DaveMarcus

LadenDoc RegSnapshotDiff

May 3rd, 2011
1,167
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Regshot 1.8.2
  2. Comments:
  3. Datetime:2011/5/3 15:48:14 , 2011/5/3 15:49:04
  4. Computer:DMARCUS-GOAT , DMARCUS-GOAT
  5. Username:dmarcus , dmarcus
  6.  
  7. ----------------------------------
  8. Keys deleted:1
  9. ----------------------------------
  10. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24
  11.  
  12. ----------------------------------
  13. Keys added:107
  14. ----------------------------------
  15. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\MenuExt
  16. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel
  17. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.imaadpcm
  18. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.msgsm610
  19. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Offline
  20. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Offline\Files
  21. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag
  22. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions
  23. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}
  24. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A}
  25. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}
  26. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{579A3C71-2339-4dee-A735-24BF2D1C5814}
  27. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}
  28. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F}
  29. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}
  30. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers
  31. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{32D85DA2-070B-49A0-9261-E7854457A6D6}
  32. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{579A3C71-2339-4dee-A735-24BF2D1C5814}
  33. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}
  34. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#phone
  35. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#time
  36. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}
  37. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0
  38. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common
  39. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General
  40. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources
  41. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
  42. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\MailSettings
  43. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\Migration
  44. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\Migration\Office
  45. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\Migration\Word
  46. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\ReviewCycle
  47. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel
  48. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security
  49. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations
  50. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location0
  51. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location1
  52. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location2
  53. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location3
  54. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location4
  55. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location5
  56. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint
  57. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security
  58. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations
  59. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location0
  60. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location1
  61. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location2
  62. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location3
  63. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings
  64. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\AccessDE_Core
  65. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Ace_OdbcCurrentUser
  66. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Excel_Core
  67. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Excel_Intl
  68. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Graph_Core
  69. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_Core
  70. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_CoreReg
  71. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_Intl
  72. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\PowerPoint_Core
  73. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\PowerPoint_Intl
  74. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Word_Core
  75. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Word_Intl
  76. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\XDocs_XMLEditVerbHandler
  77. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word
  78. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Options
  79. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency
  80. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
  81. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security
  82. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations
  83. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location0
  84. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location1
  85. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location2
  86. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Wizards
  87. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithList
  88. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.doc
  89. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\WHCIconStartup
  90. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions
  91. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\ASF Stream Descriptor File
  92. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\ASF Stream Descriptor File\Settings
  93. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MS Design Tools
  94. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MS Design Tools\MDTDBD
  95. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP
  96. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers
  97. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD570-B9D4-11D1-9C78-0000F875AC61}
  98. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}
  99. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared
  100. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools
  101. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping
  102. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook
  103. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling
  104. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
  105. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint
  106. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word
  107. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers
  108. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive
  109. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com
  110. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC
  111. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI
  112. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files
  113. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines
  114. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase
  115. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files
  116. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines
  117. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet
  118. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database
  119. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines
  120. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet
  121. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\ODBC Data Sources
  122.  
  123. ----------------------------------
  124. Values deleted:7
  125. ----------------------------------
  126. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\CrawlType: 0x00000002
  127. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\InProgress: 0x00000001
  128. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\DoneAddingCrawlSeeds: 0x00000000
  129. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\IsCatalogLevel: 0x00000000
  130. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24\LogStartAddId: 0x00000002
  131. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\C:\Users\dmarcus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk: 0x00000001
  132. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk: 0x00000001
  133.  
  134. ----------------------------------
  135. Values added:299
  136. ----------------------------------
  137. HKLM\SOFTWARE\Microsoft\FTH\CheckPointTime: 0x0CDD1414
  138. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage\SpellingAndGrammarFiles_1033: 0x3EA30001
  139. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004119110000000000000000F01FEC\Usage\WORDFiles: 0x3EA30002
  140. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004119110000000000000000F01FEC\Usage\ProductFiles: 0x3EA30002
  141. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-2: "Microsoft Script Detection"
  142. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-5: "Microsoft Transliteration Engine"
  143. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-4: "Microsoft Simplified Chinese to Traditional Chinese Transliteration"
  144. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-6: "Microsoft Cyrillic to Latin Transliteration"
  145. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-3: "Microsoft Traditional Chinese to Simplified Chinese Transliteration"
  146. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-7: "Microsoft Devanagari to Latin Transliteration"
  147. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-8: "Microsoft Malayalam to Latin Transliteration"
  148. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-9: "Microsoft Bengali to Latin Transliteration"
  149. HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-1: "Microsoft Language Detection"
  150. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton: "Yes"
  151. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\: "res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000"
  152. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts: 0x00000001
  153. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTEncodeSetting: 0x00000006
  154. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.imaadpcm\MaxRTDecodeSetting: 0x00000006
  155. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.msgsm610\MaxRTDecodeSetting: 0x00000004
  156. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Multimedia\msacm.msgsm610\MaxRTEncodeSetting: 0x00000004
  157. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\UserInfo\Company: ""
  158. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\UserInfo\UserInitials: "d"
  159. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}\XLMAIN: 0x00000001
  160. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}\PPFrameClass: 0x00000001
  161. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}\PPFrameClass: 0x00000001
  162. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}\Internet Explorer_Server: 0x00000001
  163. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}\OpusApp: 0x00000001
  164. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}\IEFrame: 0x00000001
  165. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#time\OpusApp: 0x00000001
  166. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#time\XLMAIN: 0x00000002
  167. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#time\PPFrameClass: 0x00000002
  168. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#phone\XLMAIN: 0x00000002
  169. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#phone\PPFrameClass: 0x00000002
  170. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}\XLMAIN: 0x00000002
  171. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{32D85DA2-070B-49A0-9261-E7854457A6D6}\XLMAIN: 0x00000002
  172. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages\1033: "On"
  173. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\ReviewCycle\ReviewToken: "{B78C7BCD-1219-4992-BBD6-8A70CA91BF3A}"
  174. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\MailSettings\Template: ""
  175. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\UISnapshot: 31 30 33 33 00
  176. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\UIFallback: 30 3B 31 30 33 33 00
  177. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\HelpFallback: 30 3B 31 30 33 33 00
  178. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\UILanguage: 0x00000409
  179. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\HelpLanguage: 0x00000409
  180. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\WinXPLanguagePatch: 0x00000001
  181. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\InstallLanguage: 0x00000409
  182. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\PreviousInstallLanguage: 0x00000409
  183. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\WordChangeInstallLanguage: "No"
  184. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\WordMailChangeInstallLanguage: "No"
  185. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\XLChangeInstallLanguage: "No"
  186. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\PPTChangeInstallLanguage: "No"
  187. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\AccessChangeInstallLanguage: "No"
  188. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\OutlookChangeInstallLanguage: "No"
  189. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\SharePointDesignerChangeInstallLanguage: "No"
  190. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\PublisherChangeInstallLanguage: "No"
  191. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\ProjectChangeInstallLanguage: "No"
  192. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\InfoPathChangeInstallLanguage: "No"
  193. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\OneNoteChangeInstallLanguage: "No"
  194. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\WebDesignerChangeInstallLanguage: "No"
  195. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\LangTuneUp: "OfficeCompleted"
  196. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\LanguageResources\ShowDates: "ON"
  197. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Xlstart: "XLSTART"
  198. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Themes: "Themes"
  199. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Templates: "Templates"
  200. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Stationery: "Stationery"
  201. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Startup: "STARTUP"
  202. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Signatures: "Signatures"
  203. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\RecentFiles: "Recent"
  204. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Queries: "Queries"
  205. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Proof: "Proof"
  206. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\MyPictures: "My Pictures"
  207. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\MyDocuments: "My Documents"
  208. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Favorites: "Favorites"
  209. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Desktop: "Desktop"
  210. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\ApplicationData: "Application Data"
  211. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\AddIns: "AddIns"
  212. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\Actors: "Actors"
  213. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Common\General\FirstRun: 0x00000000
  214. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location5\AllowSubFolders: 0x00000001
  215. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location5\Path: "C:\Program Files\Microsoft Office\Office14\Library\"
  216. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location5\Description: "12"
  217. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location4\AllowSubFolders: 0x00000001
  218. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location4\Path: "C:\Program Files\Microsoft Office\Office14\STARTUP\"
  219. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location4\Description: "7"
  220. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location3\AllowSubFolders: 0x00000001
  221. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location3\Path: "C:\Program Files\Microsoft Office\Templates\"
  222. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location3\Description: "6"
  223. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location2\Path: "%APPDATA%\Microsoft\Templates"
  224. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location2\Description: "5"
  225. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location1\Path: "%APPDATA%\Microsoft\Excel\XLSTART"
  226. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location1\Description: "4"
  227. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location0\AllowSubFolders: 0x00000001
  228. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location0\Path: "C:\Program Files\Microsoft Office\Office14\XLSTART\"
  229. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location0\Description: "3"
  230. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location3\AllowSubFolders: 0x00000001
  231. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location3\Path: "C:\Program Files\Microsoft Office\Document Themes 14\"
  232. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location3\Description: "11"
  233. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location2\Path: "%APPDATA%\Microsoft\Addins"
  234. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location2\Description: "10"
  235. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location1\AllowSubFolders: 0x00000001
  236. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location1\Path: "C:\Program Files\Microsoft Office\Templates\"
  237. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location1\Description: "9"
  238. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location0\AllowSubFolders: 0x00000001
  239. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location0\Path: "%APPDATA%\Microsoft\Templates"
  240. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\PowerPoint\Security\Trusted Locations\Location0\Description: "8"
  241. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\XDocs_XMLEditVerbHandler\Count: 0x00000001
  242. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Word_Intl\Count: 0x00000001
  243. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Word_Core\Count: 0x00000001
  244. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\PowerPoint_Intl\Count: 0x00000001
  245. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\PowerPoint_Core\Count: 0x00000001
  246. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_Intl\Count: 0x00000001
  247. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_CoreReg\Count: 0x00000001
  248. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Mso_Core\Count: 0x00000001
  249. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Graph_Core\Count: 0x00000001
  250. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Excel_Intl\Count: 0x00000001
  251. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Excel_Core\Count: 0x00000001
  252. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\Ace_OdbcCurrentUser\Count: 0x00000001
  253. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\User Settings\AccessDE_Core\Count: 0x00000001
  254. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems\a): 7F 61 29 00 00 09 00 00 01 00 00 00 00 00 00 00 00 00 00 00
  255. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems\8i): 38 69 29 00 00 09 00 00 06 00 00 00 01 00 00 00 92 00 00 00 02 00 00 00 82 00 00 00 04 00 00 00 63 00 3A 00 5C 00 75 00 73 00 65 00 72 00 73 00 5C 00 64 00 6D 00 61 00 72 00 63 00 75 00 73 00 5C 00 64 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 6D 00 61 00 6C 00 77 00 61 00 72 00 65 00 5C 00 6C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 64 00 65 00 61 00 74 00 68 00 5C 00 6C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 64 00 65 00 61 00 74 00 68 00 2E 00 64 00 6F 00 63 00 00 00 00 00 00 00
  256. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems\vn): 76 6E 29 00 00 09 00 00 0B 00 00 00 00 00 00 00 00 00 00 00
  257. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems\&.*: 26 2E 2A 00 00 09 00 00 0A 00 00 00 01 00 00 00 00 00 00 00
  258. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location2\Path: "%APPDATA%\Microsoft\Word\Startup"
  259. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location2\Description: "2"
  260. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location1\AllowSubFolders: 0x00000001
  261. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location1\Path: "C:\Program Files\Microsoft Office\Templates\"
  262. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location1\Description: "1"
  263. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location0\Path: "%APPDATA%\Microsoft\Templates"
  264. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location0\Description: "0"
  265. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Wizards\PageSize: "Letter"
  266. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Options\PROGRAMDIR: "C:\Program Files\Microsoft Office\Office14\"
  267. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\Options\FirstRun: 0x00000000
  268. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\FontInfoCacheW: 60 00 < EDITED FOR SPACE> 20 05 00 00 00
  269. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Office\14.0\Word\MTTA: 0x00000021
  270. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithList\a: "WINWORD.EXE"
  271. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithList\MRUList: "a"
  272. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\17: 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 2E 00 64 00 6F 00 63 00 00 00 70 00 32 00 00 00 00 00 00 00 00 00 00 00 4C 61 64 65 6E 27 73 20 44 65 61 74 68 2E 6C 6E 6B 00 50 00 08 00 04 00 EF BE 00 00 00 00 00 00 00 00 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 2E 00 6C 00 6E 00 6B 00 00 00 20 00 00 00
  273. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\18: 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 00 00 7C 00 32 00 00 00 00 00 00 00 00 00 00 00 4C 61 64 65 6E 27 73 20 44 65 61 74 68 20 28 32 29 2E 6C 6E 6B 00 58 00 08 00 04 00 EF BE 00 00 00 00 00 00 00 00 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 20 00 28 00 32 00 29 00 2E 00 6C 00 6E 00 6B 00 00 00 24 00 00 00
  274. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\11: 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 00 00 7C 00 32 00 00 00 00 00 00 00 00 00 00 00 4C 61 64 65 6E 27 73 20 44 65 61 74 68 20 28 32 29 2E 6C 6E 6B 00 58 00 08 00 04 00 EF BE 00 00 00 00 00 00 00 00 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 20 00 28 00 32 00 29 00 2E 00 6C 00 6E 00 6B 00 00 00 24 00 00 00
  275. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.doc\0: 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 2E 00 64 00 6F 00 63 00 00 00 70 00 32 00 00 00 00 00 00 00 00 00 00 00 4C 61 64 65 6E 27 73 20 44 65 61 74 68 2E 6C 6E 6B 00 50 00 08 00 04 00 EF BE 00 00 00 00 00 00 00 00 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 00 61 00 64 00 65 00 6E 00 27 00 73 00 20 00 44 00 65 00 61 00 74 00 68 00 2E 00 6C 00 6E 00 6B 00 00 00 20 00 00 00
  276. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.doc\MRUListEx: 00 00 00 00 FF FF FF FF
  277. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\JVAJBEQ.RKR: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF F0 D9 F2 85 A9 09 CC 01 00 00 00 00
  278. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\NumRegistrationRuns: 0x00000006
  279. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\rtf: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.rtf"
  280. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\dot: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.dot"
  281. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\dotm: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.dotm"
  282. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\dotx: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.dotx"
  283. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\docm: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.docm"
  284. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\docx: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.docx"
  285. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\doc: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE ^.doc"
  286. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\xlsx: "C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE"
  287. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Extensions\xls: "C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE"
  288. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\ASF Stream Descriptor File\Settings\Don't Show Boot Dialog: 0x00000000
  289. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MS Design Tools\MDTDBD\AutoSaveChangeScript: "0"
  290. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}\: "Microsoft Data Access Internet Publishing Provider WEC"
  291. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}\Priority: 0x01000000
  292. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}\ThreadSensitive: 0x00000001
  293. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD570-B9D4-11D1-9C78-0000F875AC61}\: "Microsoft Data Access Internet Publishing Provider DAV"
  294. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\MSDAIPP\Providers\{9FECD570-B9D4-11D1-9C78-0000F875AC61}\Priority: 0x08800000
  295. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared\OfficeUILanguage: 0x00000409
  296. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\Description: "Microsoft Word"
  297. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\AutoJournaled: 0x00000001
  298. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\Large Icon: "[13]"
  299. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\Small Icon: "[13]"
  300. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\Description: "Microsoft PowerPoint"
  301. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\AutoJournaled: 0x00000001
  302. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\Small Icon: "[15]"
  303. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft PowerPoint\Large Icon: "[15]"
  304. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel\Description: "Microsoft Excel"
  305. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel\AutoJournaled: 0x00000001
  306. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel\Large Icon: "[14]"
  307. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel\Small Icon: "[14]"
  308. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Meiryo: "MS Gothic"
  309. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Monotype Sorts: "ZapfDingbats"
  310. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Monotype Corsiva: "ZapfChancery"
  311. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\ZapfDingbats: "Zapf Dingbats"
  312. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\ZapfChancery: "Zapf Chancery"
  313. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Univers: "Univers (W1)"
  314. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Univers_Scale: "Univers"
  315. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Times: "Times Roman"
  316. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Tms Rmn: "Times Roman"
  317. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\New York: "Times New Roman"
  318. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\CG Times (W1): "Times New Roman"
  319. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Times Roman: "Times New Roman"
  320. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Times New Roman: "Times"
  321. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\MT Symbol: "Symbol"
  322. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\PSD: "Roman PX"
  323. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier PS: "Roman PS"
  324. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\PS: "Roman PS"
  325. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier 6cpi: "Roman 6cpi"
  326. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\EliteD: "Roman 6cpi"
  327. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\PicaD: "Roman 5cpi"
  328. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier 5cpi: "Roman 5cpi"
  329. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier 12cpi: "Roman 12cpi"
  330. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Elite: "Roman 12cpi"
  331. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier 10cpi: "Roman 10cpi"
  332. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\NLQ: "Roman 10cpi"
  333. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Pica: "Roman 10cpi"
  334. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Book Antiqua: "Palatino"
  335. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Los Angeles: "Onyx"
  336. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\London: "Old English Text MT"
  337. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\NLQDblHigh: "NLQII 10cpi"
  338. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Century Schoolbook: "NewCenturySchlbk"
  339. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\NewCenturySchlbk: "New Century Schlbk"
  340. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\CourierPC: "MS LineDraw"
  341. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Zapf Dingbats: "Monotype Sorts"
  342. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Zapf Chancery: "Monotype Corsiva"
  343. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\HGGothicE-PRO: "HGPGothicE"
  344. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Arial Narrow: "Helvetica-Narrow"
  345. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Helvetica-Narrow: "Helvetica Narrow"
  346. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Helv: "Helvetica"
  347. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Arial: "Helvetica"
  348. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Garamond MT: "Garamond"
  349. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\FE Font 2: "FE Font 2"
  350. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\FE Font 1: "FE Font 1"
  351. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\PSNLQ: "Courier PS"
  352. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman PS: "Courier PS"
  353. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\linedraw: "Courier New,437"
  354. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\MS LineDraw: "Courier New,437"
  355. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Monaco: "Courier New"
  356. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier: "Courier New"
  357. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Letter Gothic: "Courier New"
  358. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman 6cpi: "Courier 6cpi"
  359. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman 5cpi: "Courier 5cpi"
  360. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman 12cpi: "Courier 12cpi"
  361. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Roman 10cpi: "Courier 10cpi"
  362. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Courier New: "Courier"
  363. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\CG Times: "CG Times (W1)"
  364. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\CGTimes_Scale: "CG Times"
  365. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\New Century Schlbk: "Century Schoolbook"
  366. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Avant Garde: "Century Gothic"
  367. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Gothic: "Century Gothic"
  368. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Bookman: "Bookman Old Style"
  369. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Bookman Old Style: "Bookman"
  370. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Palatino: "Book Antiqua"
  371. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Century Gothic: "AvantGarde"
  372. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\AvantGarde: "Avant Garde"
  373. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Kafisma: "Arial,866"
  374. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Helvetica Narrow: "Arial Narrow"
  375. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Helvetica: "Arial"
  376. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Chicago: "Arial"
  377. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Geneva: "Arial"
  378. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Shared Tools\Font Mapping\Univers (W1): "Arial"
  379. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\WizardName: "New Web Site on MSN"
  380. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\Shortcut: "My Web Sites on MSN"
  381. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\ShortcutUrl: "http://www.msnusers.com"
  382. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\NewWDUrl: "http://r.office.microsoft.com/r/rlidNetworkPlaces?clid=1033&app=Office10&select=no"
  383. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\ManageWDUrl: "http://r.office.microsoft.com/r/rlidManageNetworkPlaces?clid=1033"
  384. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\www.msnusers.com\Icon: "C:\PROGRA~1\MICROS~2\Office14\MSN.ICO"
  385. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Web Service Providers\WebDrive\CreateShortcuts: 0x00000001
  386. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/rtf: "RTF"
  387. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/msword: "DOC"
  388. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/msexcel: "XLS"
  389. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/ppt: "PPT"
  390. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/pps: "PPS"
  391. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Suffixes\application/pot: "POT"
  392. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE5: "application/rtf"
  393. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/msword: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE"
  394. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/rtf: "C:\PROGRA~1\MICROS~2\Office14\WINWORD.EXE"
  395. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/msexcel: "C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE"
  396. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE6: "application/ppt"
  397. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE8: "application/pps"
  398. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE7: "application/pot"
  399. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/pps: "C:\PROGRA~1\MICROS~2\Office14\POWERPNT.EXE"
  400. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/ppt: "C:\PROGRA~1\MICROS~2\Office14\POWERPNT.EXE"
  401. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\application/pot: "C:\PROGRA~1\MICROS~2\Office14\POWERPNT.EXE"
  402. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase\UserCommitSync: "Yes"
  403. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase\Threads: 0x00000003
  404. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Engines\Xbase\ImplicitCommitSync: ""
  405. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\UserCommitSync: "Yes"
  406. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\Threads: 0x00000003
  407. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\ImplicitCommitSync: ""
  408. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\FirstRowHasNames: 01
  409. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet\UserCommitSync: "Yes"
  410. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet\Threads: 0x00000003
  411. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet\ImplicitCommitSync: ""
  412. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\ODBC Data Sources\dBASE Files: "Microsoft Access dBASE Driver (*.dbf, *.ndx, *.mdx)"
  413. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\ODBC Data Sources\Excel Files: "Microsoft Excel Driver (*.xls, *.xlsx, *.xlsm, *.xlsb)"
  414. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\ODBC Data Sources\MS Access Database: "Microsoft Access Driver (*.mdb, *.accdb)"
  415. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\UID: ""
  416. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\SafeTransactions: 0x00000000
  417. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\DriverId: 0x00000019
  418. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\MS Access Database\Driver: "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\ACEODBC.DLL"
  419. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\UID: ""
  420. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\SafeTransactions: 0x00000000
  421. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\DriverId: 0x00000416
  422. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\Excel Files\Driver: "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\ACEODBC.DLL"
  423. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\UID: ""
  424. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\SafeTransactions: 0x00000000
  425. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\DriverId: 0x00000215
  426. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\ODBC\ODBC.INI\dBASE Files\Driver: "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\ACEODBC.DLL"
  427. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-2: "Microsoft Script Detection"
  428. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-5: "Microsoft Transliteration Engine"
  429. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-4: "Microsoft Simplified Chinese to Traditional Chinese Transliteration"
  430. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-6: "Microsoft Cyrillic to Latin Transliteration"
  431. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-3: "Microsoft Traditional Chinese to Simplified Chinese Transliteration"
  432. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-7: "Microsoft Devanagari to Latin Transliteration"
  433. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-8: "Microsoft Malayalam to Latin Transliteration"
  434. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-9: "Microsoft Bengali to Latin Transliteration"
  435. HKU\S-1-5-18\Software\Classes\Local Settings\MuiCache\28\52C64B7E\C:\Windows\system32,@elscore.dll,-1: "Microsoft Language Detection"
  436.  
  437. ----------------------------------
  438. Values modified:16
  439. ----------------------------------
  440. HKLM\SOFTWARE\McAfee\Agent\lpc\lpc_throb: "1304437684"
  441. HKLM\SOFTWARE\McAfee\Agent\lpc\lpc_throb: "1304437713"
  442. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009\Counter: 31 00 31 < EDITED FOR SPACE >73 00 32 30 32 32 00 43 75 72 72 65 6E 74 43 6F 6E 74 65 78 74 73 00 32 30 32 34 00 43 75 72 72 65 6E 74 52 65 73 6F 75 72 63 65 73 00 00 00
  443. HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex\pkm:catalog:LastCatalogCrawlEndTime: 95 72 D8 89 A8 09 CC 01
  444. HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex\pkm:catalog:LastCatalogCrawlEndTime: 92 1F DD 94 A9 09 CC 01
  445. HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex\pkm:catalog:LastCatalogCrawlId: 0x00000017
  446. HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex\pkm:catalog:LastCatalogCrawlId: 0x00000018
  447. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages\2\CrawlNumberInProgress: 0x00000018
  448. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages\2\CrawlNumberInProgress: 0xFFFFFFFF
  449. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages\2\LastCrawlTime: 95 72 D8 89 A8 09 CC 01
  450. HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages\2\LastCrawlTime: 92 1F DD 94 A9 09 CC 01
  451. HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{5AA844F1-1309-4E68-8236-35509D68C05D}\DhcpInterfaceOptions: FC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E4 22 C0 4D 06 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 D0 43 DE DE 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 0F 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 68 6F 6D 65 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 00 01 51 80 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 29 74 C1 4D 05 00 00 00
  452. HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{5AA844F1-1309-4E68-8236-35509D68C05D}\DhcpInterfaceOptions: FC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2B 23 C0 4D 06 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 D0 43 DE DE 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 0F 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 68 6F 6D 65 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 00 01 51 80 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 29 74 C1 4D 05 00 00 00
  453. HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{5AA844F1-1309-4E68-8236-35509D68C05D}\DhcpInterfaceOptions: FC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E4 22 C0 4D 06 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 D0 43 DE DE 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 0F 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 68 6F 6D 65 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 00 01 51 80 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 29 74 C1 4D 05 00 00 00
  454. HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{5AA844F1-1309-4E68-8236-35509D68C05D}\DhcpInterfaceOptions: FC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2B 23 C0 4D 06 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 D0 43 DE DE 03 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 0F 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 68 6F 6D 65 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D FF FF FF 00 33 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D 00 01 51 80 36 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 29 74 C1 4D C0 A8 01 01 35 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 29 74 C1 4D 05 00 00 00
  455. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\MRUListEx: 10 00 00 00 0F 00 00 00 0E 00 00 00 0D 00 00 00 03 00 00 00 00 00 00 00 0C 00 00 00 0B 00 00 00 09 00 00 00 08 00 00 00 0A 00 00 00 07 00 00 00 05 00 00 00 06 00 00 00 04 00 00 00 01 00 00 00 02 00 00 00 FF FF FF FF
  456. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\MRUListEx: 12 00 00 00 11 00 00 00 10 00 00 00 0F 00 00 00 0E 00 00 00 0D 00 00 00 03 00 00 00 00 00 00 00 0C 00 00 00 0B 00 00 00 09 00 00 00 08 00 00 00 0A 00 00 00 07 00 00 00 05 00 00 00 06 00 00 00 04 00 00 00 01 00 00 00 02 00 00 00 FF FF FF FF
  457. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\MRUListEx: 0A 00 00 00 09 00 00 00 03 00 00 00 00 00 00 00 08 00 00 00 06 00 00 00 07 00 00 00 05 00 00 00 04 00 00 00 01 00 00 00 02 00 00 00 FF FF FF FF
  458. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\MRUListEx: 0B 00 00 00 0A 00 00 00 09 00 00 00 03 00 00 00 00 00 00 00 08 00 00 00 06 00 00 00 07 00 00 00 05 00 00 00 04 00 00 00 01 00 00 00 02 00 00 00 FF FF FF FF
  459. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYFRFFVBA: 00 00 00 00 < EDITED FOR SPACE > C4 E4 04 02
  460. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYFRFFVBA: 00 00 00 00 < EDITED FOR SPACE> C4 E4 04 02
  461. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr: 00 00 00 00 0E 00 00 00 5C 00 00 00 E2 00 13 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF 50 FD 85 38 A9 09 CC 01 00 00 00 00
  462. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr: 00 00 00 00 0E 00 00 00 5E 00 00 00 EF 0F 13 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF 50 FD 85 38 A9 09 CC 01 00 00 00 00
  463. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Gbbyf\ertfubg_1.8.2_fep_ova\ertfubg.rkr: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF D0 C3 0D 79 A9 09 CC 01 00 00 00 00
  464. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Gbbyf\ertfubg_1.8.2_fep_ova\ertfubg.rkr: 00 00 00 00 01 00 00 00 01 00 00 00 18 6F 00 00 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF 00 00 80 BF FF FF FF FF D0 C3 0D 79 A9 09 CC 01 00 00 00 00
  465. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE2: "application/vnd.adobe.xfdf"
  466. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE2: "application/msexcel"
  467. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE4: "application/vnd.adobe.xdp"
  468. HKU\S-1-5-21-3247066810-1978177574-2554680335-1000\Software\Netscape\Netscape Navigator\Viewers\TYPE4: "application/msword"
  469.  
  470. ----------------------------------
  471. Total changes:430
  472. ----------------------------------
RAW Paste Data