IOC Report
X SBC - Virtual SBC For TrustID v1 Change Order 2024-10-09 Approved AH Clean(NON-CONFIDENTIAL).docx

loading gif

Files

File Path
Type
Category
Malicious
X SBC - Virtual SBC For TrustID v1 Change Order 2024-10-09 Approved AH Clean(NON-CONFIDENTIAL).docx
Microsoft Word 2007+
initial sample
C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf
TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\61D5736.png
PNG image data, 279 x 180, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\829F60B4.png
PNG image data, 1700 x 208, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8482F1BF.png
PNG image data, 70 x 65, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{EF84AE1E-CFED-4A38-8DC1-F54468F81C1D}.tmp
Composite Document File V2 Document, Cannot read section info
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B4880A55-8D55-4309-8CD5-0F82A717D0BB}.tmp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E6D2FA23-EED4-41A5-8E41-7F09C22C7D6F}.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1730397827899534900_8E2F86E5-0175-490B-AAFB-C8BBE0234A6C.log
ASCII text, with very long lines (6589), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD97BF.tmp\BracketList.glox
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD97BF.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9806.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9806.tmp\InterconnectedBlockProcess.glox
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCD982D.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD982D.tmp\pictureorgchart.glox
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD983E.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD983E.tmp\iso690nmerical.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD984F.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD984F.tmp\sist02.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD989F.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD989F.tmp\chevronaccent.glox
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD98B1.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD98B1.tmp\architecture.glox
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD98C6.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD98C6.tmp\RadialPictureList.glox
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD98C9.tmp\CircleProcess.glox
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCD98C9.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD98DA.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD98DA.tmp\gosttitle.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD98EA.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD98EA.tmp\ThemePictureAlternatingAccent.glox
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCD98FE.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD98FE.tmp\chicago.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9910.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9910.tmp\gb.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9920.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9920.tmp\PictureFrame.glox
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9931.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9931.tmp\gostname.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9941.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9941.tmp\Equations.dotx
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Local\Temp\TCD9952.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9952.tmp\ThemePictureGrid.glox
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCD9963.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9963.tmp\Text Sidebar (Annual Report Red and Black design).docx
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Local\Temp\TCD9985.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9985.tmp\mlaseventheditionofficeonline.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9996.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9996.tmp\ConvergingText.glox
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCD99A6.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD99A6.tmp\iso690.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD99C6.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD99C6.tmp\TabbedArc.glox
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCD99E7.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD99E7.tmp\harvardanglia2008officeonline.xsl
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD99F8.tmp\APASixthEditionOfficeOnline.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD99F8.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD99F9.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD99F9.tmp\ThemePictureAccent.glox
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCD9A0A.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9A0A.tmp\Element design set.dotx
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Local\Temp\TCD9A0B.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9A0B.tmp\HexagonRadial.glox
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9A1C.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9A1C.tmp\TabList.glox
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCD9A2C.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9A2C.tmp\rings.glox
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9A4C.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9A4C.tmp\VaryingWidthList.glox
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9A5D.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9A5D.tmp\ieee2006officeonline.xsl
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9AAC.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCD9AAC.tmp\turabian.xsl
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9E19.tmp\View.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9E19.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9E8B.tmp\Banded.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9E8B.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9E9B.tmp\Dividend.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9E9B.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9EBB.tmp\Metropolitan.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9EBB.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9EEC.tmp\Basis.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9EEC.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCD9F0E.tmp\Frame.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCD9F0E.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDA048.tmp\Parcel.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDA048.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDA2DA.tmp\Parallax.thmx
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCDA2DA.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDA3A7.tmp\Wood_Type.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDA3A7.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDA417.tmp\Quotable.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDA417.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDA4B5.tmp\Berlin.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDA4B5.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDA709.tmp\Gallery.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDA709.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDA7D6.tmp\Savon.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDA7D6.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDA865.tmp\Circuit.thmx
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\TCDA865.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDAA0C.tmp\Droplet.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDAA0C.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDAC8F.tmp\Damask.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDAC8F.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDACEF.tmp\Slate.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDACEF.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDAF43.tmp\Main_Event.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDAF43.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDAFE1.tmp\Mesh.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDAFE1.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDB169.tmp\Vapor_Trail.thmx
Microsoft OOXML
dropped
C:\Users\user\AppData\Local\Temp\TCDB169.tmp\content.inf
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TCDB227.tmp\Content.inf
data
dropped
C:\Users\user\AppData\Local\Temp\TCDB227.tmp\Insight design set.dotx
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Local\Temp\cab978F.tmp
Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab97C0.tmp
Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab97D0.tmp
Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab97E1.tmp
Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab97E2.tmp
Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab97E3.tmp
Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab97E4.tmp
Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab97F5.tmp
Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab97F6.tmp
Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9807.tmp
Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9818.tmp
Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9819.tmp
Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab981A.tmp
Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab981B.tmp
Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab981C.tmp
Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab982C.tmp
Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab987F.tmp
Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98A0.tmp
Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98B0.tmp
Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98B2.tmp
Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98B3.tmp
Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98B4.tmp
Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98C5.tmp
Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98C7.tmp
Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98C8.tmp
Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98EB.tmp
Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98EC.tmp
Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98ED.tmp
Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab98FF.tmp
Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9973.tmp
Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9984.tmp
Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab99E8.tmp
Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9DE9.tmp
Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9E68.tmp
Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9E79.tmp
Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9E7A.tmp
Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9EBC.tmp
Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cab9EED.tmp
Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabA028.tmp
Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabA2BA.tmp
Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabA387.tmp
Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabA3F7.tmp
Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabA485.tmp
Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabA6D9.tmp
Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabA7A6.tmp
Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabA844.tmp
Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabA9DD.tmp
Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabAC50.tmp
Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabACA0.tmp
Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabAF03.tmp
Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabAFA1.tmp
Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabB11A.tmp
Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
dropped
C:\Users\user\AppData\Local\Temp\cabB1C8.tmp
Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
dropped
C:\Users\user\AppData\Local\Temp\mso5B50.tmp
GIF image data, version 89a, 15 x 15
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Thu Oct 31 17:03:47 2024, mtime=Thu Oct 31 17:05:04 2024, atime=Thu Oct 31 17:05:04 2024, length=0, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\X SBC - Virtual SBC For TrustID v1 Change Order 2024-10-09 Approved AH Clean(NON-CONFIDENTIAL).LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Oct 5 05:47:16 2023, mtime=Thu Oct 31 17:03:51 2024, atime=Thu Oct 31 17:03:46 2024, length=81971, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Generic INItialization configuration [folders]
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)
Microsoft OOXML
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)
XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0002.tmp
Microsoft Word 2007+
dropped
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Users\user\Desktop\X SBC - Virtual SBC For TrustID v1 Change Order 2024-10-09 Approved AH Clean(NON-CONFIDENTIAL).docx (copy)
Microsoft Word 2007+
dropped
C:\Users\user\Desktop\~$SBC - Virtual SBC For TrustID v1 Change Order 2024-10-09 Approved AH Clean(NON-CONFIDENTIAL).docx
data
dropped
C:\Users\user\Desktop\~WRD0000.tmp
Microsoft Word 2007+
dropped
C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
Chrome Cache Entry: 372
Java source, ASCII text, with very long lines (970)
dropped
Chrome Cache Entry: 373
HTML document, Unicode text, UTF-8 text, with very long lines (8856)
downloaded
Chrome Cache Entry: 374
ASCII text, with very long lines (701)
downloaded
Chrome Cache Entry: 375
ASCII text, with very long lines (15752)
dropped
Chrome Cache Entry: 376
ASCII text, with very long lines (37481)
dropped
Chrome Cache Entry: 377
ASCII text, with very long lines (29468), with no line terminators
downloaded
Chrome Cache Entry: 378
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 379
ASCII text
downloaded
Chrome Cache Entry: 380
Java source, ASCII text, with very long lines (1225)
downloaded
Chrome Cache Entry: 381
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 382
Java source, ASCII text, with very long lines (3147)
dropped
Chrome Cache Entry: 383
ASCII text, with very long lines (2947)
downloaded
Chrome Cache Entry: 384
JSON data
downloaded
Chrome Cache Entry: 385
ASCII text
dropped
Chrome Cache Entry: 386
JSON data
dropped
Chrome Cache Entry: 387
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 388
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 389
Java source, ASCII text, with very long lines (2494)
downloaded
Chrome Cache Entry: 390
Java source, ASCII text, with very long lines (2494)
dropped
Chrome Cache Entry: 391
ASCII text, with very long lines (23949)
dropped
Chrome Cache Entry: 392
ASCII text
dropped
Chrome Cache Entry: 393
Unicode text, UTF-8 text, with very long lines (17289), with no line terminators
dropped
Chrome Cache Entry: 394
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 395
ASCII text
downloaded
Chrome Cache Entry: 396
ASCII text, with very long lines (22445)
dropped
Chrome Cache Entry: 397
Java source, ASCII text, with very long lines (1225)
dropped
Chrome Cache Entry: 398
PNG image data, 600 x 106, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 399
JSON data
downloaded
Chrome Cache Entry: 400
ASCII text
dropped
Chrome Cache Entry: 401
ASCII text
dropped
Chrome Cache Entry: 402
ASCII text, with very long lines (427)
downloaded
Chrome Cache Entry: 403
ASCII text, with very long lines (32034)
dropped
Chrome Cache Entry: 404
Java source, ASCII text, with very long lines (924)
downloaded
Chrome Cache Entry: 405
ASCII text, with very long lines (21587), with no line terminators
downloaded
Chrome Cache Entry: 406
ASCII text, with very long lines (11048)
dropped
Chrome Cache Entry: 407
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 408
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 409
JSON data
dropped
Chrome Cache Entry: 410
ASCII text, with very long lines (29272)
dropped
Chrome Cache Entry: 411
ASCII text, with no line terminators
dropped
Chrome Cache Entry: 412
ASCII text
downloaded
Chrome Cache Entry: 413
ASCII text, with very long lines (19197)
dropped
Chrome Cache Entry: 414
ASCII text
dropped
Chrome Cache Entry: 415
JSON data
downloaded
Chrome Cache Entry: 416
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 417
JSON data
downloaded
Chrome Cache Entry: 418
ASCII text, with very long lines (4163), with no line terminators
dropped
Chrome Cache Entry: 419
PNG image data, 391 x 69, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 420
ASCII text
dropped
Chrome Cache Entry: 421
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 422
ASCII text, with very long lines (4644), with no line terminators
downloaded
Chrome Cache Entry: 423
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 424
Java source, ASCII text, with very long lines (760)
downloaded
Chrome Cache Entry: 425
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 426
ASCII text, with very long lines (1434), with no line terminators
downloaded
Chrome Cache Entry: 427
ASCII text
downloaded
Chrome Cache Entry: 428
ASCII text, with very long lines (1836), with no line terminators
downloaded
Chrome Cache Entry: 429
ASCII text
downloaded
Chrome Cache Entry: 430
ASCII text, with very long lines (6707)
downloaded
Chrome Cache Entry: 431
Java source, ASCII text, with very long lines (4172)
dropped
Chrome Cache Entry: 432
ASCII text, with very long lines (647)
downloaded
Chrome Cache Entry: 433
PNG image data, 2879 x 751, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 434
PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 435
ASCII text, with very long lines (11048)
downloaded
Chrome Cache Entry: 436
Java source, ASCII text, with very long lines (760)
dropped
Chrome Cache Entry: 437
ASCII text, with very long lines (422)
dropped
Chrome Cache Entry: 438
data
downloaded
Chrome Cache Entry: 439
PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 440
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 441
ASCII text, with very long lines (50018)
dropped
Chrome Cache Entry: 442
ASCII text
downloaded
Chrome Cache Entry: 443
ASCII text, with very long lines (647)
dropped
Chrome Cache Entry: 444
TrueType Font data, 17 tables, 1st "GPOS", 15 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto LightRegularVersion 2.001151; 2014Roboto-L
downloaded
Chrome Cache Entry: 445
Java source, ASCII text, with very long lines (538)
downloaded
Chrome Cache Entry: 446
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 447
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 448
ASCII text, with very long lines (19197)
downloaded
Chrome Cache Entry: 449
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 450
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 451
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 452
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 453
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 454
Java source, ASCII text, with very long lines (2260)
downloaded
Chrome Cache Entry: 455
ASCII text, with very long lines (29272)
downloaded
Chrome Cache Entry: 456
ASCII text
downloaded
Chrome Cache Entry: 457
ASCII text, with very long lines (65317)
downloaded
Chrome Cache Entry: 458
ASCII text, with very long lines (2947)
dropped
Chrome Cache Entry: 459
ASCII text, with very long lines (52271)
dropped
Chrome Cache Entry: 460
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 461
HTML document, ASCII text, with very long lines (4636)
dropped
Chrome Cache Entry: 462
PNG image data, 391 x 69, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 463
ASCII text, with very long lines (43408)
downloaded
Chrome Cache Entry: 464
PNG image data, 42 x 16, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 465
Java source, ASCII text, with very long lines (25869)
downloaded
Chrome Cache Entry: 466
ASCII text, with very long lines (2345)
dropped
Chrome Cache Entry: 467
ASCII text, with very long lines (392)
downloaded
Chrome Cache Entry: 468
ASCII text
dropped
Chrome Cache Entry: 469
Java source, ASCII text, with very long lines (807)
downloaded
Chrome Cache Entry: 470
ASCII text, with very long lines (422)
downloaded
Chrome Cache Entry: 471
JSON data
dropped
Chrome Cache Entry: 472
ASCII text, with very long lines (2694)
downloaded
Chrome Cache Entry: 473
Java source, ASCII text, with very long lines (526)
downloaded
Chrome Cache Entry: 474
ASCII text, with very long lines (48464)
downloaded
Chrome Cache Entry: 475
ASCII text
downloaded
Chrome Cache Entry: 476
ASCII text, with very long lines (12736)
downloaded
Chrome Cache Entry: 477
Java source, ASCII text, with very long lines (3217)
downloaded
Chrome Cache Entry: 478
ASCII text, with very long lines (43408)
dropped
Chrome Cache Entry: 479
JSON data
downloaded
Chrome Cache Entry: 480
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 481
ASCII text, with very long lines (15752)
downloaded
Chrome Cache Entry: 482
ASCII text
downloaded
Chrome Cache Entry: 483
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 484
ASCII text
downloaded
Chrome Cache Entry: 485
ASCII text, with very long lines (41564)
dropped
Chrome Cache Entry: 486
Java source, ASCII text, with very long lines (970)
downloaded
Chrome Cache Entry: 487
ASCII text
downloaded
Chrome Cache Entry: 488
Java source, ASCII text, with very long lines (3217)
dropped
Chrome Cache Entry: 489
ASCII text, with very long lines (57765)
downloaded
Chrome Cache Entry: 490
assembler source, ASCII text
downloaded
Chrome Cache Entry: 491
Java source, ASCII text, with very long lines (1438)
dropped
Chrome Cache Entry: 492
ASCII text, with very long lines (701)
dropped
Chrome Cache Entry: 493
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 494
ASCII text, with very long lines (2343)
dropped
Chrome Cache Entry: 495
ASCII text, with very long lines (41564)
downloaded
Chrome Cache Entry: 496
ASCII text, with very long lines (32034)
downloaded
Chrome Cache Entry: 497
Unicode text, UTF-8 text, with very long lines (32023)
downloaded
Chrome Cache Entry: 498
Java source, ASCII text, with very long lines (538)
dropped
Chrome Cache Entry: 499
JSON data
downloaded
Chrome Cache Entry: 500
ASCII text, with very long lines (11048)
dropped
Chrome Cache Entry: 501
Unicode text, UTF-8 text, with very long lines (38828), with no line terminators
dropped
Chrome Cache Entry: 502
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 503
ASCII text, with very long lines (1419)
downloaded
Chrome Cache Entry: 504
JSON data
dropped
Chrome Cache Entry: 505
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 506
ASCII text, with very long lines (9463), with no line terminators
dropped
Chrome Cache Entry: 507
ASCII text, with very long lines (5848), with no line terminators
downloaded
Chrome Cache Entry: 508
Unicode text, UTF-8 text, with very long lines (38828), with no line terminators
downloaded
Chrome Cache Entry: 509
Java source, ASCII text, with very long lines (815)
dropped
Chrome Cache Entry: 510
ASCII text
downloaded
Chrome Cache Entry: 511
ASCII text, with very long lines (5848), with no line terminators
dropped
Chrome Cache Entry: 512
ASCII text, with very long lines (1216), with no line terminators
downloaded
Chrome Cache Entry: 513
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 514
Java source, ASCII text, with very long lines (924)
dropped
Chrome Cache Entry: 515
ASCII text
dropped
Chrome Cache Entry: 516
ASCII text, with very long lines (427)
dropped
Chrome Cache Entry: 517
Java source, ASCII text, with very long lines (25869)
dropped
Chrome Cache Entry: 518
Unicode text, UTF-8 text, with very long lines (2322)
dropped
Chrome Cache Entry: 519
ASCII text, with no line terminators
dropped
Chrome Cache Entry: 520
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 521
Java source, ASCII text, with very long lines (1438)
downloaded
Chrome Cache Entry: 522
HTML document, ASCII text, with very long lines (4636)
downloaded
Chrome Cache Entry: 523
ASCII text
downloaded
Chrome Cache Entry: 524
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 525
ASCII text, with very long lines (4272)
dropped
Chrome Cache Entry: 526
ASCII text, with very long lines (1419)
dropped
Chrome Cache Entry: 527
ASCII text, with no line terminators
dropped
Chrome Cache Entry: 528
ASCII text, with very long lines (18308)
dropped
Chrome Cache Entry: 529
ASCII text, with very long lines (40030), with no line terminators
downloaded
Chrome Cache Entry: 530
ASCII text, with very long lines (65447)
downloaded
Chrome Cache Entry: 531
Java source, ASCII text, with very long lines (357)
downloaded
Chrome Cache Entry: 532
ASCII text, with very long lines (18308)
downloaded
Chrome Cache Entry: 533
PNG image data, 600 x 106, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 534
ASCII text, with very long lines (9463), with no line terminators
downloaded
Chrome Cache Entry: 535
Unicode text, UTF-8 text, with very long lines (2322)
downloaded
Chrome Cache Entry: 536
ASCII text, with very long lines (351)
dropped
Chrome Cache Entry: 537
HTML document, Unicode text, UTF-8 text, with very long lines (1136)
dropped
Chrome Cache Entry: 538
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 539
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 540
ASCII text, with very long lines (2694)
dropped
Chrome Cache Entry: 541
Java source, ASCII text, with very long lines (2260)
dropped
Chrome Cache Entry: 542
ASCII text
dropped
Chrome Cache Entry: 543
Unicode text, UTF-8 text
dropped
Chrome Cache Entry: 544
ASCII text, with very long lines (508)
downloaded
Chrome Cache Entry: 545
data
dropped
Chrome Cache Entry: 546
ASCII text, with very long lines (351)
downloaded
Chrome Cache Entry: 547
JSON data
dropped
Chrome Cache Entry: 548
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 549
ASCII text, with very long lines (4163), with no line terminators
downloaded
Chrome Cache Entry: 550
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 551
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 552
ASCII text, with very long lines (1216), with no line terminators
dropped
Chrome Cache Entry: 553
ASCII text, with very long lines (1836), with no line terminators
dropped
Chrome Cache Entry: 554
ASCII text, with very long lines (2345)
downloaded
Chrome Cache Entry: 555
ASCII text, with very long lines (7227)
dropped
Chrome Cache Entry: 556
TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.001101; 2014Roboto-Regular
downloaded
Chrome Cache Entry: 557
ASCII text, with very long lines (51317)
downloaded
Chrome Cache Entry: 558
ASCII text, with very long lines (22367), with no line terminators
downloaded
Chrome Cache Entry: 559
ASCII text, with very long lines (65364)
downloaded
Chrome Cache Entry: 560
ASCII text
downloaded
Chrome Cache Entry: 561
ASCII text, with very long lines (12736)
dropped
Chrome Cache Entry: 562
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 563
Java source, ASCII text, with very long lines (815)
downloaded
Chrome Cache Entry: 564
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 565
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 566
ASCII text, with very long lines (56168)
dropped
Chrome Cache Entry: 567
ASCII text
dropped
Chrome Cache Entry: 568
ASCII text, with very long lines (65317)
dropped
Chrome Cache Entry: 569
PNG image data, 1323 x 272, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 570
ASCII text, with very long lines (52271)
downloaded
Chrome Cache Entry: 571
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 572
ASCII text, with very long lines (11218)
downloaded
Chrome Cache Entry: 573
Unicode text, UTF-8 text
downloaded
Chrome Cache Entry: 574
ASCII text
downloaded
Chrome Cache Entry: 575
ASCII text, with very long lines (701)
downloaded
Chrome Cache Entry: 576
ASCII text, with very long lines (27250)
dropped
Chrome Cache Entry: 577
PNG image data, 1323 x 272, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 578
ASCII text
dropped
Chrome Cache Entry: 579
ASCII text, with very long lines (64912)
dropped
Chrome Cache Entry: 580
ASCII text, with very long lines (50018)
downloaded
Chrome Cache Entry: 581
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 582
ASCII text
dropped
Chrome Cache Entry: 583
HTML document, ASCII text
downloaded
Chrome Cache Entry: 584
ASCII text
dropped
Chrome Cache Entry: 585
ASCII text, with very long lines (37481)
downloaded
Chrome Cache Entry: 586
PNG image data, 42 x 16, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 587
ASCII text
dropped
Chrome Cache Entry: 588
Unicode text, UTF-8 text, with very long lines (2047), with no line terminators
dropped
Chrome Cache Entry: 589
JSON data
dropped
Chrome Cache Entry: 590
Java source, ASCII text, with very long lines (357)
dropped
Chrome Cache Entry: 591
Unicode text, UTF-8 text, with very long lines (32023)
dropped
Chrome Cache Entry: 592
JSON data
downloaded
Chrome Cache Entry: 593
ASCII text, with very long lines (392)
dropped
Chrome Cache Entry: 594
ASCII text, with very long lines (46677), with no line terminators
dropped
Chrome Cache Entry: 595
Java source, ASCII text, with very long lines (4172)
downloaded
Chrome Cache Entry: 596
ASCII text, with very long lines (2343)
downloaded
Chrome Cache Entry: 597
Java source, ASCII text, with very long lines (492)
downloaded
Chrome Cache Entry: 598
Java source, ASCII text, with very long lines (1703)
downloaded
Chrome Cache Entry: 599
ASCII text, with very long lines (15127)
downloaded
Chrome Cache Entry: 600
Java source, ASCII text, with very long lines (492)
dropped
Chrome Cache Entry: 601
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 602
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 603
ASCII text, with very long lines (56168)
downloaded
Chrome Cache Entry: 604
Unicode text, UTF-8 text
dropped
Chrome Cache Entry: 605
ASCII text, with very long lines (64912)
downloaded
Chrome Cache Entry: 606
ASCII text
downloaded
Chrome Cache Entry: 607
ASCII text
downloaded
Chrome Cache Entry: 608
Java source, ASCII text, with very long lines (1324)
downloaded
Chrome Cache Entry: 609
TrueType Font data, 17 tables, 1st "GPOS", 15 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto MediumRegularVersion 2.001152; 2014Roboto-
downloaded
Chrome Cache Entry: 610
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 611
ASCII text, with very long lines (23949)
downloaded
Chrome Cache Entry: 612
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 613
ASCII text, with very long lines (7227)
downloaded
Chrome Cache Entry: 614
ASCII text
dropped
Chrome Cache Entry: 615
ASCII text
downloaded
Chrome Cache Entry: 616
ASCII text
downloaded
Chrome Cache Entry: 617
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 618
ASCII text, with very long lines (12722)
dropped
Chrome Cache Entry: 619
ASCII text, with very long lines (1434), with no line terminators
dropped
Chrome Cache Entry: 620
PNG image data, 2879 x 751, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 621
ASCII text, with very long lines (29468), with no line terminators
dropped
Chrome Cache Entry: 622
Java source, ASCII text, with very long lines (1324)
dropped
Chrome Cache Entry: 623
Java source, ASCII text, with very long lines (526)
dropped
Chrome Cache Entry: 624
Unicode text, UTF-8 text, with very long lines (17289), with no line terminators
downloaded
Chrome Cache Entry: 625
ASCII text, with very long lines (65364)
dropped
Chrome Cache Entry: 626
ASCII text
downloaded
Chrome Cache Entry: 627
Java source, ASCII text, with very long lines (807)
dropped
Chrome Cache Entry: 628
ASCII text, with very long lines (534)
dropped
Chrome Cache Entry: 629
ASCII text, with very long lines (51317)
dropped
Chrome Cache Entry: 630
ASCII text, with very long lines (534)
downloaded
Chrome Cache Entry: 631
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 632
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 633
ASCII text, with very long lines (21587), with no line terminators
dropped
Chrome Cache Entry: 634
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 635
Java source, ASCII text, with very long lines (1703)
dropped
Chrome Cache Entry: 636
ASCII text, with very long lines (27250)
downloaded
Chrome Cache Entry: 637
ASCII text, with very long lines (6707)
dropped
Chrome Cache Entry: 638
Java source, ASCII text, with very long lines (7089)
downloaded
Chrome Cache Entry: 639
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 640
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 641
ASCII text
dropped
Chrome Cache Entry: 642
ASCII text, with very long lines (22445)
downloaded
Chrome Cache Entry: 643
Java source, ASCII text, with very long lines (3147)
downloaded
Chrome Cache Entry: 644
Unicode text, UTF-8 text, with very long lines (2047), with no line terminators
downloaded
Chrome Cache Entry: 645
ASCII text, with very long lines (12722)
downloaded
Chrome Cache Entry: 646
ASCII text, with very long lines (65371)
downloaded
Chrome Cache Entry: 647
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 648
ASCII text, with very long lines (508)
dropped
Chrome Cache Entry: 649
ASCII text, with very long lines (4272)
downloaded
Chrome Cache Entry: 650
ASCII text, with very long lines (11048)
downloaded
Chrome Cache Entry: 651
ASCII text
downloaded
Chrome Cache Entry: 652
ASCII text, with very long lines (65447)
dropped
Chrome Cache Entry: 653
ASCII text, with very long lines (46677), with no line terminators
downloaded
Chrome Cache Entry: 654
Java source, ASCII text, with very long lines (7089)
dropped
There are 513 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2012,i,7186506623477383776,6042746606331604628,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://help.mypurecloud.com/articles/about-byoc-cloud/"

URLs

Name
IP
Malicious
https://help.mypurecloud.com/articles/about-byoc-cloud/
malicious
https://static.cloud.coveo.com/atomic/v2/p-a56bfec6.js
18.239.83.121
https://help.mypurecloud.com/wp-content/plugins/bootstrap-shortcodes/css/bootstrap.css?ver=6.6.1
13.32.27.54
https://stats.g.doubleclick.net/g/collect
unknown
https://developers.google.com/recaptcha/docs/faq#localhost_support
unknown
https://www.google.com/recaptcha/api.js?hl=en&ver=6.6.1
142.250.186.132
https://static.cloud.coveo.com/atomic/v2/p-a0432fef.entry.js
18.239.83.121
https://braintab.genesys.com/assets/icons/arrow-down-navy.svg
18.244.18.112
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/img/thumbs-up.svg
13.32.27.54
https://ampcid.google.com/v1/publisher:getClientId
unknown
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/js/dataTables/Responsive/js/dataTables.responsive.min.js?ver=6.0.7.233
13.32.27.54
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/img/chevron-down.svg
13.32.27.54
https://static.cloud.coveo.com/atomic/v2/p-e5e52bdb.js
18.239.83.121
https://fontawesome.com
unknown
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/js/coveo.js?ver=6.0.7.233
13.32.27.54
https://support.google.com/recaptcha/#6175971
unknown
https://static.cloud.coveo.com/atomic/v2/p-76cdb4e5.js
18.239.83.121
https://unpkg.com/static-filter@0.0.3/dist/my-custom-components/my-custom-components.esm.js
104.17.247.203
http://getbootstrap.com)
unknown
http://pellepim.bitbucket.org/jstz/
unknown
https://stats.g.doubleclick.net/j/collect
unknown
https://help.mypurecloud.com/wp-content/plugins/dearpdf-lite/assets/css/dearpdf.min.css?ver=2.0.38
13.32.27.54
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/img/suggested.svg
13.32.27.54
https://help.mypurecloud.com/wp-includes/js/dist/a11y.min.js?ver=d90eebea464f6c09bfd5
13.32.27.54
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/css/coveo.css?ver=6.6.1
13.32.27.54
https://support.google.com/recaptcha
unknown
https://help.mypurecloud.com/wp-content/plugins/gravityforms/assets/js/dist/vendor-theme.min.js?ver=54e7080aa7a02c83aa61fae430b9d869
13.32.27.54
https://unpkg.com/static-filter@0.0.3
104.17.247.203
https://static.cloud.coveo.com/atomic/v2/p-0943c4bd.js
18.239.83.121
https://www.gstatic.c..?/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__.
unknown
https://unpkg.com/static-filter@0.0.3/dist/my-custom-components/p-886325de.js
104.17.247.203
https://help.mypurecloud.com/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1
13.32.27.54
https://help.mypurecloud.com/wp-content/plugins/gravityforms/assets/js/dist/scripts-theme.min.js?ver=bab19fd84843dabc070e73326d787910
13.32.27.54
https://help.mypurecloud.com/wp-content/plugins/google-language-translator/js/scripts.js?ver=6.0.20
13.32.27.54
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
unknown
https://help.mypurecloud.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6
13.32.27.54
https://static.cloud.coveo.com/atomic/v2/p-f956d7ef.js
18.239.83.121
https://assets.genesyscsdt.com/assets/fonts/roboto/Roboto-Light.ttf
108.138.26.30
https://cdn.cookielaw.org/scripttemplates/202305.1.0/assets/otFlat.json
104.18.87.42
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/js/language_selector.js?ver=6.0.7.233
13.32.27.54
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
https://static.cloud.coveo.com/atomic/v2/p-0b727812.entry.js
18.239.83.121
http://www.audiocodes.com/media/14061/audiocodes-end-user-software-license-
unknown
https://braintab.genesys.com/assets/images/gkn-logo-light.svg
18.244.18.112
https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js?ver=6.0.7.233
104.18.10.207
https://static.cloud.coveo.com/atomic/v2/p-e1255160.js
18.239.83.121
https://static.cloud.coveo.com/searchui/v2.10119/css/CoveoFullSearch.min.css
143.204.215.33
https://help.mypurecloud.com/wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18
13.32.27.54
https://help.mypurecloud.com/favicon.ico
13.32.27.54
https://static.cloud.coveo.com/atomic/v2/p-e48090a7.js
18.239.83.121
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
104.18.87.42
https://braintab.genesys.com/?product=genesys-cloud-cx&theme=light
18.244.18.112
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/js/dataTables/Responsive/css/dataTables.responsive.css?ver=6.6.1
13.32.27.54
https://assets.genesyscsdt.com/assets/images/brain.svg
18.239.94.86
https://www.google.com/images/cleardot.gif
unknown
https://help.mypurecloud.com/articles/carrier-
unknown
https://assets.genesyscsdt.com/styles/genesys-roboto.css
108.138.26.30
https://help.mypurecloud.com/wp-content/plugins/bootstrap-shortcodes/css/shortcodes.css?ver=6.6.1
13.32.27.54
https://static.cloud.coveo.com/searchui/v2.10119/js/CoveoJsSearch.min.js
143.204.215.33
https://static.cloud.coveo.com/atomic/v2/p-3699e07e.js
18.239.83.121
https://cloud.google.com/contact
unknown
https://fontawesome.com/license/free
unknown
https://static.cloud.coveo.com/atomic/v2/p-5027b35d.js
18.239.83.121
https://www.google.com/recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6LdBBSYUAAAAAA2fL-3p7HWeTLkKZ1ZCQRwRKxjP
172.217.16.196
https://assets.genesyscsdt.com/assets/fonts/roboto/Roboto-Medium.ttf
108.138.26.30
https://static.cloud.coveo.com/atomic/v2/p-5d2c1523.js
18.239.83.121
https://static.cloud.coveo.com/atomic/v2/p-1e3b01c2.js
18.239.83.121
https://fontawesome.com/license
unknown
https://help.mypurecloud.com/wp-content/plugins/bootstrap-shortcodes/js/bootstrap.js?ver=6.6.1
13.32.27.54
https://static.cloud.coveo.com/atomic/v2/p-37511f39.js
18.239.83.121
https://www.google.com/recaptcha/api2/
unknown
https://kit-uploads.fontawesome.com
unknown
https://help.mypurecloud.com/wp-content/plugins/gravityforms/assets/js/dist/utils.min.js?ver=50c7bea9c2320e16728e44ae9fde5f26
13.32.27.54
https://cookiepedia.co.uk/giving-consent-to-cookies
unknown
https://github.com/dbushell/Pikaday
unknown
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/img/logo-main.png
13.32.27.54
https://cloud.google.com/recaptcha-enterprise/billing-information
unknown
https://static.cloud.coveo.com/atomic/v2/p-9c7dbbdf.js
18.239.83.121
https://static.cloud.coveo.com/atomic/v2/p-e9c4f463.js
18.239.83.121
https://googleads.g.doubleclick.net
unknown
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/img/scroll.png
13.32.27.54
https://unpkg.com/static-filter
104.17.247.203
https://github.com/jquery/globalize
unknown
https://kit.fontawesome.com
unknown
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/js/dataTables/js/min/jquery.dataTables-min.js?ver=6.0.7.233
13.32.27.54
https://static.cloud.coveo.com/atomic/v2/p-c86021c8.js
18.239.83.121
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
unknown
https://static.cloud.coveo.com/atomic/v2/p-8e964907.js
18.239.83.121
https://td.doubleclick.net
unknown
https://assets.genesyscsdt.com/widgets/braintab-core.min.js
18.239.94.86
https://tracker.marinsm.com/tracker/async/
unknown
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/js/search.js?ver=6.0.7.233
13.32.27.54
https://www.google.com/js/bg/b50FiC3GJqhOPkFyj4HYcajJNbVzXJ6nVw0XfMkHZ-k.js
172.217.16.196
https://google.com
unknown
https://adservice.google.com/pagead/regclk?
unknown
https://static.cloud.coveo.com/atomic/v2/p-c258ee3b.js
18.239.83.121
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/js/fedramp_toggle.js?ver=6.0.7.233
13.32.27.54
https://help.mypurecloud.com/wp-content/themes/ResourceCenter2023/js/trackers.js?ver=6.0.7.233
13.32.27.54
http://www.broofa.com
unknown
https://help.mypurecloud.com/wp-includes/js/wp-emoji-release.min.js?ver=6.6.1
13.32.27.54
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
d31c7iw3tm6wwd.cloudfront.net
13.32.27.54
static.cloud.coveo.com
18.239.83.121
csp.withgoogle.com
142.250.185.81
www3.l.google.com
142.250.184.238
assets.genesyscsdt.com
18.239.94.86
maxcdn.bootstrapcdn.com
104.18.10.207
www.google.com
216.58.212.164
d3myjs358rzo6u.cloudfront.net
18.244.18.112
unpkg.com
104.17.247.203
cdn.cookielaw.org
104.18.87.42
geolocation.onetrust.com
172.64.155.119
stats.g.doubleclick.net
64.233.167.155
kit.fontawesome.com
unknown
www.genesys.com
unknown
help.mypurecloud.com
unknown
use.fontawesome.com
unknown
braintab.genesys.com
unknown
translate.google.com
unknown
ka-p.fontawesome.com
unknown
web-fire.genesys.com
unknown
There are 10 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
18.239.83.121
static.cloud.coveo.com
United States
142.250.185.228
unknown
United States
13.32.27.54
d31c7iw3tm6wwd.cloudfront.net
United States
18.244.18.112
d3myjs358rzo6u.cloudfront.net
United States
13.32.27.14
unknown
United States
192.168.2.6
unknown
unknown
104.18.32.137
unknown
United States
143.204.215.33
unknown
United States
18.155.129.83
unknown
United States
104.18.87.42
cdn.cookielaw.org
United States
18.239.94.86
assets.genesyscsdt.com
United States
18.244.18.31
unknown
United States
172.64.155.119
geolocation.onetrust.com
United States
64.233.166.155
unknown
United States
239.255.255.250
unknown
Reserved
142.250.184.238
www3.l.google.com
United States
172.217.16.196
unknown
United States
108.138.26.30
unknown
United States
172.217.18.100
unknown
United States
64.233.167.155
stats.g.doubleclick.net
United States
104.18.10.207
maxcdn.bootstrapcdn.com
United States
216.58.212.164
www.google.com
United States
192.168.2.17
unknown
unknown
142.250.186.132
unknown
United States
142.250.185.81
csp.withgoogle.com
United States
104.17.246.203
unknown
United States
104.17.247.203
unpkg.com
United States
There are 17 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
'i:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Wizards
PageSize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\MailSettings
Template
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
AutoRecoverySaveIntervalMetadata
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word
Language
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word
EcsRequestPending
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word
SubscriptionCustomerLicenseInfo
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
ACUpdated
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
DefaultKerningLigatures
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\WEF
Word_RequireForceRefreshAtBoot
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
1w:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\FileBlock
FileTypeBlockList
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\FileBlock
OoxmlConverterBlockList
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\BootTimeSkuOverride
{30CAC893-3CA4-494C-A5E9-A99141352216}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\CachedLicenseData
winword.exe
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\DocumentRecovery\35E20
35E20
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage
VBAFiles
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ExdCache\Word8.0
MSForms
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ExdCache\Word8.0
MSComctlLib
HKEY_CURRENT_USER\SOFTWARE\Microsoft\VBA\Forms3\Controls
EnableActiveXControlArchitetureIndependent
HKEY_CURRENT_USER\SOFTWARE\Microsoft\VBA\Forms3\Controls
EnableActiveXControlMSWebBrowserArchiteturePersistenceIssue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word
WordName
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word
BuildNumber
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word
Expires
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.7
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.9
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.10
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.11
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.13
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.14
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.15
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.16
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.17
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.18
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.19
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.20
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.21
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.22
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.23
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.24
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.25
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.26
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.27
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.28
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
1.29
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
VersionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word
ETag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word
DeferredConfigs
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word
ConfigIds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Volatile
MsaDevice
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries
UpdateComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851216
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328884
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03090430
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457444
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033917
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328893
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328905
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851217
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328908
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033919
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328916
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033921
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457464
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033925
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
TM03998158
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
TM01840907
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457475
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM10001114
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851218
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851219
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851220
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851221
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328919
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851222
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
TM03998159
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328925
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851223
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851224
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033927
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457485
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457491
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851225
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457496
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM10001115
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328932
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328935
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457503
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328940
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328998
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457510
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851227
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033929
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328972
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328951
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
TM02835233
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328975
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328983
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328986
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851226
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033937
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328990
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457515
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03090434
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
NextUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
NextUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
NextUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
NextUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
LastUpdate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency
PotentialDataLossInfo2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
Extensions
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
Symbol
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
Times New Roman
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
Courier New
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
Calibri
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
MS Gothic
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
Wingdings 2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
Segoe UI
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
Cambria
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0
File Path
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0
Datetime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0
Position
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastSyncTimeWord
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastWriteTimeWord
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Data
Toolbars
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Toolbars\Settings
Microsoft Word
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
Calibri Light
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Panose
Wingdings
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Data
Settings
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
VisiForceField
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
IgnoreFilenamesEmailAliases
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
AutoSpell
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
NoContextSpell
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
InsPic
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
NavPaneAdvertised
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
SoundFeedback
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
BkgrndPag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
ATUserAdded
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
AccentOnUpper
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
AppWindowPos
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
AppWindowPosKey
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Signals\Stats\Anonymous\Microsoft.Word.Document
ClicksData
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
SessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
FilePath
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
StartDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
EndDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache
LastClean
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage
VBAFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word
Expires
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}
DeviceTicket
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328893
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851227
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328983
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851217
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328884
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328932
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328908
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328986
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851218
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
TM02835233
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851219
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851220
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328916
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328925
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328905
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851225
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851223
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328975
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851216
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328972
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851224
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328998
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
TM03998158
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328940
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
TM01840907
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328951
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851221
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851222
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328990
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328919
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\SmartArt\1033
TM03328935
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocBibs\1033
TM02851226
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457515
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03090430
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457464
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457491
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457444
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457475
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM10001115
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457496
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03090434
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457503
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033917
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM10001114
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457510
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033919
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033925
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033921
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033929
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033927
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM03457485
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\Themes\1033
TM04033937
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033
TM03998159
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Word\Text Converters\Import
Extensions
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\DocumentRecovery\35E20
35E20
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\DocumentRecovery\35E20
35E20
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingConfigurableSettings
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingConfigurableSettings
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency
PotentialDataLossInfo2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0
Datetime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Reading Locations\Document 0
Position
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3472
0
There are 300 hidden registries, click here to show them.

DOM / HTML

URL
Malicious
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
https://help.mypurecloud.com/articles/about-byoc-cloud/
There are 1 hidden doms, click here to show them.