URL Details

URL
http://www.tikkle.io/

Score

This url shows some signs of potential malicious behavior.

The score of this url is 1.8 out of 10.

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Information on Execution

Category Started Completed Duration Logs
URL Jan. 10, 2019, 4:23 a.m. Jan. 10, 2019, 4:27 a.m. 271 seconds

Machine

Name Label Started On Shutdown On
winxpsp3pro32 winxpsp3pro32 2019-01-10 04:23:10 2019-01-10 04:27:39

Analyzer Log

2019-01-10 02:23:08,015 [analyzer] DEBUG: Starting analyzer from: C:\nnnvsrji
2019-01-10 02:23:08,030 [analyzer] DEBUG: Pipe server name: \\.\PIPE\FmPtFciMVOgWugTJOShj
2019-01-10 02:23:08,030 [analyzer] DEBUG: Log pipe server name: \\.\PIPE\EIhgHTGaqwlNyQkvCiqhhEZrjBU
2019-01-10 02:23:08,030 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2019-01-10 02:23:08,030 [analyzer] INFO: Automatically selected analysis package "ie"
2019-01-10 02:23:09,765 [analyzer] DEBUG: Started auxiliary module Disguise
2019-01-10 02:23:09,921 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-10 02:23:09,921 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-10 02:23:09,983 [analyzer] DEBUG: Loaded monitor into process with pid 692
2019-01-10 02:23:09,983 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2019-01-10 02:23:09,983 [analyzer] DEBUG: Started auxiliary module Human
2019-01-10 02:23:09,983 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2019-01-10 02:23:09,983 [analyzer] DEBUG: Started auxiliary module Reboot
2019-01-10 02:23:10,217 [analyzer] DEBUG: Started auxiliary module RecentFiles
2019-01-10 02:23:10,217 [analyzer] DEBUG: Started auxiliary module Screenshots
2019-01-10 02:23:10,405 [lib.api.process] INFO: Successfully executed process from path 'C:\\Program Files\\Internet Explorer\\iexplore.exe' with arguments ['http://www.tikkle.io/'] and pid 1440
2019-01-10 02:23:10,842 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-10 02:23:10,842 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-10 02:23:10,905 [analyzer] DEBUG: Loaded monitor into process with pid 1440
2019-01-10 02:23:11,140 [analyzer] INFO: Added new file to list with pid 1440 and path \Device\NamedPipe\lsass
2019-01-10 02:23:11,312 [analyzer] CRITICAL: Encountered an unknown process while in monitoring mode: "C:\WINDOWS\system32\Rundll32.exe" "C:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL",GetResourceModulePath HmLZq7bxCkoPnk/Zv+CFzuu6+I/gFfsa!
2019-01-10 02:23:11,437 [analyzer] INFO: Injected into process with pid 1408 and name u'rundll32.exe'
2019-01-10 02:23:11,530 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-10 02:23:11,530 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-10 02:23:11,640 [analyzer] DEBUG: Loaded monitor into process with pid 1408
2019-01-10 02:23:11,750 [analyzer] DEBUG: Received request to inject pid=1408, but we are already injected there.
2019-01-10 02:23:12,937 [analyzer] INFO: Added new file to list with pid 1408 and path C:\Documents and Settings\zamen\Application Data\Microsoft\Office\Groove12.pip
2019-01-10 02:23:26,640 [lib.api.process] INFO: Memory dump of process with pid 1408 completed
2019-01-10 02:23:27,030 [analyzer] INFO: Process with pid 1408 has terminated
2019-01-10 02:23:27,187 [analyzer] INFO: Added new file to list with pid 1440 and path \Device\NamedPipe\ROUTER
2019-01-10 02:23:44,703 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit mshtml.dll (with timestamp 0x4802a150)
2019-01-10 02:23:44,703 [analyzer] DEBUG: Error resolving function mshtml!CDocument_write through our custom callback.
2019-01-10 02:23:44,703 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit mshtml.dll (with timestamp 0x4802a150)
2019-01-10 02:23:44,703 [analyzer] DEBUG: Error resolving function mshtml!CElement_put_innerHTML through our custom callback.
2019-01-10 02:23:44,703 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit mshtml.dll (with timestamp 0x4802a150)
2019-01-10 02:23:44,703 [analyzer] DEBUG: Error resolving function mshtml!CHyperlink_SetUrlComponent through our custom callback.
2019-01-10 02:23:44,703 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit mshtml.dll (with timestamp 0x4802a150)
2019-01-10 02:23:44,703 [analyzer] DEBUG: Error resolving function mshtml!CIFrameElement_CreateElement through our custom callback.
2019-01-10 02:23:44,703 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit mshtml.dll (with timestamp 0x4802a150)
2019-01-10 02:23:44,703 [analyzer] DEBUG: Error resolving function mshtml!CImgElement_put_src through our custom callback.
2019-01-10 02:23:44,703 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit mshtml.dll (with timestamp 0x4802a150)
2019-01-10 02:23:44,703 [analyzer] DEBUG: Error resolving function mshtml!CScriptElement_put_src through our custom callback.
2019-01-10 02:23:44,703 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit mshtml.dll (with timestamp 0x4802a150)
2019-01-10 02:23:44,703 [analyzer] DEBUG: Error resolving function mshtml!CWindow_AddTimeoutCode through our custom callback.
2019-01-10 02:27:24,187 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2019-01-10 02:27:28,546 [lib.api.process] INFO: Memory dump of process with pid 1440 completed
2019-01-10 02:27:28,546 [analyzer] INFO: Terminating remaining processes before shutdown.
2019-01-10 02:27:28,546 [lib.api.process] INFO: Successfully terminated process with pid 1440.
2019-01-10 02:27:28,546 [analyzer] WARNING: File at path "u'\\device\\namedpipe\\lsass'" does not exist, skip.
2019-01-10 02:27:28,546 [analyzer] WARNING: File at path "u'\\device\\namedpipe\\router'" does not exist, skip.
2019-01-10 02:27:28,578 [analyzer] INFO: Analysis completed.

Cuckoo Log

2019-01-10 04:23:09,810 [lib.cuckoo.core.scheduler] INFO: Task #642: acquired machine winxpsp3pro32 (label=winxpsp3pro32)
2019-01-10 04:23:10,010 [modules.auxiliary.sniffer] INFO: Started sniffer with PID 11175 (interface=eth2, host=192.168.128.102, pcap=/opt/cuckoo/storage/analyses/642/dump.pcap)
2019-01-10 04:23:13,524 [lib.cuckoo.core.guest] INFO: Starting analysis on guest (id=winxpsp3pro32, ip=192.168.128.102)
2019-01-10 04:27:38,747 [lib.cuckoo.core.guest] INFO: winxpsp3pro32: analysis completed successfully
2019-01-10 04:27:59,157 [lib.cuckoo.core.plugins] WARNING: The processing module "Suricata" returned the following error: Unable to locate Suricata binary
2019-01-10 04:28:02,419 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.001s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f9b5288a510>: Failed to establish a new connection: [Errno 111] Connection refused
2019-01-10 04:28:02,420 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f9b5288a6d0>: Failed to establish a new connection: [Errno 111] Connection refused
2019-01-10 04:28:02,421 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f9b5288a0d0>: Failed to establish a new connection: [Errno 111] Connection refused
2019-01-10 04:28:02,422 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f9b5288aa10>: Failed to establish a new connection: [Errno 111] Connection refused
2019-01-10 04:28:02,423 [lib.cuckoo.core.plugins] ERROR: Failed to run the reporting module "ElasticSearch":
Traceback (most recent call last):
  File "/opt/cuckoo/lib/cuckoo/core/plugins.py", line 533, in process
    current.run(self.results)
  File "/opt/cuckoo/modules/reporting/elasticsearch.py", line 196, in run
    self.connect()
  File "/opt/cuckoo/modules/reporting/elasticsearch.py", line 79, in connect
    if not self.es.indices.exists_template("cuckoo_template"):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/client/utils.py", line 69, in _wrapped
    return func(*args, params=params, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/client/indices.py", line 491, in exists_template
    name), params=params)
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/transport.py", line 327, in perform_request
    status, headers, data = connection.perform_request(method, url, params, body, ignore=ignore, timeout=timeout)
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 105, in perform_request
    raise ConnectionError('N/A', str(e), e)
ConnectionError: ConnectionError(<urllib3.connection.HTTPConnection object at 0x7f9b5288aa10>: Failed to establish a new connection: [Errno 111] Connection refused) caused by: NewConnectionError(<urllib3.connection.HTTPConnection object at 0x7f9b5288aa10>: Failed to establish a new connection: [Errno 111] Connection refused)

Signatures

Queries for the computername (2 events)
Time & API Arguments Status Return Repeated
Jan. 9, 2019, 11:23 p.m.
GetComputerNameA
computer_name: ZAMEN-D4C44BD73
success 1 0
Jan. 9, 2019, 11:23 p.m.
GetComputerNameW
computer_name: ZAMEN-D4C44BD73
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}\DigitalProductID
Tries to locate where the browsers are installed (2 events)
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\ProductCodes
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (2 events)
Time & API Arguments Status Return Repeated
Jan. 9, 2019, 11:23 p.m.
GlobalMemoryStatusEx
success 1 0
Jan. 9, 2019, 11:23 p.m.
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (4 events)
Time & API Arguments Status Return Repeated
Jan. 9, 2019, 11:23 p.m.
__exception__
stacktrace:
?IsObjectInSafeForScriptingMode@GCSafeScriptingSupport@@SG_NPAUIObjectSafety@@@Z+0x51 ?SetThreadName@@YGXPB_WK@Z-0x18 grooveutil+0x336ba @ 0x68f236ba
?SetThreadName@@YGXPB_WK@Z+0x8f ??0GCSimpleTokenIterator@@QAE@PB_W_W@Z-0x8 grooveutil+0x33761 @ 0x68f23761
DllUnregisterServer+0x7f26 grooveshellextensions+0x6725f @ 0x6623725f
_endthread+0x4b _beginthread-0x81 msvcr80+0x2848 @ 0x78132848
_endthread+0xcb _beginthread-0x1 msvcr80+0x28c8 @ 0x781328c8

exception.instruction_r: 5e c9 c2 10 00 85 ff 0f 8e 36 93 ff ff 8b 55 fc
exception.symbol: RaiseException+0x52 GetVersionExA-0x83 kernel32+0x12aeb
exception.instruction: pop esi
exception.module: kernel32.dll
exception.exception_code: 0x406d1388
exception.offset: 76523
exception.address: 0x7c812aeb
registers.esp: 18415024
registers.edi: 18415357
registers.eax: 18415028
registers.ebp: 18415108
registers.edx: 18415210
registers.ebx: 13672920
registers.esi: 18415348
registers.ecx: 0
success 0 0
Jan. 9, 2019, 11:23 p.m.
__exception__
stacktrace:
?IsObjectInSafeForScriptingMode@GCSafeScriptingSupport@@SG_NPAUIObjectSafety@@@Z+0x51 ?SetThreadName@@YGXPB_WK@Z-0x18 grooveutil+0x336ba @ 0x68f236ba
?SetThreadName@@YGXPB_WK@Z+0x8f ??0GCSimpleTokenIterator@@QAE@PB_W_W@Z-0x8 grooveutil+0x33761 @ 0x68f23761
DllUnregisterServer+0x7f26 grooveshellextensions+0x6725f @ 0x6623725f
_endthread+0x4b _beginthread-0x81 msvcr80+0x2848 @ 0x78132848
_endthread+0xcb _beginthread-0x1 msvcr80+0x28c8 @ 0x781328c8

exception.instruction_r: 5e c9 c2 10 00 85 ff 0f 8e 36 93 ff ff 8b 55 fc
exception.symbol: RaiseException+0x52 GetVersionExA-0x83 kernel32+0x12aeb
exception.instruction: pop esi
exception.module: kernel32.dll
exception.exception_code: 0x406d1388
exception.offset: 76523
exception.address: 0x7c812aeb
registers.esp: 21102000
registers.edi: 21102333
registers.eax: 21102004
registers.ebp: 21102084
registers.edx: 21102186
registers.ebx: 13672920
registers.esi: 21102324
registers.ecx: 0
success 0 0
Jan. 9, 2019, 11:23 p.m.
__exception__
stacktrace:
?IsObjectInSafeForScriptingMode@GCSafeScriptingSupport@@SG_NPAUIObjectSafety@@@Z+0x51 ?SetThreadName@@YGXPB_WK@Z-0x18 grooveutil+0x336ba @ 0x68f236ba
?SetThreadName@@YGXPB_WK@Z+0x8f ??0GCSimpleTokenIterator@@QAE@PB_W_W@Z-0x8 grooveutil+0x33761 @ 0x68f23761
DllCanUnloadNow-0xaea2 groovesystemservices+0x29d2 @ 0x65e529d2
_endthread+0x4b _beginthread-0x81 msvcr80+0x2848 @ 0x78132848
_endthread+0xcb _beginthread-0x1 msvcr80+0x28c8 @ 0x781328c8

exception.instruction_r: 5e c9 c2 10 00 85 ff 0f 8e 36 93 ff ff 8b 55 fc
exception.symbol: RaiseException+0x52 GetVersionExA-0x83 kernel32+0x12aeb
exception.instruction: pop esi
exception.module: kernel32.dll
exception.exception_code: 0x406d1388
exception.offset: 76523
exception.address: 0x7c812aeb
registers.esp: 22150604
registers.edi: 22150937
registers.eax: 22150608
registers.ebp: 22150688
registers.edx: 22150791
registers.ebx: 13672920
registers.esi: 22150928
registers.ecx: 0
success 0 0
Jan. 9, 2019, 11:23 p.m.
__exception__
stacktrace:
?IsObjectInSafeForScriptingMode@GCSafeScriptingSupport@@SG_NPAUIObjectSafety@@@Z+0x51 ?SetThreadName@@YGXPB_WK@Z-0x18 grooveutil+0x336ba @ 0x68f236ba
?SetThreadName@@YGXPB_WK@Z+0x8f ??0GCSimpleTokenIterator@@QAE@PB_W_W@Z-0x8 grooveutil+0x33761 @ 0x68f23761
DllCanUnloadNow-0x8ce9 groovesystemservices+0x4b8b @ 0x65e54b8b
_endthread+0x4b _beginthread-0x81 msvcr80+0x2848 @ 0x78132848
_endthread+0xcb _beginthread-0x1 msvcr80+0x28c8 @ 0x781328c8

exception.instruction_r: 5e c9 c2 10 00 85 ff 0f 8e 36 93 ff ff 8b 55 fc
exception.symbol: RaiseException+0x52 GetVersionExA-0x83 kernel32+0x12aeb
exception.instruction: pop esi
exception.module: kernel32.dll
exception.exception_code: 0x406d1388
exception.offset: 76523
exception.address: 0x7c812aeb
registers.esp: 28310964
registers.edi: 28311297
registers.eax: 28310968
registers.ebp: 28311048
registers.edx: 28311152
registers.ebx: 13672920
registers.esi: 28311288
registers.ecx: 0
success 0 0
Allocates read-write-execute memory (usually to unpack itself) (3 events)
Time & API Arguments Status Return Repeated
Jan. 9, 2019, 11:23 p.m.
NtProtectVirtualMemory
base_address: 0x68f6f000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1408
process_handle: 0xffffffff
success 0 0
Jan. 9, 2019, 11:23 p.m.
NtProtectVirtualMemory
base_address: 0x32b72000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1408
process_handle: 0xffffffff
success 0 0
Jan. 9, 2019, 11:23 p.m.
NtProtectVirtualMemory
base_address: 0x7c844000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1408
process_handle: 0xffffffff
success 0 0
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)
Time & API Arguments Status Return Repeated
Jan. 9, 2019, 11:23 p.m.
GetDiskFreeSpaceExW
total_number_of_free_bytes: 24107606016
free_bytes_available: 24107606016
root_path: C:\WINDOWS\system32
total_number_of_bytes: 31453437952
success 1 0

Screenshots

Network

Hosts

No hosts contacted.

Summary

Process IEXPLORE.EXE (1440)

  • Opened files

    • C:\Documents and Settings\zamen\Favorites\Links\
    • C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
    • C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
    • c:\AUTOEXEC.BAT
    • C:\
    • C:\WINDOWS\system32\inetcpl.cpl
    • C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\rasphone.pbk
    • C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\
    • C:\Program Files\Java\jre1.8.0_111\bin\javaws.exe
    • C:\Program Files\Messenger\msmsgs.exe
    • C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    • C:\WINDOWS\system32\ras\
    • C:\Program Files\Microsoft Office\Office12\REFBAR.ICO
    • C:\Documents and Settings\zamen\Local Settings\History\desktop.ini
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    • C:\WINDOWS\system32\shell32.dll
    • C:\Documents and Settings\zamen\Cookies\index.dat
    • C:\WINDOWS\system32\browseui.dll
    • C:\Documents and Settings\zamen\Cookies\
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files\desktop.ini
    • C:\Documents and Settings\zamen\
    • \\?\PIPE\lsarpc
    • C:\WINDOWS\system32\tapi32.dll
    • C:\Documents and Settings\zamen\Local Settings\Temp\JavaDeployReg.log
    • C:\Program Files\Mozilla Firefox\plugins\
    • \\?\PIPE\ROUTER
    • C:\Program Files\Java\jre7\bin\javaws.exe
    • C:\WINDOWS\system32\
    • C:\WINDOWS\system32\url.dll
    • C:\WINDOWS\system32\urlmon.dll
    • C:\Program Files\Java\jre1.8.0_111\lib\plugin.jar
    • C:\Documents and Settings\
    • C:\Documents and Settings\zamen\Local Settings\History
    • C:\Documents and Settings\zamen\Local Settings\
    • C:\WINDOWS\WindowsShell.manifest
    • C:\WINDOWS\system32\rsaenh.dll
    • C:\Program Files\
    • C:\Documents and Settings\zamen\Favorites\Desktop.ini
    • C:\WINDOWS\system32\mlang.dll
    • C:\Program Files\Mozilla Firefox\firefox.exe
    • C:\WINDOWS\
    • C:\Program Files\Java\jre7\lib\plugin.jar
    • C:\Program Files\Java\jre1.8.0_111\
    • \??\FDC#GENERIC_FLOPPY_DRIVE#6&1435b2e2&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
    • C:\Documents and Settings\zamen\Local Settings\History\History.IE5\
    • C:\Program Files\Java\jre1.8.0_111\bin\
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files
    • C:\WINDOWS\system32\mshtml.dll
    • C:\WINDOWS\system32\cscui.dll
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files\Content.IE5\
    • C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    • C:\Documents and Settings\zamen\Favorites\
    • C:\Documents and Settings\zamen\Local Settings\History\History.IE5\index.dat
    • C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\
    • C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\
    • C:\Documents and Settings\zamen\Desktop
  • Written files

    • \\?\PIPE\lsarpc
    • \\?\PIPE\ROUTER

Process rundll32.exe (1408)

  • Opened files

    • C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Cultures\OFFICE.ODF
    • C:\Documents and Settings\zamen\Application Data\Microsoft\Office\Groove12.pip
  • Written files

    • C:\Documents and Settings\zamen\Application Data\Microsoft\Office\Groove12.pip
  • Files Read

    • C:\Documents and Settings\zamen\Application Data\Microsoft\Office\Groove12.pip

Process IEXPLORE.EXE (1440)

Process rundll32.exe (1408)

  • Registry keys opened

    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\00002109AB0090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\GELPrefs
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109A10090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C0E79A5D583D5DD80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6484EE93FE751C00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8E1AB7B669C78EB4A91600BFBA495531
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109810090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4006F64980E4BACB0EF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C970EAB9130F3C6D0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109F100A0C00000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\470D1EE91DF781C00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50D08F791A7199CD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB2DC41B1950E0F8237563
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57A0EAB9B4EE3C6D0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AB56EFF9C85AEB4895ECBBBA040B3E9
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\5.0\0\win32
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109411090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109810090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109B10090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7AD08F79957199CD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEE398C496A10E44E9FEE9456EA92BB3
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8FD08F79537199CD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5A3830318DA76E24896335C3031273F5
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F89B7B8640721C450CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE7A2EE931A871C00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\000021091A0090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109A10090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\515AD2B95D5ABE110BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Features\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Word_Core
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0C0A-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Branding
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3671BC89D0C5F5BD0BF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\Common
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DEA00C998AE1B010CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07DEDD9F8F16079469A0D3265BA8594C
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF40E261581A8634C8271A66A86B174F
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DA806821DB813D4691239BE8F7CE832
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Features\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\52F1CAC1C1C96004F8B5863811E33071
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F932641E363C6C140998A324AF56AEDB
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office Genuine Advantage Validation_is1
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F10090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0AF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\EnabledLanguages
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Word_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\PagedBuffers
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DAFDFB976BE4B010CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A81BC89D7B5F5BD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\515AD2B95D5ABE110CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\Managed
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetMeeting
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8C60D176EDB949190CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2513B922A03FBD548BD17EBF1E2C0E98
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D6BD49C8A516ED41BB0C0D31B0F52BC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Mso_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A49EAE468DA8E24899345AE8120D652
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E43F70B3CA553624FBC0D2C41172192E
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BF66B723B3B4F1428172871FA829AE9
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109711090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E3F997A2790938844ACDF81020B32415
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\17424250BDD1F8E47B65AEC6F2F72860
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4C118F793E4199CD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7B813366E55A1B850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A07C2387B12CEE340BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19437E3B36247A8459E3D020E3D7E827
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EC3DF47D8A2C9E00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\762B375D03EBD69488491B616F272300
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11AC6A5D364D8DD80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\Config
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109511090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Excel_Core
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7060EAB95E0F3C6D0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\ProductVersion
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109810090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF60EAB9970F3C6D0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36798A5DFC3D6DD80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A62A952D6899D44489E91CA1BFD7740A
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\854EEFB99D9E3B010BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E0F8237563
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109510090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9ADB2B9525ADE110BF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\outexum
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3671BC89D0C5F5BD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EADBFBF7BAFC77940A81C4B0F8E81888
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F664EDB152806014A87C9B1DAA410AD7
    • HKEY_CURRENT_USER\Keyboard Layout\Toggle
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109411090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF05DEB6085B31A80CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109E60090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DDFBC37E8440874DAB7C25041E8C8BA
    • HKEY_CURRENT_USER\Software\Microsoft\Shared
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B470EAB9550F3C6D0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Usage
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11B564CAA807C694ABE73044DC90516B
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ShellHandler
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F8BFFB9F55F2B010CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBB8E2B9B85AAE110CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F949E36CB3004C50AF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Outlook_AutoDiscover
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F71EEFB9D1BE3B010CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109F10090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F6F8B577F401E246A13B81D3D057714
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\235DBC0C454BEEC4CB496140DCD4BEC6
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08B1BC897995F5BD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4D39E3668C004C50CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5AE40CAEC8E1154988E08D566124476
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5081BC895CB5F5BD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectAnimation
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E8F8237563
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41C6E54226C55944D8077A5F8A1E1789
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\User Settings\
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B470EAB9550F3C6D0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Components\07E1C9E99D7027947B5750FBDAE6D3A5
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A60EAB9D90F3C6D0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Excel_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C970EAB9130F3C6D0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109A10090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24E4EDAA37A904D4DB02ECDC56C46FD2
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Ace_OdbcCurrentUser
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A75910C9F3AE0B010BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E396768F57E9F014C9DEDA42364C61ED
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109910090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3F0A44D0132159649B3A448B4C59B5BE
    • HKEY_CLASSES_ROOT\.htm
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109440090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\51F9B0C5BB7C4F448B6FADF4D5FDF9D0
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A54268967E815954FB12558C36DD1118
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B93E2EA8008629944AA908C0A1E36081
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D602F732C91589248BC588C917FFDE6E
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6057B798D2E9A42439615DC1151328FF
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65D08F79D77199CD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109511090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CB01166D9A20AA45AFBE37BB874219F
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3C7DB2B9966ADE110BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\12B306B24E250DD428FC7016B6FB4BD8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Access_Core
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\PowerPoint_Core
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109C20090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\38058D3940402E5458B108E83AA75033
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\XDocs_XMLEditVerbHandler
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4F2DF473C33C9E00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C3FAC2B9BA0BCE110BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3C7DB2B9966ADE110CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Mso_Core
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E303DF477533C9E00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C733A8B34D26AF4458B43E09EFC2C77F
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\068612CF467A767478CD904941B4470E
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109440090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C61BC8955C5F5BD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8FB655DD34BFD4546BA9BAE5F9A4AD33
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E1E8C6BFA352D940987EADBC22AE78D
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BA38BEB6416B51A80CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Policies\Microsoft\Office
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A9E08F79DE6199CD0BF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Mso_CoreReg
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109510090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF62B1E69F42B4342A5860C340763FA7
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE4ABD129E4F1C941B7444D6977C7AE9
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A90D176A9A949190CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD6C5F41EE5962542BA8F6599BAF844B
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D84D03877FA767F459FC6272E56E3BC3
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AECC6A5DF13D8DD80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\Rundll32.exe
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A31EAB9FA7E3C6D0AF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC52E7A7F1DD2CB4E909ED2AA7294291
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox (3.0)
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\95913366615A1B850CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109F100A0C00000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109510090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E9B7B860E621C450CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Components\12B306B24E250DD428FC7016B6FB4BD8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E593B68EC2A194848B94A92C9BE7920B
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0AFF57910929E8C4EA9307BECB764BE1
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Outlook_Core
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109711090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B271454ED4348B47B365F93ADEAC015
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F03103879F2C1F340BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CADB7B86E8421C450CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E4F8237563
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Access_Core
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE7A2EE931A871C00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF586AE3E10DF3D4EA5BA4DD0B0302D6
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\479AC045813E1B64CA257557D0551AAB
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7AA6F3DBF3CE139469FE63D56E7AF446
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Features\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7060EAB95E0F3C6D0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A31EAB9FA7E3C6D0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6581BC891AB5F5BD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7900372DB05448850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A07C2387B12CEE340CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16328246F192F92458E9D299B136DB3F
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Mso_Core
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5BD481424C3EC4549A8EEDBAE91A39D4
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\250D2EC62893A2E42B4EBF45C12B7B5F
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EC3DF47D8A2C9E00AF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9310372D3C4448850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC9E0EE9B10891C00CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109440090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2171BC8913C5F5BD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\92F2F088AC13ECF45BBDC3F67BEE0B43
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7CC7F027D8365C46910D3063521B80B
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109B10090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109511090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Mso_CoreReg
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\80A583FE361858541BDE3068833E5517
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1497D8DDB91CD3A42A8BFDA14C34B728
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\LanguageResources\InstalledUIs
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109F10090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\243ACBCD38A2231458C912E75091C765
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C3FAC2B9BA0BCE110CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E5F8237563
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B71BC899EB5F5BD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B40D45D6498661548A1AAA9A0F9FE015
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Migration\Office
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\AccessDE_Core
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109411090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9AB7696C8E350E80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E03DF47F033C9E00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0010-0409-0000-0000000FF1CE}
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Outlook_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8160C947EAB7BB44DA242941D55C30BA
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5C39E362FC004C50CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C61BC8955C5F5BD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32\Performance
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A81A7A5D5AED7DD80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96C651CA3B2ADC4479B38EBF4467D906
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F102C17682C959190CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\869C0C701D584D115AF3000972A8B18B
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7AD08F79957199CD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\28AB7B8689621C450CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Mso_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A2CE2722E487CE448CC38F71777A982
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FD39E36E3C004C50CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B50EAB9901F3C6D0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7BE522658BB8BE04C83F61EE718C39AF
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7B3554CE058FE804CAC166E14046848E
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AFE2DF477E33C9E00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Office\BypassMigration
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\PowerPoint_Core
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109610090400000000000F01FEC\InstallProperties
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\000021091A0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4F2DF473C33C9E00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5081BC895CB5F5BD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5120EEDE039486F42830D8D2552797F6
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2171BC8913C5F5BD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Groove\Development
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\outexum
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AFE2DF477E33C9E00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109810090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Word_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B71BC899EB5F5BD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC9E0EE9B10891C00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13AB7B86CB621C450CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBB8E2B9B85AAE110BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E88BB5C866C031A409F04DAB44D67573
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109610090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Outlook_Core
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19CF0387B61C0F340BF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B64FB72C2797D14CB19381AF4411544
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rundll32.exe\RpcThreadPoolThrottle
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7205DE6773D7AD54DA2B5DB94BEB6066
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A31EAB9FA7E3C6D0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CF49B73DBC474424784FEC229D71CD89
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109010090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F26AFDA5F7C6FC646949B18163FE58D4
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\62BF76B218F1FDC42B65507110BEC32A
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3BDA33871D1CDE340CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\35FF272DB95448850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0115-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\470D1EE91DF781C00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\80913366A35A1B850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94E08F79117199CD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E39B7B8682721C450CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRAR archiver
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E6F8237563
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A785B69C52266743B99C2D7458ABA73
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\748B2526ADAB4D3429253E7976AF041A
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1960408961-1085031214-725345543-1003\Components\77D840A09ED22764CA7F2124692693D7
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEE08F799C6199CD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950ECF8237563
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A11FA2B93B6AEE110CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F03103879F2C1F340CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B9F0387FA2C0F340BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4006F64980E4BACB0DF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109F10090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\OSession\Microsoft Office 12 Sessions
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2562336682C91B850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109E60090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9F2DF47F933C9E00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA9133662F4A1B850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F100A0C00000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4868BEB60D4B51A80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109F100C0400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Sps_OutlookAddin
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F803DF473333C9E00CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\PowerPoint_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\40A1D95781A6EF74E97B8B18F623ADB8
    • HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Common\LanguageResources\EnabledLanguages
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27A160E816EFE7F44B45157E292AC1EA
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E7F8237563
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109010090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A60EAB9D90F3C6D0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0AF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8560EAB91C0F3C6D0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\854EEFB99D9E3B010CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C917C9CCEEAEFE46974EC992F8700DD
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\423E6696A44360E80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Office\OPWBypassMigration
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D2694DDF519B6C4EAC338740C0C71CE
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F949E36CB3004C50CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6400372DF25448850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\66FC3C3413AAD6740B92D672E4648FC6
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94E08F79117199CD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{32A3A4F4-B792-11D6-A78A-00B0D0180111}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF913366EC4A1B850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CAC39E36ECC004C50CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109610090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77AE531D63D456630DF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\131D13871FCCFE340CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\210AB6B7A405B1641B8815C6A0D9507A
    • HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Security
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8A9214E501BEFA47B1B2069EE267C0D
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6484EE93FE751C00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\060A8794DC9547943B9D9D0BEA47D635
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared\
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office Test\Special\Perf
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE8B7B86C4721C450CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3DFFE462A99B4934287386DFAC9FD152
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109E60090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F653A024AB127F04D9863F4CB2AA23C1
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E2F8237563
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CD93EE9D3F761C00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109AB0090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65D08F79D77199CD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\76D797A0865F57D4FBDA2603D66D2DFB
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E699158510CB6F945A999910A89EBAF6
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8E00372D7E4448850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D82A4497D9A0B146B6ABB7590237DBF
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF5E6696603360E80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109010090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AAF304281C54768418AF48D62556B5B1
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1799696C63330E80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\52D133664C2A1B850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109440090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEF2DF47B733C9E00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08B1BC897995F5BD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AEE5D9F0E8D32F74E8BF1F9BBCFFFC0D
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DEA00C998AE1B010BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCABF232126726445BC57F4CDE05C5EB
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8C08AEE0B4FCBFF4DB816962B994EDC2
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Registration
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\07E1C9E99D7027947B5750FBDAE6D3A5
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Graph_Core
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Components\12B306B24E250DD428FC7016B6FB4BD8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CABF17600B919190CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109AB0090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Excel_Core
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\12.0\User Settings\
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7CD01816C53D32438CF043106011676
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\670B86966B3340E80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109511090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Outlook_AutoDiscover
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4AFF272D775448850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3DAB7B8647621C450CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DFC39E36AAC004C50CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B50EAB9901F3C6D0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F8BFFB9F55F2B010BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6A73EEB6635B21A80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50D08F791A7199CD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3D0372D14C348850CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\Resiliency\StartupItems
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Features\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD792D99A2A35DF43B0F82ED2AA62E8C
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109AB0090400000000000F01FEC\Usage
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F83217007FF}
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109010090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5AC8E056A09FBD44A94C85DDE5CA58CD
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D43D1EE9D8E781C00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42B5CEB6650C41A80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\PowerPoint_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BCD12BAF31451F4F961A2B84E2FEF38
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OutlookExpress
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109AB0090400000000000F01FEC\Features
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C049E3685A004C50CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20D9AEB6E56B61A80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A75910C9F3AE0B010CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E8574A1B56F8A594C9EAF39D7CB4F0C4
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Outlook_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B2A1715C2EE75049B04095FD673A65F
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEE08F799C6199CD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42F941EC62E99B14B8503D51BC31C83A
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\000021091A0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCHealth
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\676746B1EF9A9284081E5933D486241D
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57A0EAB9B4EE3C6D0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Ace_OdbcCurrentUser
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0117-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\XDocs_XMLEditVerbHandler
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CEBA2B3FEAED5D41BDEEBFDD2917065
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C9A6F846E2818A47A408CAF13381C71
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A0C39E3661D004C50CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180111F0}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B38DBF5657F6D174B99FC6540586AB7E
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E03DF47F033C9E00BF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Excel_Intl
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2140372DDD2448850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Graph_Core
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DAFDFB976BE4B010BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B7CF5696494370E80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0711BDB4BF8C2A246B70861972536622
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19CF0387B61C0F340CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EC3DF47D8A2C9E00BF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Sps_OutlookAddin
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\25B8DA2099D39CD4F8C231AB90AF6966
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\14EDD176026A39190CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F803DF473333C9E00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D6C7B862FD11C450AF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F71EEFB9D1BE3B010BF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109910090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109F100C0400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47155108894E68A409FDC1FC6E8DA2CB
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\35F25165962A88A4397F181224F1D81A
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2227A34C816D4F94EB598446F9BD8B17
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109E60090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109F100C0400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A81BC89D7B5F5BD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109F100A0C00000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B33DF479213C9E00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109910090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2562336682C91B850AF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CA934E32B4EAF64D84CFE3C67611289
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8560EAB91C0F3C6D0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7621905552BBC374287F800E3C275DD2
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109910090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E303DF477533C9E00CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\Common\OffDiag
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109B10090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EA7B711503001246845051536B6A26B
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF60EAB9970F3C6D0BF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Word_Core
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Components\07E1C9E99D7027947B5750FBDAE6D3A5
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\Security
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3E3E87DE42ABF4F48BE32A4171DDA208
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A393389F8C93B73448352E8A2F0CD11F
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICW
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109411090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E17DF6DD2191EF344B18F02A673726C1
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D6C7B862FD11C450CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\131D13871FCCFE340BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77D840A09ED22764CA7F2124692693D7
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\AccessDE_Core
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87F05C9D7CE4B584E874B2F2096B51D2
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A11FA2B93B6AEE110BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A14DE176A4B929190CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109C20090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109C20090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Features
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9ADB2B9525ADE110CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E1F8237563
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B92D5049E11C93DB0DF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3D0372D14C348850AF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D43D1EE9D8E781C00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F100C0400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109A10090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24A233AADEEDC1548A59470681C7BE69
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\66813366285A1B850CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Debug
    • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\00002109510090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E5C161912A2A6C4C93C76678926C56C
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8FD08F79537199CD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\82DE7549CF3F8CCB0DF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0409-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{20c31435-2a0a-4580-be8b-ac06fc243ca4}
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\Resiliency
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-040C-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\73BB89C9488F606449FC5B1962401F11
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109610090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\000021091A0090400000000000F01FEC\InstallProperties
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109711090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Migration\Groove
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C1D6229422D71045BFB2F8BCE017AA4
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEF2DF47B733C9E00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B33DF479213C9E00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A20F2A57D1B80224FAE195D71F6B83BB
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F9D39E3626C004C50CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\925EC7136C3CE184E8BF5BE19D687FAB
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20AA390AA2E38F846871814229A485E0
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CD93EE9D3F761C00CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PIL-py2.7
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1960408961-1085031214-725345543-1003\Installer\Products\00002109B10090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9F2DF47F933C9E00BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6581BC891AB5F5BD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E3F8237563
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4C118F793E4199CD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\863E5A5DDA4D9DD80CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A9E08F79DE6199CD0CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Common\LanguageResources
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4A13366AA4A1B850CF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6A7E2E3675190CA4E8C5D17C16122BEE
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94B0DDEF99CBDCB469618B4CA768A5FB
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109C20090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3BDA33871D1CDE340BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950EDF8237563
    • HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109711090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5FFF272D355448850CF18C3B9B1A1EE8
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0BF18C3B9B1A1EE8
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\{90120000-0030-0000-0000-0000000FF1CE}
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B9F0387FA2C0F340CF18C3B9B1A1EE8
  • Registry keys written

    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\MTTT
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\Resiliency\StartupItems\pz&
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\EnabledLanguages\1033
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Usage\ProductFiles
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Usage\GrooveFiles
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\MTTF
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109AB0090400000000000F01FEC\Usage\GrooveFilesIntl_1033
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\MTTA
  • Registry keys read

    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UseAlternateShowUIMethodForFtpSession
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
    • HKEY_CURRENT_USER\Software\Microsoft\Shared\OfficeUILanguage
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\863E5A5DDA4D9DD80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF5E6696603360E80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB2DC41B1950E0F8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C61BC8955C5F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96C651CA3B2ADC4479B38EBF4467D906\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BCD12BAF31451F4F961A2B84E2FEF38\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\73BB89C9488F606449FC5B1962401F11\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9ADB2B9525ADE110BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3671BC89D0C5F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\PowerPoint_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9ADB2B9525ADE110CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\62BF76B218F1FDC42B65507110BEC32A\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36798A5DFC3D6DD80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B7CF5696494370E80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD792D99A2A35DF43B0F82ED2AA62E8C\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AAF304281C54768418AF48D62556B5B1\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\PowerPoint_Intl\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A07C2387B12CEE340BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\SetupDuration
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C733A8B34D26AF4458B43E09EFC2C77F\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9310372D3C4448850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation\PreferOffline
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\ExeMode
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\25B8DA2099D39CD4F8C231AB90AF6966\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B40D45D6498661548A1AAA9A0F9FE015\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F9D39E3626C004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation\MaxWordsJapan
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F8BFFB9F55F2B010BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7BE522658BB8BE04C83F61EE718C39AF\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\UIFallback
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Graph_Core\Count
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts\00021404
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A75910C9F3AE0B010BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{20c31435-2a0a-4580-be8b-ac06fc243ca4}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A54268967E815954FB12558C36DD1118\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109C20090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_CURRENT_USER\Software\Microsoft\Office\Common\AllowConsecutiveSlashesInUrlPathComponent
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D6BD49C8A516ED41BB0C0D31B0F52BC\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC9E0EE9B10891C00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Mso_Core\Count
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\FirstRunTime
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\AccessDE_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E1F8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109AB0090400000000000F01FEC\Features\GrooveFilesIntl_1033
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Outlook_AutoDiscover\Count
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\MTTT
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65D08F79D77199CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3BDA33871D1CDE340BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4C118F793E4199CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Mso_Core\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5AE40CAEC8E1154988E08D566124476\00002109AB0090400000000000F01FEC
    • HKEY_CURRENT_USER\.htm\(Default)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\outexum\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E43F70B3CA553624FBC0D2C41172192E\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A20F2A57D1B80224FAE195D71F6B83BB\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7CD01816C53D32438CF043106011676\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3DFFE462A99B4934287386DFAC9FD152\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87F05C9D7CE4B584E874B2F2096B51D2\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6A7E2E3675190CA4E8C5D17C16122BEE\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A90D176A9A949190CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D6C7B862FD11C450AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation\CurrentProvider
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4006F64980E4BACB0DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109610090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4D39E3668C004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94E08F79117199CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5C39E362FC004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2562336682C91B850AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4868BEB60D4B51A80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\XDocs_XMLEditVerbHandler\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\17424250BDD1F8E47B65AEC6F2F72860\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRAR archiver\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Outlook_Core\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6581BC891AB5F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\MTTA
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Outlook_Intl\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A785B69C52266743B99C2D7458ABA73\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AEE5D9F0E8D32F74E8BF1F9BBCFFFC0D\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7621905552BBC374287F800E3C275DD2\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CD93EE9D3F761C00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\35F25165962A88A4397F181224F1D81A\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B38DBF5657F6D174B99FC6540586AB7E\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D82A4497D9A0B146B6ABB7590237DBF\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8E00372D7E4448850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8FB655DD34BFD4546BA9BAE5F9A4AD33\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F949E36CB3004C50AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0AFF57910929E8C4EA9307BECB764BE1\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A9E08F79DE6199CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\PowerPoint_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\LanguageResources\SKULanguage
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A31EAB9FA7E3C6D0AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4F2DF473C33C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\14EDD176026A39190CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109E60090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CADB7B86E8421C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-040C-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16328246F192F92458E9D299B136DB3F\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\MTTF
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E8F8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6A73EEB6635B21A80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A2CE2722E487CE448CC38F71777A982\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4A13366AA4A1B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42F941EC62E99B14B8503D51BC31C83A\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3D0372D14C348850AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08B1BC897995F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation\MaxWords
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D2694DDF519B6C4EAC338740C0C71CE\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E2F8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11B564CAA807C694ABE73044DC90516B\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Access_Core\Order
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts\00021004
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PIL-py2.7\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared\CUAS
    • HKEY_CURRENT_USER\Control Panel\International\Geo\Nation
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EC3DF47D8A2C9E00AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19CF0387B61C0F340BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E699158510CB6F945A999910A89EBAF6\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Graph_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50D08F791A7199CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\470D1EE91DF781C00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B93E2EA8008629944AA908C0A1E36081\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\LangTuneUp
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectAnimation\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20AA390AA2E38F846871814229A485E0\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E9B7B860E621C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\748B2526ADAB4D3429253E7976AF041A\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OutlookExpress\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\80913366A35A1B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts\0001040E
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D43D1EE9D8E781C00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24A233AADEEDC1548A59470681C7BE69\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E8574A1B56F8A594C9EAF39D7CB4F0C4\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F100A0C00000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\InstallType
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD6C5F41EE5962542BA8F6599BAF844B\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2513B922A03FBD548BD17EBF1E2C0E98\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Branding\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8160C947EAB7BB44DA242941D55C30BA\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109AB0090400000000000F01FEC\Usage\GrooveFilesIntl_1033
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts\00010407
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Excel_Intl\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\479AC045813E1B64CA257557D0551AAB\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{32A3A4F4-B792-11D6-A78A-00B0D0180111}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A60EAB9D90F3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC9E0EE9B10891C00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\outexum\Count
    • HKEY_CURRENT_USER\Software\Microsoft\Office\Common\QMStudyID
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CF49B73DBC474424784FEC229D71CD89\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8FD08F79537199CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\51F9B0C5BB7C4F448B6FADF4D5FDF9D0\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEE08F799C6199CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Mso_CoreReg\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94E08F79117199CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC52E7A7F1DD2CB4E909ED2AA7294291\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6400372DF25448850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50D08F791A7199CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CAC39E36ECC004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetMeeting\ProductCodes
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBB8E2B9B85AAE110BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\676746B1EF9A9284081E5933D486241D\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DEA00C998AE1B010BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F89B7B8640721C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7205DE6773D7AD54DA2B5DB94BEB6066\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\PowerPoint_Intl\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B92D5049E11C93DB0DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Excel_Core\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\PowerPoint_Core\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A11FA2B93B6AEE110BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AB56EFF9C85AEB4895ECBBBA040B3E9\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\060A8794DC9547943B9D9D0BEA47D635\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\ProductCodes
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\XDocs_XMLEditVerbHandler\Count
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\Resiliency\StartupItems\pz&
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41C6E54226C55944D8077A5F8A1E1789\00002109AB0090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\Common\QMStrMax
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0115-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\068612CF467A767478CD904941B4470E\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19CF0387B61C0F340CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts\00020804
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F71EEFB9D1BE3B010BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C970EAB9130F3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBB8E2B9B85AAE110CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77D840A09ED22764CA7F2124692693D7\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109411090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F10090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CA934E32B4EAF64D84CFE3C67611289\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08B1BC897995F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\235DBC0C454BEEC4CB496140DCD4BEC6\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF60EAB9970F3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\Debug
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3BDA33871D1CDE340CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEE08F799C6199CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BA38BEB6416B51A80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11AC6A5D364D8DD80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CABF17600B919190CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF62B1E69F42B4342A5860C340763FA7\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3E3E87DE42ABF4F48BE32A4171DDA208\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Mso_Intl\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7900372DB05448850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1799696C63330E80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\{90120000-0030-0000-0000-0000000FF1CE}\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180111F0}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\E. South America Standard Time\Tzi
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0C0A-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42B5CEB6650C41A80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\AddressBookNameMax4096
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\5.0\0\win32\(Default)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2171BC8913C5F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Mso_CoreReg\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3D0372D14C348850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Outlook_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\854EEFB99D9E3B010BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A14DE176A4B929190CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6484EE93FE751C00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A0C39E3661D004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F8BFFB9F55F2B010CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E3F8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E1E8C6BFA352D940987EADBC22AE78D\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F03103879F2C1F340BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\Common\QMPersNum
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C0E79A5D583D5DD80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B271454ED4348B47B365F93ADEAC015\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77AE531D63D456630DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AECC6A5DF13D8DD80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\470D1EE91DF781C00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5A3830318DA76E24896335C3031273F5\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Outlook_Intl\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A11FA2B93B6AEE110CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\762B375D03EBD69488491B616F272300\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF40E261581A8634C8271A66A86B174F\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F102C17682C959190CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B33DF479213C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox (3.0)\ProductCodes
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation\UseOnline
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F803DF473333C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5BD481424C3EC4549A8EEDBAE91A39D4\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEF2DF47B733C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109810090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Features\ProductFiles
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Word_Intl\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\outexum\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19437E3B36247A8459E3D020E3D7E827\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3F0A44D0132159649B3A448B4C59B5BE\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109440090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DA806821DB813D4691239BE8F7CE832\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7060EAB95E0F3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2140372DDD2448850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E396768F57E9F014C9DEDA42364C61ED\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\CustomSetup
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Groove\GrooveName
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5FFF272D355448850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\InstallFonts
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\PIDKEY
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\XDocs_XMLEditVerbHandler\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\80A583FE361858541BDE3068833E5517\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\GrooveFiles
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AFE2DF477E33C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E303DF477533C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A60EAB9D90F3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE8B7B86C4721C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Graph_Core\Order
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\AcbOn
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Word_Intl\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109510090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4C118F793E4199CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5AC8E056A09FBD44A94C85DDE5CA58CD\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E3F997A2790938844ACDF81020B32415\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CEBA2B3FEAED5D41BDEEBFDD2917065\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E03DF47F033C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\E. South America Standard Time\Dlt
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E5F8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\EnableAnchorContext
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C3FAC2B9BA0BCE110BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1497D8DDB91CD3A42A8BFDA14C34B728\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3C7DB2B9966ADE110BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UseCaseInsensitivePathForHyperlink
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A81BC89D7B5F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Excel_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D43D1EE9D8E781C00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B2A1715C2EE75049B04095FD673A65F\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109F100C0400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9F2DF47F933C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Access_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\SetupVersion
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E0F8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEE398C496A10E44E9FEE9456EA92BB3\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B9F0387FA2C0F340BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Excel_Intl\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8560EAB91C0F3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office Genuine Advantage Validation_is1\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2562336682C91B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109910090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B470EAB9550F3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F949E36CB3004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5081BC895CB5F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57A0EAB9B4EE3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\423E6696A44360E80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Outlook_AutoDiscover\Order
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\UILanguage
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Sps_OutlookAddin\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FD39E36E3C004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Mso_Intl\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3C7DB2B9966ADE110CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F653A024AB127F04D9863F4CB2AA23C1\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\{90120000-0030-0000-0000-0000000FF1CE}\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8C60D176EDB949190CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Word_Core\Count
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\AcbControl
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\131D13871FCCFE340CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8FD08F79537199CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8E1AB7B669C78EB4A91600BFBA495531\00002109AB0090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\HelpExplicit
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950ECF8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\TimeZoneKeyName
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Build
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B71BC899EB5F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20D9AEB6E56B61A80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEF2DF47B733C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C049E3685A004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts\00030404
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109B10090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27A160E816EFE7F44B45157E292AC1EA\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47155108894E68A409FDC1FC6E8DA2CB\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\ProductVersion\LastProduct
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A31EAB9FA7E3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA9133662F4A1B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF05DEB6085B31A80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\PreviousOfficeApps
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Sps_OutlookAddin\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7AA6F3DBF3CE139469FE63D56E7AF446\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F6F8B577F401E246A13B81D3D057714\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EC3DF47D8A2C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E593B68EC2A194848B94A92C9BE7920B\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Access_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\40A1D95781A6EF74E97B8B18F623ADB8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Features\GrooveFiles
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation\UseMT
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\869C0C701D584D115AF3000972A8B18B\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\35FF272DB95448850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A49EAE468DA8E24899345AE8120D652\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\670B86966B3340E80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\66813366285A1B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A393389F8C93B73448352E8A2F0CD11F\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DAFDFB976BE4B010BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE7A2EE931A871C00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109511090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E03DF47F033C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2227A34C816D4F94EB598446F9BD8B17\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E17DF6DD2191EF344B18F02A673726C1\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3DAB7B8647621C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7AD08F79957199CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B71BC899EB5F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableUserInstalls
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\515AD2B95D5ABE110BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C1D6229422D71045BFB2F8BCE017AA4\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9F2DF47F933C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A81A7A5D5AED7DD80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4F2DF473C33C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13AB7B86CB621C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Mso_CoreReg\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4AFF272D775448850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\CustomizableAlertBaseURL
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF913366EC4A1B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCABF232126726445BC57F4CDE05C5EB\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\E. South America Standard Time\Std
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AFE2DF477E33C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0711BDB4BF8C2A246B70861972536622\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCHealth\ProductCodes
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Excel_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6581BC891AB5F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C61BC8955C5F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\854EEFB99D9E3B010CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EC3DF47D8A2C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CD93EE9D3F761C00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\SourceType
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\PreviousInstallLanguage
    • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Word_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\28AB7B8689621C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BF66B723B3B4F1428172871FA829AE9\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DAFDFB976BE4B010CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\925EC7136C3CE184E8BF5BE19D687FAB\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\UISnapshot
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Usage\ProductFiles
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5120EEDE039486F42830D8D2552797F6\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A75910C9F3AE0B010CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\Upgrade
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F803DF473333C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A9E08F79DE6199CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE7A2EE931A871C00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109A10090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\52D133664C2A1B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F664EDB152806014A87C9B1DAA410AD7\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\38058D3940402E5458B108E83AA75033\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0010-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8A9214E501BEFA47B1B2069EE267C0D\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\000021091A0090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8C08AEE0B4FCBFF4DB816962B994EDC2\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C9A6F846E2818A47A408CAF13381C71\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B50EAB9901F3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\82DE7549CF3F8CCB0DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109AB0090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICW\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109010090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7CC7F027D8365C46910D3063521B80B\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Mso_Core\Count
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\AccessDE_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8560EAB91C0F3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\07E1C9E99D7027947B5750FBDAE6D3A5\1033\GrooveIntlResource.dll
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\95913366615A1B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\PowerPoint_Intl\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B50EAB9901F3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E7F8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7B3554CE058FE804CAC166E14046848E\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Usage\GrooveFiles
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F71EEFB9D1BE3B010CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A62A952D6899D44489E91CA1BFD7740A\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3671BC89D0C5F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C917C9CCEEAEFE46974EC992F8700DD\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0117-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Ace_OdbcCurrentUser\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C970EAB9130F3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Sps_OutlookAddin\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C3FAC2B9BA0BCE110CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F26AFDA5F7C6FC646949B18163FE58D4\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\AccessDE_Core\Order
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Ace_OdbcCurrentUser\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94B0DDEF99CBDCB469618B4CA768A5FB\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E88BB5C866C031A409F04DAB44D67573\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\210AB6B7A405B1641B8815C6A0D9507A\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D6C7B862FD11C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7AD08F79957199CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}\DigitalProductID
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7060EAB95E0F3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\131D13871FCCFE340BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A07C2387B12CEE340CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E5C161912A2A6C4C93C76678926C56C\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CB01166D9A20AA45AFBE37BB874219F\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7B813366E55A1B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2171BC8913C5F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6057B798D2E9A42439615DC1151328FF\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109711090400000000000F01FEC\InstallProperties\WindowsInstaller
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DFC39E36AAC004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Outlook_Intl\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A81BC89D7B5F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\92F2F088AC13ECF45BBDC3F67BEE0B43\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D602F732C91589248BC588C917FFDE6E\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57A0EAB9B4EE3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\InstallLocation
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Outlook_Core\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5081BC895CB5F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9AB7696C8E350E80CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B64FB72C2797D14CB19381AF4411544\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F83217007FF}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF60EAB9970F3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A31EAB9FA7E3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D94C8360B8BB1DC41B1950E4F8237563\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4006F64980E4BACB0EF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24E4EDAA37A904D4DB02ECDC56C46FD2\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EADBFBF7BAFC77940A81C4B0F8E81888\00002109AB0090400000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\515AD2B95D5ABE110CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E303DF477533C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Excel_Intl\Count
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ShowOtherTablesInDataSrc
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6484EE93FE751C00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\52F1CAC1C1C96004F8B5863811E33071\00002109AB0090400000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\HelpLanguage
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109AB0090400000000000F01FEC\GrooveFilesIntl_1033
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts\00010437
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Outlook_AutoDiscover\Count
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\WinXPLanguagePatch
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E39B7B8682721C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65D08F79D77199CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\ProductCodes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Ace_OdbcCurrentUser\Count
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Mso_Intl\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07DEDD9F8F16079469A0D3265BA8594C\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\250D2EC62893A2E42B4EBF45C12B7B5F\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF586AE3E10DF3D4EA5BA4DD0B0302D6\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}\ProductID
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\User Settings\Word_Core\Order
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D84D03877FA767F459FC6272E56E3BC3\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DDFBC37E8440874DAB7C25041E8C8BA\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DEA00C998AE1B010CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F932641E363C6C140998A324AF56AEDB\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B9F0387FA2C0F340CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config\{90120000-0030-0000-0000-0000000FF1CE}\DiskFreeSpace
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EA7B711503001246845051536B6A26B\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\User Settings\Word_Intl\Count
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\243ACBCD38A2231458C912E75091C765\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B33DF479213C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\76D797A0865F57D4FBDA2603D66D2DFB\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B470EAB9550F3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\ProductFiles
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F03103879F2C1F340CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
    • HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\LanguageResources\InstallLanguage
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE4ABD129E4F1C941B7444D6977C7AE9\00002109030000000000000000F01FEC

Process IEXPLORE.EXE (1440)

Process rundll32.exe (1408)

  • Mutexes accessed

    • CTF.Compart.MutexDefaultS-1-5-21-1960408961-1085031214-725345543-1003
    • CTF.LBES.MutexDefaultS-1-5-21-1960408961-1085031214-725345543-1003
    • CTF.TMD.MutexDefaultS-1-5-21-1960408961-1085031214-725345543-1003
    • CTF.TimListCache.FMPDefaultS-1-5-21-1960408961-1085031214-725345543-1003MUTEX.DefaultS-1-5-21-1960408961-1085031214-725345543-1003
    • Global\MsoShellExtRegAccess_S-1-5-21-1960408961-1085031214-725345543-1003
    • CTF.Layouts.MutexDefaultS-1-5-21-1960408961-1085031214-725345543-1003
    • CTF.Asm.MutexDefaultS-1-5-21-1960408961-1085031214-725345543-1003

Process IEXPLORE.EXE (1440)

Process rundll32.exe (1408)

  • Directories created

    • C:\Documents and Settings\zamen\Local Settings\Application Data\Microsoft\Office\12.0\
  • Directories enumerated

    • C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
    • C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
    • C:\WINDOWS
    • C:\WINDOWS\WinSxS

Process IEXPLORE.EXE (1440)

  • Processes created

    • "C:\WINDOWS\system32\Rundll32.exe" "C:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL",GetResourceModulePath HmLZq7bxCkoPnk/Zv+CFzuu6+I/gFfsa
  • DLLs Loaded

    • OLE32
    • C:\WINDOWS\system32\SHELL32.dll
    • sensapi.dll
    • urlmon.dll
    • xpsp2res.dll
    • kernel32.dll
    • UxTheme.dll
    • BROWSEUI.dll
    • netapi32.dll
    • ntdll.dll
    • C:\WINDOWS\system32\browselc.dll
    • C:\WINDOWS\system32\msv1_0.dll
    • C:\WINDOWS\System32\mswsock.dll
    • xpsp3res.dll
    • ADVAPI32.dll
    • C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    • shlwapi.dll
    • USER32.DLL
    • URLMON.DLL
    • rasadhlp.dll
    • SHDOCVW.dll
    • WININET.dll
    • crypt32.dll
    • RASAPI32.DLL
    • Secur32.dll
    • shdoclc.dll
    • C:\WINDOWS\system32\mswsock.dll
    • rsaenh.dll
    • C:\Program Files\Java\jre1.8.0_111\bin\jp2ssv.dll
    • ole32.dll
    • comctl32.dll
    • hnetcfg.dll
    • USER32.dll
    • Comctl32.dll
    • MLANG.dll
    • wsock32
    • RTUTILS.DLL
    • shdocvw.dll
    • C:\WINDOWS\system32\urlmon.dll
    • shell32.dll
    • Kernel32.DLL
    • C:\WINDOWS\system32\shdoclc.dll
    • secur32.dll
    • OLEAUT32.dll
    • mlang.dll
    • SHELL32.dll
    • DNSAPI.dll
    • C:\WINDOWS\System32\wshtcpip.dll
    • COMCTL32.dll
    • oleaut32.dll
    • OLEAUT32
    • SHLWAPI.dll
    • C:\WINDOWS\system32\xpsp3res.dll
    • C:\WINDOWS\system32\ole32.dll
    • RASMAN.DLL
    • SXS.DLL
    • USERENV.dll
    • appHelp.dll
    • ws2_32
    • UXTHEME.DLL
    • C:\Program Files\Java\jre1.8.0_111\bin\msvcr100.dll
    • OLE32.DLL
    • C:\Program Files\Java\jre1.8.0_111\bin\deploy.dll
    • SHELL32.DLL
    • rpcrt4.dll
    • C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    • SETUPAPI.dll
    • WS2_32.dll
    • OLEAUT32.DLL
    • user32.dll
    • MSImg32.dll

Process rundll32.exe (1408)

  • DLLs Loaded

    • C:\WINDOWS\system32\ADVAPI32.DLL
    • C:\Program Files\Common Files\Microsoft Shared\office12\1033\MSOINTL.DLL
    • kernel32.dll
    • C:\Program Files\Microsoft Office\Office12\1033\GrooveIntlResource.dll
    • Shlwapi.DLL
    • UxTheme.DLL
    • C:\WINDOWS\system32\KERNEL32.DLL
    • advapi32.dll
    • C:\WINDOWS\system32\uxtheme.dll
    • Comctl32.dll
    • MSO.dll
    • VERSION.DLL
    • C:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL
    • Kernel32.DLL
    • uxtheme.dll
    • C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSORES.DLL
    • comctl32.dll
    • mso.dll
    • C:\WINDOWS\system32\MSCTF.dll
    • C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll
    • SHELL32.DLL
    • rpcrt4.dll
    • Shlwapi.dll
No static analysis available.
Antivirus Result
CLEAN MX Clean Site
DNS8 Clean Site
VX Vault Clean Site
ZDB Zeus Clean Site
Tencent Clean Site
Netcraft Unrated Site
desenmascara_me Clean Site
Dr_Web Clean Site
PhishLabs Unrated Site
Zerofox Clean Site
K7AntiVirus Clean Site
Virusdie External Site Scan Clean Site
SCUMWARE_org Clean Site
Quttera Clean Site
AegisLab WebGuard Clean Site
MalwareDomainList Clean Site
ZeusTracker Clean Site
zvelo Clean Site
Google Safebrowsing Clean Site
Kaspersky Clean Site
BitDefender Clean Site
Certly Clean Site
G-Data Clean Site
C-SIRT Clean Site
OpenPhish Clean Site
Malware Domain Blocklist Clean Site
MalwarePatrol Clean Site
Webutation Clean Site
Trustwave Clean Site
Web Security Guard Clean Site
CyRadar Clean Site
ADMINUSLabs Clean Site
Malwarebytes hpHosts Clean Site
Opera Clean Site
AlienVault Clean Site
Emsisoft Clean Site
Malc0de Database Clean Site
Spam404 Clean Site
Phishtank Clean Site
Malwared Clean Site
Avira Clean Site
NotMining Unrated Site
CyberCrime Clean Site
Antiy-AVL Clean Site
Forcepoint ThreatSeeker Unrated Site
FraudSense Clean Site
malwares_com URL checker Clean Site
Comodo Site Inspector Clean Site
Malekal Clean Site
ESET Clean Site
Sophos Unrated Site
Yandex Safebrowsing Clean Site
SecureBrain Clean Site
Nucleon Clean Site
Sucuri SiteCheck Clean Site
Blueliv Clean Site
ZCloudsec Clean Site
AutoShun Unrated Site
ThreatHive Clean Site
FraudScore Clean Site
Rising Clean Site
URLQuery Unrated Site
StopBadware Unrated Site
Fortinet Clean Site
ZeroCERT Clean Site
Baidu-International Clean Site
securolytics Clean Site

Process Tree


IEXPLORE.EXE, PID: 1440, Parent PID: 1312

default registry file network process services synchronisation iexplore office pdf

rundll32.exe, PID: 1408, Parent PID: 1440

default registry file network process services synchronisation iexplore office pdf

Deprecation note: While processing this analysis you did not have the httpreplay Python library installed. Installing this library (i.e., pip install httpreplay) will allow Cuckoo to do more proper PCAP analysis including but not limited to showing full HTTP and HTTPS (!) requests and responses. It is recommended that you install this library and possibly reprocess any interesting analysis tasks.

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.128.102 1025 192.168.128.111 53
192.168.128.102 137 192.168.128.255 137
192.168.128.102 138 192.168.128.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 2438437234472e54_groove12.pip
Filepath C:\Documents and Settings\zamen\Application Data\Microsoft\Office\Groove12.pip
Size 144.0B
Processes 1408 (rundll32.exe)
Type data
MD5 b7f9c831d347c365afe4d4fc912a6ccb
SHA1 6f76ef1ab1a02e9bed1b858ae5398b015c511e24
SHA256 2438437234472e54bca542fe8017405c269026aca4ed554beabba79dd3f12d89
CRC32 A67B5A82
ssdeep 3:0/l3lldHllXlD//hllrllrllrll:87
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.
Task ID 642
Mongo ID 5c37102411d3080d16cdebce
Cuckoo release 2.0-dev