IOC Report
NetCDF4Excel_3_3_setup.exe

loading gif

Files

File Path
Type
Category
Malicious
NetCDF4Excel_3_3_setup.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
malicious
C:\Program Files (x86)\NetCDF4Excel\NetCDF4Excel_2007.xlsm
Microsoft Excel 2007+
dropped
C:\Program Files (x86)\NetCDF4Excel\VbNc.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files (x86)\NetCDF4Excel\uninstaller.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\R6H1M60R\osfintl[1].xml
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt (copy)
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1AC88B16.tmp
Microsoft Excel 2007+
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\WefGalleryExcel[1]
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\office[1]
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\BusinessBarClose_16x16x32[1]
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\WefGallery[1]
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\WefGalleryExcelInsert[1]
HTML document, ASCII text, with very long lines (314), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\WefGallery[1]
ASCII text, with very long lines (64712), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\Progress[1]
GIF image data, version 89a, 24 x 24
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\wefgallery_strings[1]
ASCII text, with very long lines (10137), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\9EABC9EF.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
data
dropped
C:\Users\user\AppData\Local\Temp\~DF091FBA1044B213DC.TMP
data
dropped
C:\Users\user\AppData\Local\Temp\~DF88F2325B87F19935.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NetCDF4Excel\NetCDF4Excel_2007.xlsm.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Aug 23 17:06:12 2017, mtime=Mon Oct 28 09:02:57 2024, atime=Wed Aug 23 17:06:12 2017, length=299329, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NetCDF4Excel\Uninstall.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Oct 28 09:02:57 2024, mtime=Mon Oct 28 09:02:57 2024, atime=Mon Oct 28 09:02:57 2024, length=36743, window=hide
dropped
C:\Users\user\Desktop\NetCDF4Excel_2007.xlsm.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Aug 23 17:06:12 2017, mtime=Mon Oct 28 09:02:57 2024, atime=Wed Aug 23 17:06:12 2017, length=299329, window=hide
dropped
There are 12 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe
"C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe"
C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE"
C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 8192
C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Program Files (x86)\NetCDF4Excel\NetCDF4Excel_2007.xlsm"

URLs

Name
IP
Malicious
http://www.gnu.0org/
unknown
http://www.gnu.o
unknown
http://www.gnu.or
unknown
http://nsis.sf.net/NSIS_Error
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE
unknown
http://www.gnu.orgF/
unknown
http://www.gnu.org/licenses/
unknown
https://github.com/OfficeDev/office-js/blob/release/LICENSE.md
unknown

Domains

Name
IP
Malicious
s-part-0032.t-0009.t-msedge.net
13.107.246.60

IPs

IP
Domain
Country
Malicious
13.107.246.60
s-part-0032.t-0009.t-msedge.net
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment
PATH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
,v3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Licensing
EligibleForExtendedGrace
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
ExcelWorkbookOpenedCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
Categories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
Categories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSCategoriesSeverities
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSAllCategories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.7
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.9
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.10
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.11
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.13
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.14
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.15
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.16
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.17
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.18
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.19
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.20
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.21
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.22
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.23
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.24
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.25
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.26
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.27
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.28
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
0.29
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
ETag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
ConfigIds
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
nm3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
~m3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}
UpdateInProgress
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM10000137
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM10000137\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM10000137\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM10000137\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16400656
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16400656\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16400656\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16400656\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM11414620
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM11414620\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM11414620\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM11414620\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16400647
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16400647\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16400647\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16400647\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM45299826
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM45299826\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM45299826\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM45299826\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM67739505
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM67739505\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM67739505\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM67739505\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM11829122
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM11829122\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM11829122\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM11829122\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM33398600
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM33398600\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM33398600\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM33398600\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM34128371
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM34128371\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM34128371\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM34128371\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM04014209
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM04014209\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM04014209\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM04014209\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02897376
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02897376\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02897376\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02897376\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03458075
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03458075\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03458075\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03458075\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM78582910
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM78582910\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM78582910\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM78582910\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM44562389
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM44562389\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM44562389\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM44562389\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM89309507
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM89309507\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM89309507\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM89309507\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM44461500
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM44461500\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM44461500\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM44461500\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03107665
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03107665\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03107665\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03107665\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16410221
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16410221\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16410221\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16410221\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03987161
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03987161\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03987161\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03987161\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03107658
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03107658\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03107658\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03107658\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02802345
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02802345\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02802345\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02802345\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM78443713
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM78443713\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM78443713\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM78443713\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03987167
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03987167\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03987167\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03987167\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM23154796
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM23154796\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM23154796\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM23154796\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03986974
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03986974\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03986974\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM03986974\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM66862102
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM66862102\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM66862102\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM66862102\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM22583886
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM22583886\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM22583886\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM22583886\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02887601
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02887601\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02887601\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02887601\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM55723235
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM55723235\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM55723235\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM55723235\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02930043
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02930043\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02930043\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM02930043\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16410255
Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16410255\Images
ImageData0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16410255\Images
ImageData0001
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}\TM16410255\Images
ImageData0002
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}
KeywordData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}
ExpirationDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}
Version
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}
PriorityFlag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}
xResponseId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}
TemplatesCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Volatile
MsaDevice
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\COM Class Map
{EFBD9A69-66AF-4D44-BB36-D477E5014216}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Providers
WefCacheId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Providers\vai+V16+KDygsa7v22t_6Q==
UniqueId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Providers\vai+V16+KDygsa7v22t_6Q==
Entitlements
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF
Excel__HasRegistryAddin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
(+4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
(+4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Cache\UserIdentityCache
LastUseAppCommandVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Cache\UserIdentityCache
ExcelCacheExpire
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Cache\UserIdentityCache
ExcelExchangeCatUserIdentity
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Cache\UserIdentityCache
ExcelOmexUserIdentity
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Cache\UserIdentityCache
ExcelIsAnonymous
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Cache\UserIdentityCache
ExcelCachePerIdentity
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Providers\2b7sy_Fuafa8ToSYH1UTPQ==
UniqueId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\osfintl.dll
NumberOfSubdomains
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
SmartLookupUxVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
SmartLookupDictBFVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified
excel.exe_queried
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
ts4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2EFF5
2EFF5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Security\FileBlock
FileTypeBlockList
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Security\FileBlock
OoxmlConverterBlockList
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ExdCache\Excel8.0
MSForms
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ExdCache\Excel8.0
MSComctlLib
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
Categories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
Categories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSCategoriesSeverities
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSAllCategories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2F227
2F227
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
FileActivityStoreVersion
HKEY_CURRENT_USER_Classes\TypeLib\{75926BB1-98A3-4DB3-91C2-C4E13242F13E}\2.0
NULL
HKEY_CURRENT_USER_Classes\TypeLib\{75926BB1-98A3-4DB3-91C2-C4E13242F13E}\2.0\FLAGS
NULL
HKEY_CURRENT_USER_Classes\TypeLib\{75926BB1-98A3-4DB3-91C2-C4E13242F13E}\2.0\0\win32
NULL
HKEY_CURRENT_USER_Classes\TypeLib\{75926BB1-98A3-4DB3-91C2-C4E13242F13E}\2.0\HELPDIR
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
NULL
HKEY_CURRENT_USER_Classes\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
NULL
HKEY_CURRENT_USER_Classes\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
NULL
HKEY_CURRENT_USER_Classes\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
NULL
HKEY_CURRENT_USER_Classes\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
NULL
HKEY_CURRENT_USER_Classes\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
NULL
HKEY_CURRENT_USER_Classes\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
NULL
HKEY_CURRENT_USER_Classes\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
NULL
HKEY_CURRENT_USER_Classes\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
NULL
HKEY_CURRENT_USER_Classes\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
NULL
HKEY_CURRENT_USER_Classes\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
NULL
HKEY_CURRENT_USER_Classes\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
NULL
HKEY_CURRENT_USER_Classes\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
NULL
HKEY_CURRENT_USER_Classes\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
NULL
HKEY_CURRENT_USER_Classes\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
NULL
HKEY_CURRENT_USER_Classes\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}
NULL
HKEY_CURRENT_USER_Classes\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}
NULL
HKEY_CURRENT_USER_Classes\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}
NULL
HKEY_CURRENT_USER_Classes\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}
NULL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IMEMIP\0x0809
Input
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IMEMIP\0x0809
TargetConverted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IMEMIP\0x0809
Converted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IMEMIP\0x0809
TargetNotConverted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IMEMIP\0x0809
InputError
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IMEMIP\0x0809
FixedConverted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 21
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Place MRU
Item 1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
ExcelWorkbookAutoRecoverDirty
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
kc4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
kc4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
ImmersiveWorkbookDirtySentinel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
ExcelPreviousSessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
SessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
FilePath
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
StartDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
EndDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingConfigurableSettings
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingConfigurableSettings
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastSyncTimeExcel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastWriteTimeExcel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
Expires
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel\ConfigContextData
VersionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
Expires
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\excel
DeferredConfigs
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastSyncTimeExcel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastWriteTimeExcel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{E042FC66-7EE0-4F4B-8EEE-FAF75A8564F9}
UpdateInProgress
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{E042FC66-7EE0-4F4B-8EEE-FAF75A8564F9}
UpdateInProgress
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache
UpdateData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\DocumentTemplateCache\en-CH{706E3DA8-37EC-4B93-8B19-A1536363BAF3}
UpdateInProgress
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018C00B92EA0FCD
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastSyncTimeExcel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastWriteTimeExcel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
SmartLookupDictBFVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
SmartLookupUxVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
ExcelWorkbookOpenedCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2EFF5
2EFF5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified
excel.exe_queried
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2EFF5
2EFF5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\DocumentRecovery\2EFF5
2EFF5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
ExcelWorkbookOpenedCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 7
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 9
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 10
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 11
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 13
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 14
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 15
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 16
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 17
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 18
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 19
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\File MRU
Item 20
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastWriteTimeExcel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
ImmersiveWorkbookDirtySentinel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastSyncTimeExcel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastWriteTimeExcel
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\2924
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
{j.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
Categories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
Categories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSCategoriesSeverities
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSAllCategories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{F562BB8E-422D-4B5C-B20E-90D710F7D11C}
Categories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ETWMonitor\{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}
Categories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSTagIds2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSCategoriesSeverities
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\excel.exe\ULSMonitor
ULSAllCategories
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5f2615e8\1031432769
ItemKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5f2615e8\1031432769
ItemData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5f2615e8\1031432769
SortKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5f2615e8\1031432769
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5f2615e8\1031432769
LastOperation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5fd6a8ae\-1531976937
ItemKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5fd6a8ae\-1531976937
ItemData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5fd6a8ae\-1531976937
SortKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5fd6a8ae\-1531976937
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5fd6a8ae\-1531976937
LastOperation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\813ae6b6\1100102235
ItemKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\813ae6b6\1100102235
ItemData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\813ae6b6\1100102235
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\c97901ac\630260916
ItemKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\c97901ac\630260916
ItemData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\c97901ac\630260916
SortKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\c97901ac\630260916
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\c97901ac\630260916
LastOperation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\fc752935\-1284322027
ItemKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\fc752935\-1284322027
ItemData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\fc752935\-1284322027
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\38cb8f49\-1613971593
ItemKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\38cb8f49\-1613971593
ItemData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\38cb8f49\-1613971593
SortKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\38cb8f49\-1613971593
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\38cb8f49\-1613971593
LastOperation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\a70c68f4\190925126
ItemKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\a70c68f4\190925126
ItemData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\a70c68f4\190925126
SortKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\a70c68f4\190925126
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\a70c68f4\190925126
LastOperation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\EXCEL\2924
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
ExcelWorkbookOpenedCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
ExcelPreviousSessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\2924
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\2924
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\2924
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\2924
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified
excel.exe_queried
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified
excel.exe_queried
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\3e866f52\-1703295739
ItemData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\3e866f52\-1703295739
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\32dbee8e\963821245
ItemData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\32dbee8e\963821245
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5f2615e8\1031432769
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\5fd6a8ae\-1531976937
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\3e866f52\-1703295739
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\813ae6b6\1100102235
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\32dbee8e\963821245
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\c97901ac\630260916
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\fc752935\-1284322027
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\38cb8f49\-1613971593
LastModified
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming\Identities\Anonymous\Settings\1258\{00000000-0000-0000-0000-000000000000}\PendingChanges\a70c68f4\190925126
LastModified
There are 509 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
610000
heap
page read and write
437000
unkown
page readonly
5DE000
stack
page read and write
400000
unkown
page readonly
83A000
heap
page read and write
64A000
heap
page read and write
434000
unkown
page read and write
1F0000
heap
page read and write
686000
heap
page read and write
69D000
heap
page read and write
271E000
stack
page read and write
685000
heap
page read and write
676000
heap
page read and write
80F000
stack
page read and write
688000
heap
page read and write
67A000
heap
page read and write
401000
unkown
page execute read
658000
heap
page read and write
652000
heap
page read and write
4B0000
heap
page read and write
657000
heap
page read and write
6A2000
heap
page read and write
671000
heap
page read and write
409000
unkown
page write copy
684000
heap
page read and write
680000
heap
page read and write
667000
heap
page read and write
4A0000
heap
page read and write
4B10000
heap
page read and write
480000
heap
page read and write
62D000
heap
page read and write
409000
unkown
page read and write
484000
heap
page read and write
440000
heap
page read and write
6A0000
heap
page read and write
98000
stack
page read and write
65B000
heap
page read and write
407000
unkown
page readonly
681000
heap
page read and write
25DE000
stack
page read and write
66C000
heap
page read and write
683000
heap
page read and write
663000
heap
page read and write
687000
heap
page read and write
26DF000
stack
page read and write
65F000
heap
page read and write
29C0000
trusted library allocation
page read and write
61B000
heap
page read and write
65F000
heap
page read and write
225F000
stack
page read and write
65B000
heap
page read and write
201E000
stack
page read and write
2EF0000
trusted library allocation
page read and write
215E000
stack
page read and write
652000
heap
page read and write
2930000
heap
page read and write
4C0000
heap
page read and write
836000
heap
page read and write
211F000
stack
page read and write
281F000
stack
page read and write
407000
unkown
page readonly
830000
heap
page read and write
644000
heap
page read and write
19A000
stack
page read and write
42C000
unkown
page read and write
There are 55 hidden memdumps, click here to show them.