page execute and read and write
720000
trusted library allocation
page read and write
9B4000
heap
page read and write
16B000
stack
page read and write
2B6000
heap
page read and write
110000
heap
page read and write
4E10000
trusted library allocation
page read and write
6537000
trusted library allocation
page read and write
76A6000
trusted library allocation
page read and write
240C000
stack
page read and write
4FF0000
trusted library section
page read and write
2C8000
heap
page read and write
3640000
trusted library allocation
page read and write
4B0000
heap
page read and write
2EB0000
heap
page read and write
544000
heap
page read and write
652A000
trusted library allocation
page read and write
2D1E000
stack
page read and write
6791000
trusted library allocation
page read and write
404000
heap
page read and write
1F80000
trusted library allocation
page read and write
2B00000
heap
page read and write
6410000
trusted library allocation
page read and write
407000
heap
page read and write
6FFA000
trusted library allocation
page read and write
4CF000
heap
page read and write
2B9C000
stack
page read and write
12D000
heap
page read and write
6948000
trusted library allocation
page read and write
678C000
trusted library allocation
page read and write
246000
heap
page read and write
6BB8000
trusted library allocation
page read and write
6A51000
trusted library allocation
page read and write
316000
heap
page read and write
31F9000
trusted library allocation
page read and write
10000
heap
page read and write
470000
unkown
page readonly
1F86000
trusted library allocation
page read and write
664F000
trusted library allocation
page read and write
5A90000
trusted library allocation
page read and write
578D000
stack
page read and write
4E6E000
stack
page read and write
6360000
trusted library allocation
page read and write
31F1000
trusted library allocation
page read and write
1F28000
trusted library allocation
page read and write
9AD000
heap
page read and write
527E000
stack
page read and write
10000
heap
page read and write
65C0000
trusted library allocation
page read and write
2A9F000
stack
page read and write
D0000
heap
page read and write
20CB000
heap
page read and write
7025000
trusted library allocation
page read and write
60A0000
trusted library allocation
page read and write
1FD000
heap
page read and write
2180000
heap
page read and write
1FB0000
trusted library allocation
page read and write
266000
heap
page read and write
24B000
trusted library allocation
page execute and read and write
1E0000
trusted library allocation
page read and write
662C000
trusted library allocation
page read and write
6B80000
trusted library allocation
page read and write
5C70000
heap
page read and write
1FB0000
trusted library allocation
page read and write
2C4F000
stack
page read and write
2D9F000
stack
page read and write
2AAE000
stack
page read and write
6BFD000
trusted library allocation
page read and write
6687000
trusted library allocation
page read and write
53FE000
stack
page read and write
2280000
heap
page read and write
52E5000
trusted library allocation
page read and write
360000
heap
page read and write
1F16000
trusted library allocation
page read and write
580000
heap
page read and write
170000
heap
page execute and read and write
6810000
trusted library allocation
page read and write
6505000
trusted library allocation
page read and write
514000
heap
page read and write
42E000
heap
page read and write
594000
heap
page read and write
64FC000
trusted library allocation
page read and write
6935000
trusted library allocation
page read and write
20D0000
trusted library allocation
page read and write
2000000
trusted library allocation
page read and write
1F10000
trusted library allocation
page read and write
4E0000
heap
page read and write
34E000
heap
page read and write
1F8E000
stack
page read and write
3BE000
stack
page read and write
4C0000
trusted library allocation
page read and write
3D4000
heap
page read and write
2D7000
heap
page read and write
6BFA000
trusted library allocation
page read and write
22BB000
heap
page read and write
6B54000
trusted library allocation
page read and write
358000
stack
page read and write
6293000
trusted library allocation
page read and write
230F000
stack
page read and write
5080000
trusted library allocation
page read and write
1F20000
trusted library allocation
page read and write
4F93000
trusted library allocation
page read and write
6717000
trusted library allocation
page read and write
1F2D000
trusted library allocation
page read and write
6511000
trusted library allocation
page read and write
350000
heap
page read and write
62FE000
trusted library allocation
page read and write
1E4000
heap
page read and write
10000
heap
page read and write
2D8000
heap
page read and write
E0000
heap
page read and write
507C000
heap
page read and write
7050000
trusted library allocation
page read and write
598F000
stack
page read and write
48C000
heap
page read and write
2095000
heap
page read and write
43E000
heap
page read and write
2263000
trusted library allocation
page read and write
2BFF000
stack
page read and write
2000000
trusted library allocation
page read and write
5A8F000
stack
page read and write
21FF000
stack
page read and write
390000
heap
page read and write
4F7000
heap
page read and write
4EF0000
trusted library allocation
page read and write
6B0000
trusted library allocation
page read and write
68CB000
trusted library allocation
page read and write
10000
heap
page read and write
3A0000
unkown
page readonly
2E00000
heap
page read and write
2AF0000
heap
page read and write
584000
heap
page read and write
6A0000
trusted library allocation
page read and write
6B94000
trusted library allocation
page read and write
62E1000
trusted library allocation
page read and write
98A000
heap
page read and write
330000
heap
page read and write
7010000
trusted library allocation
page read and write
2EBF000
stack
page read and write
6C3B000
trusted library allocation
page read and write
700000
trusted library allocation
page read and write
6B96000
trusted library allocation
page read and write
76B1000
trusted library allocation
page read and write
54E000
heap
page read and write
2C90000
heap
page read and write
2740000
heap
page read and write
594000
heap
page read and write
4C10000
trusted library allocation
page read and write
64B9000
trusted library allocation
page read and write
51D0000
trusted library allocation
page read and write
26F0000
heap
page read and write
50EC000
stack
page read and write
6C02000
trusted library allocation
page read and write
10000
heap
page read and write
118000
heap
page read and write
1FF0000
heap
page read and write
6788000
trusted library allocation
page read and write
2A2E000
stack
page read and write
6FD4000
trusted library allocation
page read and write
6A0000
trusted library allocation
page read and write
6757000
trusted library allocation
page read and write
64DB000
trusted library allocation
page read and write
2C80000
heap
page read and write
6BC3000
trusted library allocation
page read and write
27F000
stack
page read and write
247000
trusted library allocation
page execute and read and write
2080000
trusted library allocation
page read and write
5280000
trusted library allocation
page read and write
40B000
heap
page read and write
5281000
trusted library allocation
page read and write
1F15000
trusted library allocation
page read and write
1F70000
trusted library allocation
page read and write
37C000
heap
page read and write
409000
heap
page read and write
3F2000
heap
page read and write
6A19000
trusted library allocation
page read and write
230000
heap
page read and write
720000
trusted library allocation
page read and write
2070000
trusted library allocation
page read and write
1F30000
heap
page execute and read and write
9A6000
heap
page read and write
1F84000
trusted library allocation
page read and write
1FA0000
trusted library allocation
page read and write
1E8000
heap
page read and write
4FD2000
trusted library allocation
page read and write
6765000
trusted library allocation
page read and write
2B70000
heap
page read and write
6A0000
trusted library allocation
page read and write
5F0000
trusted library allocation
page read and write
1FA0000
trusted library allocation
page read and write
23CE000
stack
page read and write
3FE000
heap
page read and write
620E000
stack
page read and write
6AAB000
trusted library allocation
page read and write
2630000
heap
page read and write
6BCB000
trusted library allocation
page read and write
1FC0000
heap
page read and write
68F8000
trusted library allocation
page read and write
678E000
trusted library allocation
page read and write
50DB000
trusted library allocation
page read and write
20CF000
stack
page read and write
63C2000
trusted library allocation
page read and write
384000
heap
page read and write
337000
heap
page read and write
26D000
heap
page read and write
610000
trusted library allocation
page read and write
2A5E000
stack
page read and write
2B5C000
stack
page read and write
8F0000
heap
page read and write
6682000
trusted library allocation
page read and write
39B000
heap
page read and write
1F90000
trusted library allocation
page read and write
287B000
stack
page read and write
1DD000
trusted library allocation
page execute and read and write
23A000
trusted library allocation
page execute and read and write
6596000
trusted library allocation
page read and write
2010000
trusted library allocation
page read and write
91F000
heap
page read and write
390000
heap
page read and write
374000
heap
page read and write
28E0000
heap
page read and write
2070000
trusted library allocation
page read and write
317000
heap
page read and write
661F000
trusted library allocation
page read and write
6794000
trusted library allocation
page read and write
4D8E000
stack
page read and write
4AB000
stack
page read and write
735000
trusted library allocation
page read and write
2070000
trusted library allocation
page read and write
186000
heap
page read and write
710000
trusted library allocation
page read and write
6679000
trusted library allocation
page read and write
422E000
stack
page read and write
6A0000
trusted library allocation
page read and write
40A000
heap
page read and write
7017000
trusted library allocation
page read and write
22DF000
stack
page read and write
2060000
trusted library allocation
page read and write
20B000
stack
page read and write
51FF000
trusted library allocation
page read and write
4472000
heap
page read and write
310000
heap
page read and write
9B3000
heap
page read and write
490000
trusted library allocation
page read and write
1D6000
heap
page read and write
671B000
trusted library allocation
page read and write
22A000
stack
page read and write
67D9000
trusted library allocation
page read and write
628E000
trusted library allocation
page read and write
3A0000
unkown
page readonly
4E9000
heap
page read and write
232000
trusted library allocation
page read and write
4F0000
heap
page read and write
4F93000
trusted library allocation
page read and write
4C0000
trusted library section
page read and write
237000
trusted library allocation
page execute and read and write
231B000
stack
page read and write
6B7E000
trusted library allocation
page read and write
422000
heap
page read and write
671E000
trusted library allocation
page read and write
66FE000
trusted library allocation
page read and write
390000
trusted library allocation
page read and write
2B8000
heap
page read and write
6563000
trusted library allocation
page read and write
3CC000
heap
page read and write
225D000
trusted library allocation
page read and write
5281000
trusted library allocation
page read and write
69D2000
trusted library allocation
page read and write
65D000
stack
page read and write
74BA000
trusted library allocation
page read and write
6C43000
trusted library allocation
page read and write
6C0D000
trusted library allocation
page read and write
67EF000
trusted library allocation
page read and write
6A0000
trusted library allocation
page read and write
2C0F000
stack
page read and write
718000
trusted library allocation
page read and write
6A0000
trusted library allocation
page read and write
761C000
trusted library allocation
page read and write
462000
heap
page read and write
60A0000
trusted library allocation
page read and write
5DBD000
trusted library allocation
page read and write
8F7000
heap
page read and write
67D2000
trusted library allocation
page read and write
2CEE000
stack
page read and write
4454000
heap
page read and write
520F000
trusted library allocation
page read and write
1FB0000
trusted library allocation
page read and write
1F8000
heap
page read and write
2780000
heap
page read and write
6849000
trusted library allocation
page read and write
4F54000
trusted library allocation
page read and write
288000
heap
page read and write
66F000
stack
page read and write
1F70000
trusted library allocation
page read and write
1FA0000
trusted library allocation
page read and write
5190000
heap
page read and write
5281000
trusted library allocation
page read and write
4F5C000
trusted library allocation
page read and write
30D000
stack
page read and write
108000
heap
page read and write
273E000
stack
page read and write
51ED000
trusted library allocation
page read and write
380000
trusted library allocation
page execute and read and write
76C3000
trusted library allocation
page read and write
2FCF000
stack
page read and write
223C000
stack
page read and write
2ADE000
stack
page read and write
642F000
trusted library allocation
page read and write
2080000
trusted library allocation
page read and write
63B0000
trusted library allocation
page read and write
620000
trusted library allocation
page read and write
6508000
trusted library allocation
page read and write
8E9000
trusted library section
page readonly
6CEC000
trusted library allocation
page read and write
62CE000
trusted library allocation
page read and write
1D4000
trusted library allocation
page read and write
4EE0000
heap
page read and write
2020000
heap
page read and write
10000
heap
page read and write
2C1E000
stack
page read and write
700000
trusted library allocation
page execute and read and write
2BDB000
heap
page read and write
2B2000
heap
page read and write
516F000
stack
page read and write
6210000
trusted library allocation
page read and write
4CB000
heap
page read and write
284F000
stack
page read and write
53CF000
stack
page read and write
6534000
trusted library allocation
page read and write
50F000
stack
page read and write
5286000
trusted library allocation
page read and write
299F000
stack
page read and write
4A0000
trusted library allocation
page read and write
290000
heap
page read and write
37D000
stack
page read and write
64FA000
trusted library allocation
page read and write
5438000
heap
page read and write
647E000
trusted library allocation
page read and write
28D000
heap
page read and write
65C4000
trusted library allocation
page read and write
432E000
stack
page read and write
600F000
stack
page read and write
6880000
trusted library allocation
page read and write
67F2000
trusted library allocation
page read and write
6F26000
trusted library allocation
page read and write
659A000
trusted library allocation
page read and write
6FE000
stack
page read and write
4F34000
trusted library allocation
page read and write
655D000
trusted library allocation
page read and write
40D000
heap
page read and write
1F20000
trusted library allocation
page read and write
6DDA000
trusted library allocation
page read and write
There are 646 hidden memdumps, click here to show them.