API tools faq
paste
Advertisement
DaveMarcus

LadenDoc RegSnapshotDiff

DaveMarcus
May 3rd, 2011
1,608
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 64.36 KB | None | 0 0
raw download clone embed print report
  1. Regshot 1.8.2
  2. Comments:
  3. Datetime:2011/5/3 15:48:14 , 2011/5/3 15:49:04
  4. Computer:DMARCUS-GOAT , DMARCUS-GOAT
  5. Username:dmarcus , dmarcus
  6.  
  7. ----------------------------------
  8. Keys deleted:1
  9. ----------------------------------
  10. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24
  11.  
  12. ----------------------------------
  13. Keys added:107
  14. ----------------------------------
  15. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\MenuExt
  16. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel
  17. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.imaadpcm
  18. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.msgsm610
  19. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Offline
  20. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Offline\Files
  21. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag
  22. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions
  23. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}
  24. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A}
  25. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}
  26. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{579A3C71-2339-4dee-A735-24BF2D1C5814}
  27. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}
  28. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F}
  29. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}
  30. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers
  31. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{32D85DA2-070B-49A0-9261-E7854457A6D6}
  32. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{579A3C71-2339-4dee-A735-24BF2D1C5814}
  33. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}
  34. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#phone
  35. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#time
  36. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}
  37. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0
  38. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common
  39. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General
  40. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources
  41. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
  42. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\MailSettings
  43. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\Migration
  44. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\Migration\Office
  45. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\Migration\Word
  46. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\ReviewCycle
  47. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel
  48. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security
  49. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations
  50. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location0
  51. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location1
  52. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location2
  53. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location3
  54. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location4
  55. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location5
  56. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint
  57. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security
  58. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations
  59. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location0
  60. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location1
  61. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location2
  62. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location3
  63. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings
  64. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\AccessDE_Core
  65. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Ace_OdbcCurrentUser
  66. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Excel_Core
  67. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Excel_Intl
  68. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Graph_Core
  69. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_Core
  70. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_CoreReg
  71. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_Intl
  72. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\PowerPoint_Core
  73. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\PowerPoint_Intl
  74. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Word_Core
  75. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Word_Intl
  76. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\XDocs_XMLEditVerbHandler
  77. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word
  78. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Options
  79. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency
  80. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
  81. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security
  82. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations
  83. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location0
  84. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location1
  85. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location2
  86. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Wizards
  87. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithList
  88. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.doc
  89. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\WHCIconStartup
  90. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions
  91. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\ASF Stream Descriptor File
  92. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\ASF Stream Descriptor File\Settings
  93. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MS Design Tools
  94. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MS Design Tools\MDTDBD
  95. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP
  96. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers
  97. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD570-B9D4-11D1-9C78-0000F875AC61}
  98. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}
  99. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared
  100. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools
  101. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping
  102. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook
  103. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling
  104. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
  105. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint
  106. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word
  107. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers
  108. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive
  109. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com
  110. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC
  111. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI
  112. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files
  113. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines
  114. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase
  115. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files
  116. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines
  117. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet
  118. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database
  119. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines
  120. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet
  121. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\ODBC Data Sources
  122.  
  123. ----------------------------------
  124. Values deleted:7
  125. ----------------------------------
  126. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\CrawlType: 0x00000002
  127. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\InProgress: 0x00000001
  128. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\DoneAddingCrawlSeeds: 0x00000000
  129. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\IsCatalogLevel: 0x00000000
  130. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\LogStartAddId: 0x00000002
  131. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\C:\Users\dmarcus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk: 0x00000001
  132. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk: 0x00000001
  133.  
  134. ----------------------------------
  135. Values added:299
  136. ----------------------------------
  137. HKLM\SOFTWARE\Microsoft\FTH\CheckPointTime: 0x0CDD1414
  138. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage\SpellingAndGrammarFiles_1033: 0x3EA30001
  139. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004119110000000000000000F01FEC\Usage\WORDFiles: 0x3EA30002
  140. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004119110000000000000000F01FEC\Usage\ProductFiles: 0x3EA30002
  141. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-2: "Microsoft Script Detection"
  142. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-5: "Microsoft Transliteration Engine"
  143. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-4: "Microsoft Simplified Chinese to Traditional Chinese Transliteration"
  144. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-6: "Microsoft Cyrillic to Latin Transliteration"
  145. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-3: "Microsoft Traditional Chinese to Simplified Chinese Transliteration"
  146. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-7: "Microsoft Devanagari to Latin Transliteration"
  147. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-8: "Microsoft Malayalam to Latin Transliteration"
  148. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-9: "Microsoft Bengali to Latin Transliteration"
  149. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-1: "Microsoft Language Detection"
  150. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton: "Yes"
  151. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\: "res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000"
  152. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts: 0x00000001
  153. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTEncodeSetting: 0x00000006
  154. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTDecodeSetting: 0x00000006
  155. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.msgsm610\MaxRTDecodeSetting: 0x00000004
  156. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.msgsm610\MaxRTEncodeSetting: 0x00000004
  157. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\UserInfo\Company: ""
  158. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\UserInfo\UserInitials: "d"
  159. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}\XLMAIN: 0x00000001
  160. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}\PPFrameClass: 0x00000001
  161. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}\PPFrameClass: 0x00000001
  162. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}\Internet Explorer_Server: 0x00000001
  163. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}\OpusApp: 0x00000001
  164. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}\IEFrame: 0x00000001
  165. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#time\OpusApp: 0x00000001
  166. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#time\XLMAIN: 0x00000002
  167. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#time\PPFrameClass: 0x00000002
  168. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#phone\XLMAIN: 0x00000002
  169. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#phone\PPFrameClass: 0x00000002
  170. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}\XLMAIN: 0x00000002
  171. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{32D85DA2-070B-49A0-9261-E7854457A6D6}\XLMAIN: 0x00000002
  172. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages\1033: "On"
  173. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\ReviewCycle\ReviewToken: "{B78C7BCD-1219-4992-BBD6-8A70CA91BF3A}"
  174. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\MailSettings\Template: ""
  175. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\UISnapshot: 31 30 33 33 00
  176. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\UIFallback: 30 3B 31 30 33 33 00
  177. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\HelpFallback: 30 3B 31 30 33 33 00
  178. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\UILanguage: 0x00000409
  179. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\HelpLanguage: 0x00000409
  180. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\WinXPLanguagePatch: 0x00000001
  181. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\InstallLanguage: 0x00000409
  182. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\PreviousInstallLanguage: 0x00000409
  183. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\WordChangeInstallLanguage: "No"
  184. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\WordMailChangeInstallLanguage: "No"
  185. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\XLChangeInstallLanguage: "No"
  186. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\PPTChangeInstallLanguage: "No"
  187. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\AccessChangeInstallLanguage: "No"
  188. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\OutlookChangeInstallLanguage: "No"
  189. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\SharePointDesignerChangeInstallLanguage: "No"
  190. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\PublisherChangeInstallLanguage: "No"
  191. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\ProjectChangeInstallLanguage: "No"
  192. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\InfoPathChangeInstallLanguage: "No"
  193. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\OneNoteChangeInstallLanguage: "No"
  194. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\WebDesignerChangeInstallLanguage: "No"
  195. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\LangTuneUp: "OfficeCompleted"
  196. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\ShowDates: "ON"
  197. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Xlstart: "XLSTART"
  198. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Themes: "Themes"
  199. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Templates: "Templates"
  200. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Stationery: "Stationery"
  201. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Startup: "STARTUP"
  202. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Signatures: "Signatures"
  203. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\RecentFiles: "Recent"
  204. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Queries: "Queries"
  205. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Proof: "Proof"
  206. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\MyPictures: "My Pictures"
  207. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\MyDocuments: "My Documents"
  208. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Favorites: "Favorites"
  209. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Desktop: "Desktop"
  210. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\ApplicationData: "Application Data"
  211. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\AddIns: "AddIns"
  212. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Actors: "Actors"
  213. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\FirstRun: 0x00000000
  214. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location5\AllowSubFolders: 0x00000001
  215. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location5\Path: "C:\Program Files\Microsoft Office\Office14\Library\"
  216. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location5\Description: "12"
  217. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location4\AllowSubFolders: 0x00000001
  218. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location4\Path: "C:\Program Files\Microsoft Office\Office14\STARTUP\"
  219. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location4\Description: "7"
  220. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location3\AllowSubFolders: 0x00000001
  221. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location3\Path: "C:\Program Files\Microsoft Office\Templates\"
  222. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location3\Description: "6"
  223. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location2\Path: "%APPDATA%\Microsoft\Templates"
  224. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location2\Description: "5"
  225. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location1\Path: "%APPDATA%\Microsoft\Excel\XLSTART"
  226. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location1\Description: "4"
  227. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location0\AllowSubFolders: 0x00000001
  228. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location0\Path: "C:\Program Files\Microsoft Office\Office14\XLSTART\"
  229. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location0\Description: "3"
  230. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location3\AllowSubFolders: 0x00000001
  231. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location3\Path: "C:\Program Files\Microsoft Office\Document Themes 14\"
  232. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location3\Description: "11"
  233. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location2\Path: "%APPDATA%\Microsoft\Addins"
  234. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location2\Description: "10"
  235. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location1\AllowSubFolders: 0x00000001
  236. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location1\Path: "C:\Program Files\Microsoft Office\Templates\"
  237. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location1\Description: "9"
  238. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location0\AllowSubFolders: 0x00000001
  239. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location0\Path: "%APPDATA%\Microsoft\Templates"
  240. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location0\Description: "8"
  241. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\XDocs_XMLEditVerbHandler\Count: 0x00000001
  242. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Word_Intl\Count: 0x00000001
  243. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Word_Core\Count: 0x00000001
  244. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\PowerPoint_Intl\Count: 0x00000001
  245. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\PowerPoint_Core\Count: 0x00000001
  246. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_Intl\Count: 0x00000001
  247. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_CoreReg\Count: 0x00000001
  248. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_Core\Count: 0x00000001
  249. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Graph_Core\Count: 0x00000001
  250. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Excel_Intl\Count: 0x00000001
  251. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Excel_Core\Count: 0x00000001
  252. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Ace_OdbcCurrentUser\Count: 0x00000001
  253. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\AccessDE_Core\Count: 0x00000001
  254. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems\a): 7F 61 29 00 00 09 00 00 01 00 00 00 00 00 00 00 00 00 00 00
  255. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems\8i): 38 69 29 00 00 09 00 00 06 00 00 00 01 00 00 00 92 00 00 00 02 00 00 00 82 00 00 00 04 00 00 00 63 00 3A 00 5C 00 75 00 73 00 65 00 72 00 73 00 5C 00 64 00 6D 00 61 00 72 00 63 00 75 00 73 00 5C 00 64 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 6D 00 61 00 6C 00 77 00 61 00 72 00 65 00 5C 00 6C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 64 00 65 00 61 00 74 00 68 00 5C 00 6C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 64 00 65 00 61 00 74 00 68 00 2E 00 64 00 6F 00 63 00 00 00 00 00 00 00
  256. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems\vn): 76 6E 29 00 00 09 00 00 0B 00 00 00 00 00 00 00 00 00 00 00
  257. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems\&.*: 26 2E 2A 00 00 09 00 00 0A 00 00 00 01 00 00 00 00 00 00 00
  258. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location2\Path: "%APPDATA%\Microsoft\Word\Startup"
  259. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location2\Description: "2"
  260. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location1\AllowSubFolders: 0x00000001
  261. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location1\Path: "C:\Program Files\Microsoft Office\Templates\"
  262. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location1\Description: "1"
  263. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location0\Path: "%APPDATA%\Microsoft\Templates"
  264. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location0\Description: "0"
  265. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Wizards\PageSize: "Letter"
  266. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Options\PROGRAMDIR: "C:\Program Files\Microsoft Office\Office14\"
  267. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Options\FirstRun: 0x00000000
  268. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\FontInfoCacheW: 60 00 < EDITED FOR SPACE> 20 05 00 00 00
  269. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\MTTA: 0x00000021
  270. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithList\a: "WINWORD.EXE"
  271. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithList\MRUList: "a"
  272. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\17: 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 2E 00 64 00 6F 00 63 00 00 00 70 00 32 00 00 00 00 00 00 00 00 00 00 00 4C 61 64 65 6E 27 73 20 44 65 61 74 68 2E 6C 6E 6B 00 50 00 08 00 04 00 EF BE 00 00 00 00 00 00 00 00 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 2E 00 6C 00 6E 00 6B 00 00 00 20 00 00 00
  273. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\18: 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 00 00 7C 00 32 00 00 00 00 00 00 00 00 00 00 00 4C 61 64 65 6E 27 73 20 44 65 61 74 68 20 28 32 29 2E 6C 6E 6B 00 58 00 08 00 04 00 EF BE 00 00 00 00 00 00 00 00 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 20 00 28 00 32 00 29 00 2E 00 6C 00 6E 00 6B 00 00 00 24 00 00 00
  274. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\11: 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 00 00 7C 00 32 00 00 00 00 00 00 00 00 00 00 00 4C 61 64 65 6E 27 73 20 44 65 61 74 68 20 28 32 29 2E 6C 6E 6B 00 58 00 08 00 04 00 EF BE 00 00 00 00 00 00 00 00 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 20 00 28 00 32 00 29 00 2E 00 6C 00 6E 00 6B 00 00 00 24 00 00 00
  275. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.doc\0: 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 2E 00 64 00 6F 00 63 00 00 00 70 00 32 00 00 00 00 00 00 00 00 00 00 00 4C 61 64 65 6E 27 73 20 44 65 61 74 68 2E 6C 6E 6B 00 50 00 08 00 04 00 EF BE 00 00 00 00 00 00 00 00 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 2E 00 6C 00 6E 00 6B 00 00 00 20 00 00 00
  276. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.doc\MRUListEx: 00 00 00 00 FF FF FF FF
  277. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\JVAJBEQ.RKR: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF F0 D9 F2 85 A9 09 CC 01 00 00 00 00
  278. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\NumRegistrationRuns: 0x00000006
  279. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\rtf: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.rtf"
  280. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\dot: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.dot"
  281. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\dotm: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.dotm"
  282. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\dotx: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.dotx"
  283. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\docm: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.docm"
  284. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\docx: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.docx"
  285. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\doc: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.doc"
  286. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\xlsx: "C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE"
  287. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\xls: "C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE"
  288. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\ASF Stream Descriptor File\Settings\Don't Show Boot Dialog: 0x00000000
  289. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MS Design Tools\MDTDBD\AutoSaveChangeScript: "0"
  290. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}\: "Microsoft Data Access Internet Publishing Provider WEC"
  291. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}\Priority: 0x01000000
  292. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}\ThreadSensitive: 0x00000001
  293. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD570-B9D4-11D1-9C78-0000F875AC61}\: "Microsoft Data Access Internet Publishing Provider DAV"
  294. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD570-B9D4-11D1-9C78-0000F875AC61}\Priority: 0x08800000
  295. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared\OfficeUILanguage: 0x00000409
  296. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\Description: "Microsoft Word"
  297. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\AutoJournaled: 0x00000001
  298. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\Large Icon: "[13]"
  299. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\Small Icon: "[13]"
  300. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\Description: "Microsoft PowerPoint"
  301. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\AutoJournaled: 0x00000001
  302. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\Small Icon: "[15]"
  303. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\Large Icon: "[15]"
  304. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel\Description: "Microsoft Excel"
  305. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel\AutoJournaled: 0x00000001
  306. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel\Large Icon: "[14]"
  307. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel\Small Icon: "[14]"
  308. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Meiryo: "MS Gothic"
  309. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Monotype Sorts: "ZapfDingbats"
  310. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Monotype Corsiva: "ZapfChancery"
  311. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\ZapfDingbats: "Zapf Dingbats"
  312. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\ZapfChancery: "Zapf Chancery"
  313. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Univers: "Univers (W1)"
  314. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Univers_Scale: "Univers"
  315. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Times: "Times Roman"
  316. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Tms Rmn: "Times Roman"
  317. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\New York: "Times New Roman"
  318. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\CG Times (W1): "Times New Roman"
  319. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Times Roman: "Times New Roman"
  320. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Times New Roman: "Times"
  321. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\MT Symbol: "Symbol"
  322. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\PSD: "Roman PX"
  323. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier PS: "Roman PS"
  324. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\PS: "Roman PS"
  325. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier 6cpi: "Roman 6cpi"
  326. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\EliteD: "Roman 6cpi"
  327. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\PicaD: "Roman 5cpi"
  328. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier 5cpi: "Roman 5cpi"
  329. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier 12cpi: "Roman 12cpi"
  330. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Elite: "Roman 12cpi"
  331. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier 10cpi: "Roman 10cpi"
  332. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\NLQ: "Roman 10cpi"
  333. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Pica: "Roman 10cpi"
  334. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Book Antiqua: "Palatino"
  335. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Los Angeles: "Onyx"
  336. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\London: "Old English Text MT"
  337. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\NLQDblHigh: "NLQII 10cpi"
  338. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Century Schoolbook: "NewCenturySchlbk"
  339. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\NewCenturySchlbk: "New Century Schlbk"
  340. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\CourierPC: "MS LineDraw"
  341. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Zapf Dingbats: "Monotype Sorts"
  342. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Zapf Chancery: "Monotype Corsiva"
  343. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\HGGothicE-PRO: "HGPGothicE"
  344. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Arial Narrow: "Helvetica-Narrow"
  345. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Helvetica-Narrow: "Helvetica Narrow"
  346. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Helv: "Helvetica"
  347. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Arial: "Helvetica"
  348. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Garamond MT: "Garamond"
  349. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\FE Font 2: "FE Font 2"
  350. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\FE Font 1: "FE Font 1"
  351. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\PSNLQ: "Courier PS"
  352. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman PS: "Courier PS"
  353. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\linedraw: "Courier New,437"
  354. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\MS LineDraw: "Courier New,437"
  355. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Monaco: "Courier New"
  356. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier: "Courier New"
  357. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Letter Gothic: "Courier New"
  358. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman 6cpi: "Courier 6cpi"
  359. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman 5cpi: "Courier 5cpi"
  360. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman 12cpi: "Courier 12cpi"
  361. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman 10cpi: "Courier 10cpi"
  362. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier New: "Courier"
  363. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\CG Times: "CG Times (W1)"
  364. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\CGTimes_Scale: "CG Times"
  365. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\New Century Schlbk: "Century Schoolbook"
  366. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Avant Garde: "Century Gothic"
  367. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Gothic: "Century Gothic"
  368. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Bookman: "Bookman Old Style"
  369. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Bookman Old Style: "Bookman"
  370. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Palatino: "Book Antiqua"
  371. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Century Gothic: "AvantGarde"
  372. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\AvantGarde: "Avant Garde"
  373. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Kafisma: "Arial,866"
  374. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Helvetica Narrow: "Arial Narrow"
  375. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Helvetica: "Arial"
  376. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Chicago: "Arial"
  377. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Geneva: "Arial"
  378. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Univers (W1): "Arial"
  379. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\WizardName: "New Web Site on MSN"
  380. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\Shortcut: "My Web Sites on MSN"
  381. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\ShortcutUrl: "http://www.msnusers.com"
  382. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\NewWDUrl: "http://r.office.microsoft.com/r/rlidNetworkPlaces?clid=1033&app=Office10&select=no"
  383. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\ManageWDUrl: "http://r.office.microsoft.com/r/rlidManageNetworkPlaces?clid=1033"
  384. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\Icon: "C:\PROGRA~1\MICROS~2\Office14\MSN.ICO"
  385. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\CreateShortcuts: 0x00000001
  386. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/rtf: "RTF"
  387. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/msword: "DOC"
  388. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/msexcel: "XLS"
  389. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/ppt: "PPT"
  390. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/pps: "PPS"
  391. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/pot: "POT"
  392. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE5: "application/rtf"
  393. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/msword: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE"
  394. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/rtf: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE"
  395. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/msexcel: "C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE"
  396. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE6: "application/ppt"
  397. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE8: "application/pps"
  398. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE7: "application/pot"
  399. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/pps: "C:\PROGRA~1\MICROS~2\Office14\POWERPNT.EXE"
  400. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/ppt: "C:\PROGRA~1\MICROS~2\Office14\POWERPNT.EXE"
  401. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/pot: "C:\PROGRA~1\MICROS~2\Office14\POWERPNT.EXE"
  402. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase\UserCommitSync: "Yes"
  403. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase\Threads: 0x00000003
  404. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase\ImplicitCommitSync: ""
  405. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\UserCommitSync: "Yes"
  406. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\Threads: 0x00000003
  407. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\ImplicitCommitSync: ""
  408. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\FirstRowHasNames: 01
  409. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet\UserCommitSync: "Yes"
  410. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet\Threads: 0x00000003
  411. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet\ImplicitCommitSync: ""
  412. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\ODBC Data Sources\dBASE Files: "Microsoft Access dBASE Driver (*.dbf, *.ndx, *.mdx)"
  413. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\ODBC Data Sources\Excel Files: "Microsoft Excel Driver (*.xls, *.xlsx, *.xlsm, *.xlsb)"
  414. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\ODBC Data Sources\MS Access Database: "Microsoft Access Driver (*.mdb, *.accdb)"
  415. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\UID: ""
  416. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\SafeTransactions: 0x00000000
  417. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\DriverId: 0x00000019
  418. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Driver: "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\ACEODBC.DLL"
  419. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\UID: ""
  420. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\SafeTransactions: 0x00000000
  421. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\DriverId: 0x00000416
  422. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Driver: "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\ACEODBC.DLL"
  423. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\UID: ""
  424. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\SafeTransactions: 0x00000000
  425. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\DriverId: 0x00000215
  426. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Driver: "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\ACEODBC.DLL"
  427. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-2: "Microsoft Script Detection"
  428. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-5: "Microsoft Transliteration Engine"
  429. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-4: "Microsoft Simplified Chinese to Traditional Chinese Transliteration"
  430. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-6: "Microsoft Cyrillic to Latin Transliteration"
  431. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-3: "Microsoft Traditional Chinese to Simplified Chinese Transliteration"
  432. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-7: "Microsoft Devanagari to Latin Transliteration"
  433. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-8: "Microsoft Malayalam to Latin Transliteration"
  434. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-9: "Microsoft Bengali to Latin Transliteration"
  435. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-1: "Microsoft Language Detection"
  436.  
  437. ----------------------------------
  438. Values modified:16
  439. ----------------------------------
  440. HKLM\SOFTWARE\McAfee\Agent\lpc\lpc_throb: "1304437684"
  441. HKLM\SOFTWARE\McAfee\Agent\lpc\lpc_throb: "1304437713"
  442. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009\Counter: 31 00 31 < EDITED FOR SPACE >73 00 32 30 32 32 00 43 75 72 72 65 6E 74 43 6F 6E 74 65 78 74 73 00 32 30 32 34 00 43 75 72 72 65 6E 74 52 65 73 6F 75 72 63 65 73 00 00 00
  443. HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex\pkm:catalog:LastCatalogCrawlEndTime: 95 72 D8 89 A8 09 CC 01
  444. HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex\pkm:catalog:LastCatalogCrawlEndTime: 92 1F DD 94 A9 09 CC 01
  445. HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex\pkm:catalog:LastCatalogCrawlId: 0x00000017
  446. HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex\pkm:catalog:LastCatalogCrawlId: 0x00000018
  447. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages\2\CrawlNumberInProgress: 0x00000018
  448. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages\2\CrawlNumberInProgress: 0xFFFFFFFF
  449. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages\2\LastCrawlTime: 95 72 D8 89 A8 09 CC 01
  450. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages\2\LastCrawlTime: 92 1F DD 94 A9 09 CC 01
  451. HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{5AA844F1-1309-4E68-8236-35509D68C05D}\DhcpInterfaceOptions: FC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E4 22 C0 4D 06 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 D0 43 DE DE 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 0F 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 68 6F 6D 65 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 00 01 51 80 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 29 74 C1 4D 05 00 00 00
  452. HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{5AA844F1-1309-4E68-8236-35509D68C05D}\DhcpInterfaceOptions: FC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2B 23 C0 4D 06 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 D0 43 DE DE 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 0F 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 68 6F 6D 65 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 00 01 51 80 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 29 74 C1 4D 05 00 00 00
  453. HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{5AA844F1-1309-4E68-8236-35509D68C05D}\DhcpInterfaceOptions: FC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E4 22 C0 4D 06 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 D0 43 DE DE 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 0F 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 68 6F 6D 65 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 00 01 51 80 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 29 74 C1 4D 05 00 00 00
  454. HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{5AA844F1-1309-4E68-8236-35509D68C05D}\DhcpInterfaceOptions: FC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2B 23 C0 4D 06 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 D0 43 DE DE 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 0F 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 68 6F 6D 65 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 00 01 51 80 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 29 74 C1 4D 05 00 00 00
  455. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\MRUListEx: 10 00 00 00 0F 00 00 00 0E 00 00 00 0D 00 00 00 03 00 00 00 00 00 00 00 0C 00 00 00 0B 00 00 00 09 00 00 00 08 00 00 00 0A 00 00 00 07 00 00 00 05 00 00 00 06 00 00 00 04 00 00 00 01 00 00 00 02 00 00 00 FF FF FF FF
  456. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\MRUListEx: 12 00 00 00 11 00 00 00 10 00 00 00 0F 00 00 00 0E 00 00 00 0D 00 00 00 03 00 00 00 00 00 00 00 0C 00 00 00 0B 00 00 00 09 00 00 00 08 00 00 00 0A 00 00 00 07 00 00 00 05 00 00 00 06 00 00 00 04 00 00 00 01 00 00 00 02 00 00 00 FF FF FF FF
  457. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\MRUListEx: 0A 00 00 00 09 00 00 00 03 00 00 00 00 00 00 00 08 00 00 00 06 00 00 00 07 00 00 00 05 00 00 00 04 00 00 00 01 00 00 00 02 00 00 00 FF FF FF FF
  458. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\MRUListEx: 0B 00 00 00 0A 00 00 00 09 00 00 00 03 00 00 00 00 00 00 00 08 00 00 00 06 00 00 00 07 00 00 00 05 00 00 00 04 00 00 00 01 00 00 00 02 00 00 00 FF FF FF FF
  459. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYFRFFVBA: 00 00 00 00 < EDITED FOR SPACE > C4 E4 04 02
  460. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYFRFFVBA: 00 00 00 00 < EDITED FOR SPACE> C4 E4 04 02
  461. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr: 00 00 00 00 0E 00 00 00 5C 00 00 00 E2 00 13 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF 50 FD 85 38 A9 09 CC 01 00 00 00 00
  462. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr: 00 00 00 00 0E 00 00 00 5E 00 00 00 EF 0F 13 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF 50 FD 85 38 A9 09 CC 01 00 00 00 00
  463. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Gbbyf\ertfubg_1.8.2_fep_ova\ertfubg.rkr: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF D0 C3 0D 79 A9 09 CC 01 00 00 00 00
  464. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Gbbyf\ertfubg_1.8.2_fep_ova\ertfubg.rkr: 00 00 00 00 01 00 00 00 01 00 00 00 18 6F 00 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF D0 C3 0D 79 A9 09 CC 01 00 00 00 00
  465. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE2: "application/vnd.adobe.xfdf"
  466. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE2: "application/msexcel"
  467. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE4: "application/vnd.adobe.xdp"
  468. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE4: "application/msword"
  469.  
  470. ----------------------------------
  471. Total changes:430
  472. ----------------------------------
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!