File: 709bb4cb8a5abb0fddfb4e02199b7724f971f3581e42019c12400fab27a719fb
Metadata
| _709bb4cb8a5abb0fddfb4e02199b7724f971f3581e42019c12400fab27a719fb_ - Invoice.doc | |
| data | 713644 bytes |
| 2016-02-17 02:05:34 | |
| 6bcd7d515ba0c6e1ffffa7682dab5334 | |
| 4782a0601a2abaa0be145c0f0e9150c8ddd97e32 | |
| 709bb4cb8a5abb0fddfb4e02199b7724f971f3581e42019c12400fab27a719fb | |
| e05cf15a2c53053183f3bdf3476aafb90db776c05761c7d2de33eabed209610c63b92423aeea6d499f7722755e511442ab0c3dca6327330dbf8518d8d0f0df8b | |
| 12288:YBCAT7qtK5m1V9vadepu5QaBBC9uSOsEsNwLCsEwSqlkZKrm3pk:YBCAT7qtK5m1V5kQvA9sEsNwLC6Sq2K | |
| N/A | |
| N/A | |
APTNotes
Cyber threat intelligence reports associated with 709bb4cb8a5abb0fddfb4e02199b7724f971f3581e42019c12400fab27a719fb.
Cyber threat intelligence reports associated with 709bb4cb8a5abb0fddfb4e02199b7724f971f3581e42019c12400fab27a719fb.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
| Domain | IP |
|---|---|
| www.reunben.xyz | 31.220.40.22 |
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
| Host | URL | User-Agent |
|---|---|---|
| www.reunben.xyz | /stealer/index.php?action=add&username=&password=&app=&pcname=HOME&sitename= | HardCore Software For |
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
| AVG | Exploit_c.ADBW |
| Ad-Aware | Exploit.JPFD |
| AegisLab | Exploit.Msword.Agent!c |
| AhnLab-V3 | RTF/Cve-2015-1641 |
| Arcabit | Exploit.CVE-2015-1641.Gen |
| BitDefender | Exploit.JPFD |
| CAT-QuickHeal | Exp.RTF.Obfus.Gen |
| DrWeb | Exploit.Rtf.CVE2012-0158 |
| ESET-NOD32 | Win32/Exploit.Agent.NHN |
| Emsisoft | Exploit.JPFD (B) |
| F-Secure | Exploit.JPFD |
| GData | Exploit.JPFD |
| Kaspersky | Exploit.MSWord.Agent.gn |
| MicroWorld-eScan | Exploit.JPFD |
| Qihoo-360 | virus.exp.20120158 |
| Sophos | Troj/DocEx-B |
| Tencent | Win32.Trojan.Agent.Wskr |
| TrendMicro | HEUR_RTFEXP.A |
| VIPRE | LooksLike.RTF.Malware.b (v) |
| Zillya | Downloader.Iframe.JS.1774 |
| nProtect | Exploit.JPFD |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office Test\Special\Perf |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Office |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\ProductVersion |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Debug |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\LanguageResources |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\EnabledLanguages |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\MUILanguages |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Common\LanguageResources\EnabledLanguages |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\LanguageResources\InstalledUIs |
| HKEY_CURRENT_USER\Software\Microsoft\Shared |
| HKEY_CURRENT_USER\Keyboard Layout\Substitutes |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\BypassMigration |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\OPWBypassMigration |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Migration\Office |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Migration\Word |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\12.0\User Settings\ |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\ |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\ |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\AccessDE_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Access_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Ace_OdbcCurrentUser |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Excel_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Excel_Intl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Graph_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Mso_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Mso_CoreReg |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Mso_Intl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\outexum |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Outlook_AutoDiscover |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Outlook_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Outlook_Intl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\PowerPoint_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\PowerPoint_Intl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Sps_OutlookAddin |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Word_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\Word_Intl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\XDocs_XMLEditVerbHandler |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\\{90120000-0030-0000-0000-0000000FF1CE} |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Access_Core |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Ace_OdbcCurrentUser |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Excel_Core |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Excel_Intl |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Graph_Core |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Mso_Core |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Mso_CoreReg |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Mso_Intl |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\outexum |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Outlook_AutoDiscover |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Outlook_Core |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Outlook_Intl |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\PowerPoint_Core |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\PowerPoint_Intl |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Sps_OutlookAddin |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Word_Core |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\Word_Intl |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\XDocs_XMLEditVerbHandler |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\\AccessDE_Core |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\Debug |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1547161642-507921405-839522115-1004\Components\D94C8360B8BB1DC41B1950E1F8237563 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E1F8237563 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Products\00002109030000000000000000F01FEC |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Products\00002109030000000000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109030000000000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\InstallProperties |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Registration |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE} |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Features\00002109030000000000000000F01FEC |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Features\00002109030000000000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\00002109030000000000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Features |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5824C2FB557A5D43881763B7A07D05E |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD4E638E8714C454FA1AD399C0E81909 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CAB7071E27686994093945B9EE85F69D |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE334C41ADDE81149944C1D33967043A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C89954FBD4FB47C449CE85E9F7E918FB |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\748B2526ADAB4D3429253E7976AF041A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5120EEDE039486F42830D8D2552797F6 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCABF232126726445BC57F4CDE05C5EB |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47155108894E68A409FDC1FC6E8DA2CB |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B271454ED4348B47B365F93ADEAC015 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D6BD49C8A516ED41BB0C0D31B0F52BC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4006F64980E4BACB0EF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0AF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0CF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0BF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4006F64980E4BACB0DF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0AF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0CF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0BF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\82DE7549CF3F8CCB0DF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A31EAB9FA7E3C6D0AF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A31EAB9FA7E3C6D0CF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A31EAB9FA7E3C6D0BF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B92D5049E11C93DB0DF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EC3DF47D8A2C9E00AF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EC3DF47D8A2C9E00CF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EC3DF47D8A2C9E00BF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77AE531D63D456630DF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E0F8237563 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2562336682C91B850AF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2562336682C91B850CF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F949E36CB3004C50AF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F949E36CB3004C50CF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D6C7B862FD11C450AF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D6C7B862FD11C450CF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3D0372D14C348850AF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3D0372D14C348850CF18C3B9B1A1EE8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11B564CAA807C694ABE73044DC90516B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E3F997A2790938844ACDF81020B32415 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C1D6229422D71045BFB2F8BCE017AA4 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C9A6F846E2818A47A408CAF13381C71 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C733A8B34D26AF4458B43E09EFC2C77F |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2227A34C816D4F94EB598446F9BD8B17 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7AA6F3DBF3CE139469FE63D56E7AF446 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7CD01816C53D32438CF043106011676 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Usage |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\1F5C93A1704E3E445ADD70E3090042AE |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\1F5C93A1704E3E445ADD70E3090042AE |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\1F5C93A1704E3E445ADD70E3090042AE |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\Security |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004 |
| Control Panel\International |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\FixedFormat |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\MailSettings |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\Spelling |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Options\Calendar |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Office |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\HangulHanjaConv |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\Vpref |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\Vprsu |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\Vpreffuz |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\Assist |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\IMM |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\SystemShared |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB2DC41B1950E0F8237563 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Security |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\GELPrefs |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework |
| HKEY_CURRENT_USER\Software\Microsoft\.NETFramework\Policy\Upgrades |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\Upgrades |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\5.0\0\win32 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Outlook |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\ |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\General |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Word\DisabledCmdBarItemsList |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Word\DisabledCmdBarItemsCheckBoxes |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Word\DisabledShortcutKeysList |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Word\DisabledShortcutKeysCheckBoxes |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Toolbars |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\621EAA421190F8740A91708B57BE9969 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\621EAA421190F8740A91708B57BE9969 |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\621EAA421190F8740A91708B57BE9969 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72550EAA4F7970143BF094E2F6C9164E |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B905EB838DBFEE4991CF8E66F518BBF |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E2F8237563 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2FAFA61ADBF18444690EDB85CAA39EB7 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\337E30A68012B5341B7A8ADE48F4064A |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows NT\CurrentVersion\Windows |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\OneNote\MDI writer |
| HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Devices |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Messaging Subsystem |
| HKEY_CLASSES_ROOT\CLSID\{00020907-0000-0000-C000-000000000046}\LocalServer32 |
| HKEY_CLASSES_ROOT\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 |
| HKEY_CLASSES_ROOT\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32 |
| HKEY_CLASSES_ROOT\Word.Document\CurVer |
| HKEY_CLASSES_ROOT\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\TrustCenter |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP |
| HKEY_CURRENT_USER\Software\Microsoft\CTF |
| HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP |
| HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\LanguageProfile |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\LanguageProfile |
| HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\LanguageProfile |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\LanguageProfile |
| HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\LanguageProfile |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\LanguageProfile |
| HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile |
| HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409 |
| HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} |
| HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\LanguageProfile |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\LanguageProfile |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Toolbars\Settings |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\IME |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ShipAsserts |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\StatusBar |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Open Find\Places |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Open Find |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\WINWORD.EXE |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D} |
| HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{475c7950-e3d2-11e0-8d7a-806d6172696f}\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{475c7952-e3d2-11e0-8d7a-806d6172696f}\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{475c7952-e3d2-11e0-8d7a-806d6172696f}\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{475c7950-e3d2-11e0-8d7a-806d6172696f}\ |
| HKEY_CLASSES_ROOT\Directory |
| HKEY_CLASSES_ROOT\Directory\CurVer |
| HKEY_CLASSES_ROOT\Directory\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced |
| HKEY_CLASSES_ROOT\Directory\\ShellEx\IconHandler |
| HKEY_CLASSES_ROOT\Directory\\Clsid |
| HKEY_CLASSES_ROOT\Folder |
| HKEY_CLASSES_ROOT\Folder\Clsid |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\DrawAlerts\FTP Sites |
| HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions |
| HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Security\FileOpenBlock |
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\12.0\Common\Security |
| HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004_Classes |
| HKEY_LOCAL_MACHINE\Software\Classes |
| \REGISTRY\USER |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID |
| CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F} |
| CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F}\TreatAs |
| \CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F} |
| \CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F}\InprocServer32 |
| \CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F}\InprocServerX86 |
| \CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F}\LocalServer32 |
| \CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F}\InprocHandler32 |
| \CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F}\InprocHandlerX86 |
| \CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F} |
| HKEY_CLASSES_ROOT\CLSID\{88D969EC-8B8B-4C3D-859E-AF6CD158BE0F}\TreatAs |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\12.0\Common\OpenXMLFormat |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Publisher\Internet |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\PowerPoint\Internet |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer |
| HKEY_LOCAL_MACHINE\Software\Netscape\Netscape Navigator |
| HKEY_LOCAL_MACHINE\Software\Netscape\Netscape Navigator Gold |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Internet |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Internet |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\Internet |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Ole |
| HKEY_CLASSES_ROOT\AppID\WINWORD.EXE |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName |
| ActiveComputerName |
| CLSID\{88D969EF-F192-11D4-A65F-0040963251E5} |
| CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\TreatAs |
| \CLSID\{88D969EF-F192-11D4-A65F-0040963251E5} |
| \CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InprocServer32 |
| \CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InprocServerX86 |
| \CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\LocalServer32 |
| \CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InprocHandler32 |
| \CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InprocHandlerX86 |
| \CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5} |
| HKEY_CLASSES_ROOT\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\TreatAs |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MOTIF\FlexUIAutomation |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Toolbars\Word |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Word\Addins |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Word\Addins |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Word\Addins\WordEEFonts.Connect |
| WordEEFonts.Connect\Clsid |
| HKEY_CLASSES_ROOT\WordEEFonts.Connect |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\DisabledItems |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Offline |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Offline\Files |
| CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607} |
| CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\TreatAs |
| \CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607} |
| \CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\InprocServer32 |
| \CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\InprocServerX86 |
| \CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy\Appmgmt |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\Word_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap |
| HKEY_CLASSES_ROOT\.pip |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\downlevel_manifest |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\downlevel_payload |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\downlevel_manifest |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\downlevel_payload |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\downlevel_manifest |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\downlevel_payload |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\downlevel_manifest |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\downlevel_payload |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_b2841548\downlevel_manifest |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_51e427d4\downlevel_manifest |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_22ca9ad9\downlevel_manifest |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_63bb0537\downlevel_manifest |
| HKEY_CLASSES_ROOT\CLSID\{000C0126-0000-0000-C000-000000000046} |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\Mso_Core |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Common |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\Components\Watson_AltrIntl |
| \CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\InprocHandler32 |
| CLSID\{00020906-0000-0000-C000-000000000046} |
| CLSID\{00020906-0000-0000-C000-000000000046}\TreatAs |
| \CLSID\{00020906-0000-0000-C000-000000000046} |
| \CLSID\{00020906-0000-0000-C000-000000000046}\InprocServer32 |
| \CLSID\{00020906-0000-0000-C000-000000000046}\InprocServerX86 |
| \CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 |
| \CLSID\{00020906-0000-0000-C000-000000000046}\InprocHandler32 |
| CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22} |
| CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\TreatAs |
| \CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22} |
| \CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\InprocServer32 |
| \CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\InprocServerX86 |
| \CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\LocalServer32 |
| \CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\InprocHandler32 |
| CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390} |
| CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\TreatAs |
| \CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390} |
| \CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\InprocServer32 |
| \CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\InprocServerX86 |
| \CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\LocalServer32 |
| \CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\InprocHandler32 |
| CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD} |
| CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\TreatAs |
| \CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD} |
| \CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\InprocServer32 |
| \CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\InprocServerX86 |
| \CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\LocalServer32 |
| \CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\InprocHandler32 |
| CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE} |
| CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\TreatAs |
| \CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE} |
| \CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\InprocServer32 |
| \CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\InprocServerX86 |
| \CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\LocalServer32 |
| \CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\InprocHandler32 |
| CLSID\{00020907-0000-0000-C000-000000000046} |
| CLSID\{00020907-0000-0000-C000-000000000046}\TreatAs |
| \CLSID\{00020907-0000-0000-C000-000000000046} |
| \CLSID\{00020907-0000-0000-C000-000000000046}\InprocServer32 |
| \CLSID\{00020907-0000-0000-C000-000000000046}\InprocServerX86 |
| \CLSID\{00020907-0000-0000-C000-000000000046}\LocalServer32 |
| \CLSID\{00020907-0000-0000-C000-000000000046}\InprocHandler32 |
| HKEY_CLASSES_ROOT\Typelib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.4\0\win32 |
| CLSID\{000209F0-0000-0000-C000-000000000046} |
| CLSID\{000209F1-0000-0000-C000-000000000046} |
| CLSID\{000209F4-0000-0000-C000-000000000046} |
| CLSID\{000209F5-0000-0000-C000-000000000046} |
| CLSID\{000CDB0D-0000-0000-C000-000000000046} |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1 |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID |
| CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959} |
| CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\TreatAs |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959} |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\InprocServer32 |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\InprocServerX86 |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\LocalServer32 |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\InprocHandler32 |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\InprocHandlerX86 |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\LocalServer |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\AppID\{C04E4E5E-89E6-43C0-92BD-D3F2C7FBA5C4} |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\Progid |
| HKEY_CLASSES_ROOT\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959} |
| HKEY_CLASSES_ROOT\CLSID |
| HKEY_CLASSES_ROOT\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\AutoConvertTo |
| HKEY_CLASSES_ROOT\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\TreatAs |
| HKEY_CLASSES_ROOT\otkloadr.WRAssembly.1\CLSID\CLSID\{A08A033D-1A75-4AB6-A166-EAD02F547959}\InprocHandler |
| HKEY_CLASSES_ROOT\Word.Document.12 |
| HKEY_CLASSES_ROOT\Word.Document.12\CLSID |
| HKEY_CLASSES_ROOT\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607} |
| HKEY_CLASSES_ROOT\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\AutoConvertTo |
| HKEY_CLASSES_ROOT\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\MiscStatus |
| HKEY_CLASSES_ROOT\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\MiscStatus\1 |
| HKEY_CLASSES_ROOT\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933} |
| HKEY_CLASSES_ROOT\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\shell |
| HKEY_CLASSES_ROOT\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\ShellEx\IconHandler |
| HKEY_CLASSES_ROOT\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\Clsid |
| HKEY_CLASSES_ROOT\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\InProcServer32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility |
| CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933} |
| CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\TreatAs |
| \CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933} |
| \CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\InprocServer32 |
| \CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\InprocServerX86 |
| \CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\LocalServer32 |
| \CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\InprocHandler32 |
| \CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\InprocHandlerX86 |
| \CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\TreatAs |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{7BD29E01-76C1-11CF-9DD0-00A0C9034933} |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{f3364ba0-65b9-11ce-a9ba-00aa004ae837}\InProcServer32 |
| CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837} |
| CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\TreatAs |
| \CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837} |
| \CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\InprocServer32 |
| \CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\InprocServerX86 |
| \CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\LocalServer32 |
| \CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\InprocHandler32 |
| \CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\InprocHandlerX86 |
| \CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837} |
| HKEY_CLASSES_ROOT\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\TreatAs |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{7bd29e01-76c1-11cf-9dd0-00a0c9034933}\InProcServer32 |
| CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628} |
| CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\TreatAs |
| \CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628} |
| \CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0C6EE4A3C3D11194C000680395BB1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3178D6A16119EA44AB06C40F8E1C5DB8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F4F73161B98F5489313A5B7F5BFFE9 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\869C0C701D584D115AF3000972A8B18B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1ECE25BB188417F48BAEFCA55CAC5CA1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\XDocs_XMLEditVerbHandler |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\000021090300000000000014F376BCF5 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3AFE80AA038F8147B1AB826F0BD1F16 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\23E3EAE2B4035C54FBA2D0E201288CAE |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D4B4D10F3E41BD944BC9E10C81F96E38 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8420370EE47FE754CA5A8ACFDD374684 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42F1E9AF3ECCEE443A80AFBF0C9085A1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\818BC40DA5B0E084DAC4217FF842FF22 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCFD0C0DBF1B567419D85EBA368E6341 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B75C6FCFEF39CB49B3F37FBB86726C0 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B1E0398E98E85C04F939531623E572AA |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00529E526D4C78245A4E168AFEB4DFFB |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00965022248C1D110ADD000A9C502477 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C83B0C929092D11AA7A000A9CF0750B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AFFB8C4DF6FB1D1148A300008F701F02 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D92CAF890F891D119A2F000679BDFEDC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F92CAF890F891D119A2F000679BDFEDC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\227A5E5F29487CE4E9D882C38A177838 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F0835CD311D82AC46BCDEF24F08926FB |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\536C6E53D8E9697418EBBF04CFCAEB9D |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A082AC7BA846AF744BDCB8968E8B1FFE |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CA4A2DD729380043B0800BB8E938117 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46999AD5A6A327F468183DD4F69DB666 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\730C675CA44340F40A118EEE758E3735 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC6E1989ECE9EAD4D9F6AC07F3D8158B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA36E0B147DC0F4479273BBD4761F935 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\729654CB950161D43BB08ABA122E3EE6 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A16F9DD775B3C124EBEB9BD536C89A71 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\732BE251296E2B94D9CAE41283743950 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DB4191108E459145B9573A0A2D0C2D8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C96D4EEE7C022D111A58000A9CA05BF0 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A96D4EEE7C022D111A58000A9CA05BF0 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\896D4EEE7C022D111A58000A9CA05BF0 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8EEF86DD963C1D111A37000A9CA05BF0 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57634D5732AA1D11A9CC0006794C4E25 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D79BA62C1F52D684C9B5B76D5CC5576C |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9ED4DDD16EA46A41A640A4E574B9CD1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2EADE53A7BE590349AB50FF4C01F9250 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B291A616D3954A47BCB5CCEF52F630A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\55B5FB707172B1B429F7DEEE895A8C7B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D3F66C67CEC134BAD37B1E48BAAC12 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C84BA7102DDF97C4AA4EBE512A86EBC4 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\14355655CBD54D944A7518EDDF19EA2D |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AE465557625DCE24FACD16FAA7DB7EE9 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4547F4CFCF054D115AE3000972A8B18B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7547F4CFCF054D115AE3000972A8B18B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A547F4CFCF054D115AE3000972A8B18B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D547F4CFCF054D115AE3000972A8B18B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0647F4CFCF054D115AE3000972A8B18B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF45A4C037A53D115A02000A9C32B11A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD75FB93F4F6B9647A027827297DD6A0 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B00CDE5A3754F01459580BBB58019CE3 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Common\OffDiag |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\35450D900A90C73419D21D7DCFA02B35 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D025B5910BFFBEE439B469B69A8D50A4 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\146DCE28343A54D42BDD430E69B16722 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{62CEC9E0-3811-4C36-A94E-4F7565DCD23F} |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD09040AAEA06A440AE86EE9BFB1425E |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OSession |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D5CEE924778DCD74B9497BCE4075DB6A |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Office 12 |
| \CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\LocalServer32 |
| \CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocHandler32 |
| \CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocHandlerX86 |
| \CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\LocalServer |
| \CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Progid |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628} |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Control |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\HTMLControl |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Printable |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Programmable |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED3-2438-11CF-A3DB-080036F12502} |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED9-2438-11CF-A3DB-080036F12502} |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{73CEF3DD-AE85-11CF-A406-00AA00C00940} |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dotm |
| HKEY_CLASSES_ROOT\.dotm |
| HKEY_CLASSES_ROOT\Word.TemplateMacroEnabled.12 |
| HKEY_CLASSES_ROOT\Word.TemplateMacroEnabled.12\CurVer |
| HKEY_CLASSES_ROOT\Word.TemplateMacroEnabled.12\ |
| HKEY_CLASSES_ROOT\Word.TemplateMacroEnabled.12\\ShellEx\IconHandler |
| HKEY_CLASSES_ROOT\SystemFileAssociations\.dotm |
| HKEY_CLASSES_ROOT\SystemFileAssociations\.dotm\ShellEx\IconHandler |
| HKEY_CLASSES_ROOT\SystemFileAssociations\document |
| HKEY_CLASSES_ROOT\Word.TemplateMacroEnabled.12\\Clsid |
| HKEY_CLASSES_ROOT\CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\Implemented Categories\{00021490-0000-0000-C000-000000000046} |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ReviewCycle |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Workflow\Cache |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Workflow\WorkgroupCache |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{7bd29e01-76c1-11cf-9dd0-00a0c9034933}\InProcServer32\Files |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc |
| HKEY_CLASSES_ROOT\.doc |
| HKEY_CLASSES_ROOT\Word.Document.8 |
| HKEY_CLASSES_ROOT\Word.Document.8\CurVer |
| HKEY_CLASSES_ROOT\Word.Document.8\ |
| HKEY_CLASSES_ROOT\Word.Document.8\\ShellEx\IconHandler |
| HKEY_CLASSES_ROOT\SystemFileAssociations\.doc |
| HKEY_CLASSES_ROOT\SystemFileAssociations\.doc\ShellEx\IconHandler |
| HKEY_CLASSES_ROOT\Word.Document.8\\Clsid |
| HKEY_CLASSES_ROOT\CLSID\{00020906-0000-0000-C000-000000000046}\Implemented Categories\{00021490-0000-0000-C000-000000000046} |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Security\Trusted Locations |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Common\Security\Trusted Locations |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628} |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\TreatAs |
| HKEY_CLASSES_ROOT\Licenses |
| HKEY_CLASSES_ROOT\Licenses\ED4B87C4-9F76-11d1-8BF7-0000F8754DA1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Common\Security |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} |
| HKEY_CLASSES_ROOT\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Required Categories\ |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Send To OneNote 2007 |
| CLSID\{000C03B8-0000-0000-C000-000000000046} |
| HKEY_CLASSES_ROOT\CLSID\{000C03B8-0000-0000-C000-000000000046} |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Internet\Fonts |
| CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} |
| CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Required Categories\ |
| HKEY_CLASSES_ROOT\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\Implemented Categories\{C7AA2160-50FF-11CF-A77E-00AA006D2EA4} |
| \CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\Progid |
| HKEY_CLASSES_ROOT\Word.Document.12\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607} |
| CLSID\{88D969E7-F192-11D4-A65F-0040963251E5} |
| CLSID\{88D969E7-F192-11D4-A65F-0040963251E5}\TreatAs |
| \CLSID\{88D969E7-F192-11D4-A65F-0040963251E5} |
| \CLSID\{88D969E7-F192-11D4-A65F-0040963251E5}\InprocServer32 |
| \CLSID\{88D969E7-F192-11D4-A65F-0040963251E5}\InprocServerX86 |
| \CLSID\{88D969E7-F192-11D4-A65F-0040963251E5}\LocalServer32 |
| \CLSID\{88D969E7-F192-11D4-A65F-0040963251E5}\InprocHandler32 |
| \CLSID\{88D969E7-F192-11D4-A65F-0040963251E5}\InprocHandlerX86 |
| \CLSID\{88D969E7-F192-11D4-A65F-0040963251E5}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{88D969E7-F192-11D4-A65F-0040963251E5} |
| HKEY_CLASSES_ROOT\CLSID\{88D969E7-F192-11D4-A65F-0040963251E5}\TreatAs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Schema Library |
| HKEY_CURRENT_USER\Software\Microsoft\Schema Library |
| CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B} |
| CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\TreatAs |
| \CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B} |
| \CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\InprocServer32 |
| \CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\InprocServerX86 |
| \CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\LocalServer32 |
| \CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\InprocHandler32 |
| \CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\InprocHandlerX86 |
| \CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B} |
| HKEY_CLASSES_ROOT\CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\TreatAs |
| HKEY_CLASSES_ROOT\TypeLib\{9B92EB61-CBC1-11D3-8C2D-00A0CC37B591}\1.2\0\win32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Common\Smart Tag |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Common\Smart Tag\Recognizers |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Common\Smart Tag\Actions |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Actions\{16A933D2-A296-49D5-96FC-C7C2DAEE88B4} |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Actions\{3CC385AC-95CC-4A75-BF35-AB36AE645BCF} |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Actions |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A} |
| HKEY_CLASSES_ROOT\CLSID\{16A933D2-A296-49D5-96FC-C7C2DAEE88B4} |
| HKEY_CLASSES_ROOT\CLSID\{16A933D2-A296-49D5-96FC-C7C2DAEE88B4}\InprocServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A} |
| HKEY_CLASSES_ROOT\CLSID\{339361CD-6723-455D-A40B-C95F1F91FF8A} |
| HKEY_CLASSES_ROOT\CLSID\{339361CD-6723-455D-A40B-C95F1F91FF8A}\InprocServer32 |
| HKEY_CLASSES_ROOT\CLSID\{3CC385AC-95CC-4A75-BF35-AB36AE645BCF} |
| HKEY_CLASSES_ROOT\CLSID\{3CC385AC-95CC-4A75-BF35-AB36AE645BCF}\InprocServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD} |
| HKEY_CLASSES_ROOT\CLSID\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD} |
| HKEY_CLASSES_ROOT\CLSID\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}\InprocServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} |
| HKEY_CLASSES_ROOT\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} |
| HKEY_CLASSES_ROOT\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\InprocServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F} |
| HKEY_CLASSES_ROOT\CLSID\{C3754D1A-04D3-4085-8CFB-97705B57A98F} |
| HKEY_CLASSES_ROOT\CLSID\{C3754D1A-04D3-4085-8CFB-97705B57A98F}\InprocServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD} |
| HKEY_CLASSES_ROOT\CLSID\{F114AE61-1331-4238-92C9-BBE330AF25FD} |
| HKEY_CLASSES_ROOT\CLSID\{F114AE61-1331-4238-92C9-BBE330AF25FD}\InprocServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Security |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU\ |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\DWS |
| HKEY_CURRENT_USER\Environment |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\DocumentRecovery |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\DocumentRecovery\C5CA00 |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Restore Workspace |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\UserInfo |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office Test\Special |
| HKEY_CURRENT_USER\Keyboard Layout\Toggle |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\LangBarAddIn\ |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\LangBarAddIn\ |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\InstallRoot |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Licensing |
| CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
| CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServerX86 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer32 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandler32 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandlerX86 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
| HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\Ranges\ |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_URLHOSTNAME |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Cursors |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\12.0\Common\General |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Registration |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared\HTML |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared\MHTML |
| HKEY_CLASSES_ROOT\.htm |
| HKEY_CLASSES_ROOT\htmlfile\shell |
| HKEY_CLASSES_ROOT\htmlfile\shell\edit\command |
| HKEY_CLASSES_ROOT\htmlfile\shell\print\command |
| HKEY_CLASSES_ROOT\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version |
| HKEY_CLASSES_ROOT\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\12 |
| HKEY_CLASSES_ROOT\.mht |
| HKEY_CLASSES_ROOT\mhtmlfile\shell |
| HKEY_CLASSES_ROOT\mhtmlfile\shell\edit\command |
| HKEY_CLASSES_ROOT\mhtmlfile\shell\print\command |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Proof Type |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Override |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\A01FEFDE8C822B9408582AC21997CABB |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\A01FEFDE8C822B9408582AC21997CABB |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\A01FEFDE8C822B9408582AC21997CABB |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\E9A16771B8AFC744D9BDB7B2BBBC15A1 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\E9A16771B8AFC744D9BDB7B2BBBC15A1 |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\E9A16771B8AFC744D9BDB7B2BBBC15A1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Features\00002109F100A0C00000000000F01FEC |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Features\00002109F100A0C00000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\00002109F100A0C00000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F100A0C00000000000F01FEC\Features |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\37B0B509FD9CC284A8E27AE607FE5270 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45527C2C9B765B1428CF7E17324433CD |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CF0CF973CF05E0743B9BF52D4870FB24 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5E743E26CA007804580F1F5C5D683E88 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD64546253186C44DB392B0002A364FE |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C41BD7E28A59E247AD2B573BACB8677 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Products\00002109F100A0C00000000000F01FEC |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Products\00002109F100A0C00000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109F100A0C00000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F100A0C00000000000F01FEC\Usage |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\6BFFEAF45FF36B342ADC37DE1B1FC241 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\6BFFEAF45FF36B342ADC37DE1B1FC241 |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\6BFFEAF45FF36B342ADC37DE1B1FC241 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Features\00002109F10090400000000000F01FEC |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Features\00002109F10090400000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\00002109F10090400000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F10090400000000000F01FEC\Features |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FBFC0F36C55A64A439A747B668E50D4D |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41F463C603D4CFE4290226B0966AFF87 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B812766B2315D14EB7B147A0DC96653 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF59970FE4207784CB006918B6A8400B |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Products\00002109F10090400000000000F01FEC |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Products\00002109F10090400000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109F10090400000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F10090400000000000F01FEC\Usage |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Features\00002109F100C0400000000000F01FEC |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Features\00002109F100C0400000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\00002109F100C0400000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F100C0400000000000F01FEC\Features |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\072FB27307B79A84981E90D9D7FD34F3 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\848E74D12EF64E04B87C08B37F9DFA31 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\28BA0E7878234D11C85300008F40C0E5 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\48BA0E7878234D11C85300008F40C0E5 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\89529A66F52EE824286E5D7280BF2B9C |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D5F721B7BEE8EC4DA5E526F139246D0 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Products\00002109F100C0400000000000F01FEC |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Products\00002109F100C0400000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109F100C0400000000000F01FEC |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F100C0400000000000F01FEC\Usage |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1 |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Grammar |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Language Auto Detect |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Formatting Consistency Checker |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Smart Tag |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\34BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\34BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\34BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Thesaurus |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\53BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\53BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\53BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Hyphenation |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\HangulHanjaConv |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Dictionary |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\F4BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\F4BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\F4BE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Word Forms |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools Location |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2447246F41EC398429FCD2997760A0F5 |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries\ |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\SpecialtyLexicons |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\PTWatson |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\DateTime |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\285E35716D00D104F994678A97F78A0A |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\285E35716D00D104F994678A97F78A0A |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Proofing Tools\Language |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033 |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 0 |
| HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 1 |
| HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Explorer\AutoComplete |
| HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Explorer\AutoComplete |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete |
| CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062} |
| CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TreatAs |
| \CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062} |
| \CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocServer32 |
| \CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocServerX86 |
| \CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\LocalServer32 |
| \CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocHandler32 |
| \CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocHandlerX86 |
| \CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062} |
| HKEY_CLASSES_ROOT\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TreatAs |
| CLSID\{03C036F1-A186-11D0-824A-00AA005B4383} |
| CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TreatAs |
| \CLSID\{03C036F1-A186-11D0-824A-00AA005B4383} |
| \CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocServer32 |
| \CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocServerX86 |
| \CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\LocalServer32 |
| \CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocHandler32 |
| \CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocHandlerX86 |
| \CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383} |
| HKEY_CLASSES_ROOT\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TreatAs |
| CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062} |
| CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TreatAs |
| \CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062} |
| \CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocServer32 |
| \CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocServerX86 |
| \CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\LocalServer32 |
| \CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocHandler32 |
| \CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocHandlerX86 |
| \CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062} |
| HKEY_CLASSES_ROOT\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TreatAs |
| HKEY_CLASSES_ROOT\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32 |
| HKEY_CLASSES_ROOT\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32 |
| HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced |
| HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Performance |
| HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers |
| HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\CDF |
| HKEY_CLASSES_ROOT\CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13}\InProcServer32 |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{67ea19a0-ccef-11d0-8024-00c04fd75d13}\InProcServer32 |
| CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13} |
| CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13}\TreatAs |
| \CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13} |
| \CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13}\InprocServer32 |
| \CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13}\InprocServerX86 |
| \CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13}\LocalServer32 |
| \CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13}\InprocHandler32 |
| \CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13}\InprocHandlerX86 |
| \CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13} |
| HKEY_CLASSES_ROOT\CLSID\{67EA19A0-CCEF-11D0-8024-00C04FD75D13}\TreatAs |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{67EA19A0-CCEF-11D0-8024-00C04FD75D13} |
| HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\FileSystem |
| HKEY_CLASSES_ROOT\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\InProcServer32 |
| HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\MyDocuments |
| HKEY_CLASSES_ROOT\CLSID\{ECF03A33-103D-11D2-854D-006008059367}\InProcServer32 |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ecf03a33-103d-11d2-854d-006008059367}\InProcServer32 |
| CLSID\{ECF03A33-103D-11D2-854D-006008059367} |
| CLSID\{ECF03A33-103D-11D2-854D-006008059367}\TreatAs |
| \CLSID\{ECF03A33-103D-11D2-854D-006008059367} |
| \CLSID\{ECF03A33-103D-11D2-854D-006008059367}\InprocServer32 |
| \CLSID\{ECF03A33-103D-11D2-854D-006008059367}\InprocServerX86 |
| \CLSID\{ECF03A33-103D-11D2-854D-006008059367}\LocalServer32 |
| \CLSID\{ECF03A33-103D-11D2-854D-006008059367}\InprocHandler32 |
| \CLSID\{ECF03A33-103D-11D2-854D-006008059367}\InprocHandlerX86 |
| \CLSID\{ECF03A33-103D-11D2-854D-006008059367}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{ECF03A33-103D-11D2-854D-006008059367} |
| HKEY_CLASSES_ROOT\CLSID\{ECF03A33-103D-11D2-854D-006008059367}\TreatAs |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{ECF03A33-103D-11D2-854D-006008059367} |
| HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\Sharing |
| HKEY_CLASSES_ROOT\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\InProcServer32 |
| CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} |
| CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\TreatAs |
| \CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} |
| \CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\InprocServer32 |
| \CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\InprocServerX86 |
| \CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\LocalServer32 |
| \CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\InprocHandler32 |
| \CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\InprocHandlerX86 |
| \CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} |
| HKEY_CLASSES_ROOT\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\TreatAs |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ProductOptions |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1547161642-507921405-839522115-1004 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\bjxjVBc.exe |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor |
| HKEY_CURRENT_USER\Software\Microsoft\Command Processor |
| HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency |
| HKEY_CURRENT_USER\Software\Microsoft\.NETFramework\Policy\Standards |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\Standards |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\Standards\v2.0.50727 |
| HKEY_CURRENT_USER\Software\Microsoft\.NETFramework |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion |
| HKEY_CURRENT_USER\Software\Microsoft\Fusion |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Internet |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\LocalIntranet |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index59 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9\1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\319545b3\1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7febc6fd\b9ff26e |
| HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\52628d2e |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\52628d2e\2d |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\268e923b\24 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\3fcdfaca\10 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\7f729234\e |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\61a5c1bb\44 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\6abb48d8\39 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\643db07b\27 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\7949fb97\45 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\1d498232\8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\67e63d5c\6 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\291a02d0\7 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6e9ac653\8 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\ebc8f48 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\ebc8f48\3a |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\30041bb6\4c |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\43970528\4b |
| CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884} |
| CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884}\TreatAs |
| \CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884} |
| \CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884}\InprocServer32 |
| \CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884}\InprocServerX86 |
| \CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884}\LocalServer32 |
| \CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884}\InprocHandler32 |
| \CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884}\InprocHandlerX86 |
| \CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884} |
| HKEY_CLASSES_ROOT\CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884}\TreatAs |
| HKEY_CLASSES_ROOT\CLSID\{A8F03BE3-EDB7-4972-821F-AF6F8EA34884}\Server |
| HKEY_CLASSES_ROOT\AppID\bjxjVBc.exe |
| CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA} |
| CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TreatAs |
| \CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA} |
| \CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 |
| \CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServerX86 |
| \CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\LocalServer32 |
| \CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocHandler32 |
| \CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocHandlerX86 |
| \CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA} |
| HKEY_CLASSES_ROOT\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TreatAs |
| CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24} |
| CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TreatAs |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24} |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServerX86 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LocalServer32 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocHandler32 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocHandlerX86 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24} |
| HKEY_CLASSES_ROOT\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TreatAs |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient |
| CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} |
| CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TreatAs |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocServer32 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocServerX86 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalServer32 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocHandler32 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocHandlerX86 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalServer |
| \AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} |
| \ProxyStubClsid32 |
| CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} |
| CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServer32 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServerX86 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\LocalServer32 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler32 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandlerX86 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} |
| HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs |
| HKEY_CLASSES_ROOT\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887} |
| HKEY_CLASSES_ROOT\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7} |
| HKEY_CLASSES_ROOT\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32 |
| CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA} |
| CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA} |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServerX86 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LocalServer32 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler32 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandlerX86 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA} |
| HKEY_CLASSES_ROOT\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 |
| HKEY_CLASSES_ROOT\Interface\{027947E1-D731-11CE-A357-000000000001} |
| HKEY_CLASSES_ROOT\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32 |
| CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD} |
| CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD} |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServerX86 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\LocalServer32 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandlerX86 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD} |
| HKEY_CLASSES_ROOT\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs |
| HKEY_CLASSES_ROOT\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD} |
| HKEY_CLASSES_ROOT\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32 |
| HKEY_CLASSES_ROOT\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD} |
| HKEY_CLASSES_ROOT\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\69db6748 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\69db6748\11 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2995e574\9 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\3914f670\25 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4426ac2f\21 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\31de29a4\b |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004_Classes\InstalledUIs |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\{90120000-0030-0000-0000-0000000FF1CE} |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\58CE92CC2CB71D119A12000A9CE1A22A |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\58CE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\58CE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1547161642-507921405-839522115-1004\Installer\Components\96CE92CC2CB71D119A12000A9CE1A22A |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Installer\Components\96CE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\96CE92CC2CB71D119A12000A9CE1A22A |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Word\Text Converters\Import |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Word\Text Converters\Export |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\HTML |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\MEWord12 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\MSWord8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\MSWorksWin6 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\Recover |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\Word12 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\Word97 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\WordPerfect6x |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import\WrdPrfctDos |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Export |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Export\HTML |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Export\MEWord12 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Export\MSWorksWin6 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Export\Word12 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Export\Word97 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\COM3\{475c7950-e3d2-11e0-8d7a-806d6172696f}\ |
| HKEY_CLASSES_ROOT\Typelib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.4\0\win32\TreatAs |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{7bd29e01-76c1-11cf-9dd0-00a0c9034933}\InProcServer32\Resiliency |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{7bd29e01-76c1-11cf-9dd0-00a0c9034933}\InProcServer32\Resiliency\StartupItems |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\DRM |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Draw |
| HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\DocumentRecovery\C616D5 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QcKFqM.dll |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Offload |
| HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla |
| HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\bin |
| HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 6.0.2\bin |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Mozilla Firefox\bin |
| HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine |
| HKEY_LOCAL_MACHINE\Software\Classes\Software\Qualcomm\Eudora\CommandLine\current |
| HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird |
| HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts |
| HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts |
| HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts |
| HKEY_CURRENT_USER\Identities |
| HKEY_CURRENT_USER\Identities\{48FC7AFE-B9DD-4692-B12E-8A59C42FC44D} |
| HKEY_CURRENT_USER\Identities\{48FC7AFE-B9DD-4692-B12E-8A59C42FC44D}\Software\Microsoft\Internet Account Manager\Accounts |
| HKEY_CURRENT_USER\Identities\{48FC7AFE-B9DD-4692-B12E-8A59C42FC44D}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts |
| HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles |
| HKEY_CURRENT_USER\Software\IncrediMail\Identities |
| HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities |
| HKEY_LOCAL_MACHINE\Software\Group Mail |
| HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger |
| HKEY_CURRENT_USER\Software\Yahoo\Pager |
| HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL |
| HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail |
Comments
User comments about 709bb4cb8a5abb0fddfb4e02199b7724f971f3581e42019c12400fab27a719fb.
User comments about 709bb4cb8a5abb0fddfb4e02199b7724f971f3581e42019c12400fab27a719fb.
NOTICE: We have updated our privacy terms and conditions in accordance to GDPR. By using our site, you acknowledge that you have read and understand our Privacy Policy. Your use of ThreatMiner’s Products and Services is subject to these policies and terms.
ThreatMiner.org is a non-profit initiative and is licensed under a Creative Commons Attribution 4.0 International License.