下载 - 魔盾安全分析

Transcription

下载 - 魔盾安全分析

魔盾安全分析报告
分析类型
开始时间
结束时间
持续时间
分析引擎版本
FILE
2016-04-25 17:50:55
2016-04-25 18:02:41
706 秒
1.4-Maldun
虚拟机机器名
标签
虚拟机管理
开机时间
关机时间
winxp-sp3-1
winxp-sp3-1
KVM
2016-04-25 17:56:25
2016-04-25 18:02:41
魔盾分数
1.0
正常的
文件详细信息
文件名
预防和风险应对.docx
文件大小
30043 字节
文件类型
Microsoft Word 2007+
CRC32
2942B738
MD5
5dd117d04abf82f4f04f630215032850
SHA1
481f4d14bbb6c73c94166e85451c10db5a532190
SHA256
b4ba01b59051603e96aa53f237385b974139f327bd364f8b519e5521d28f55b7
SHA512
b5dc03896ab3b9d985ab8768f239820fd7e2130d5c0348e7b656b6c5aec7da027a173b20a7b57cf68af56
a8ad1545a03df4df6f11d1a04672e44a921adf96b13
Ssdeep
768:QIlGJehGGNLcSNdIJQux8zNypPPu6ysr1p:phGGN4MI+ux8Oe6ys5p
PEiD
无匹配
Yara
无Yara规则匹配
VirusTotal
VirusTotal链接
VirusTotal扫描时间: 2016-04-21 09:26:51
扫描结果: 0/57
特征
创建一个隐藏文件或系统文件
file:
file:
file:
file:
file:
C:\Documents and Settings\test\Local Settings\Temp\~$______.docx
C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.Word
C:\Documents and Settings\test\Application Data\Microsoft\Templates\~$Normal.dotm
C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.MSO
C:\Documents and Settings\test\Application Data\Microsoft\Office\Recent\index.dat
运行截图
网络分析
无信息
静态分析
投放文件
CUSTOM.DIC
文件名
相关文件
CUSTOM.DIC
C:\Documents and Settings\test\Application Data\Microsoft\UProof\CUSTOM.DIC
文件大小
2 bytes
文件类型
Little-endian UTF-16 Unicode text, with no line terminators
MD5
f3b25701fe362ec84616a93a45ce9998
SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd219
0f0efaf715309061490f9755a9bfdf1c54ca0d84
Ssdeep
3:Qn:Qn
Yara
无匹配
VirusTotal
搜索相关分析
index.dat
文件名
相关文件
index.dat
文件大小
28 bytes
文件类型
ASCII text, with CRLF line terminators
MD5
4e30a3397e81dd38a188e78fc94e5a77
SHA1
95e2efa493065e02c7370befbe5a4bc1340cf5ef
SHA256
ddd0b5a9b8bd9275ddd6bd1d9d033c56734a5bb184b4371e50c2200b903397cb
SHA512
6d9ba51003c7c056e2628f8c435029c8a62e4a7e9a40b59c952af160b91449aa4b9e5e4084a275e1825c
6be0cd1c8ee22709beb1c13839be8b29c63b2509df53
Ssdeep
3:bDuMJlv:bCy
Yara
无匹配
VirusTotal
搜索相关分析
~$______.docx
文件名
相关文件
~$______.docx
文件大小
162 bytes
文件类型
data
MD5
2ba6dc1b954f3fceae0b89d8445ad91f
SHA1
c2175ff897dbdf61452f4424dcf90efd3094e6f4
SHA256
608f1bdb5302cbb70fdcad380b610496a82146ce784ddb8581181d77542deb02
SHA512
d70edde18089b1f06fd96688482f4436a677a1ba0e1e0ff1d4af8b574c399b3b9eaf632248813366c1aa47
874e5a19e670c8842a89c34b6e26ce47f928ec23ba
Ssdeep
3:F1GqbScl3BTA8lll3/RMU:aWlxM8lllvKU
Yara
无匹配
VirusTotal
搜索相关分析
~WRS{18FC246A-B79B-4B13-B0DA-C6B465C9B611}.tmp
文件名
相关文件
~WRS{18FC246A-B79B-4B13-B0DA-C6B465C9B611}.tmp
C:\Documents and Settings\test\Local Settings\Temporary Internet
Files\Content.Word\~WRS{18FC246A-B79B-4B13-B0DA-C6B465C9B611}.tmp
文件大小
35902 bytes
文件类型
data
MD5
2331aae837b1bd866a4f69ecd52d02aa
SHA1
bb27dc79c6fd9c708e29954ac00d524672e335c5
SHA256
5ce86173be1eefd8050356978525e02587ca53a6f1b117ce73e734c958aa2f22
SHA512
2662c83738fcc16623f1d556112eef8c5e55119261dae0f368c968a3ed3abd2cffaf86468289262568472a
a568bc17be00b0a3439dee3eee9910c6986dfbcd15
Ssdeep
384:nl09PFYWRAQ6BBTs6cXKSDZDZ4vANjLZMiLr4WBRQH24/4UgGq:UyI6Bi6cTGAt3ndGgz
Yara
无匹配
VirusTotal
搜索相关分析
Word12.pip
文件名
相关文件
Word12.pip
C:\Documents and Settings\test\Application Data\Microsoft\Office\Word12.pip
文件大小
144 bytes
文件类型
data
MD5
d74f334dbc6089c5660997de4dded032
SHA1
0a4261b2af281fec021391d0e296f9d6e69afd6e
SHA256
35f9f8ce46722127145a1dfa1f5ff113f16ed6d3d402e4000f17f5ce63be9cc9
SHA512
7b98a50659d7ba6a6932274d1cf5f31b161d58aa25628eba64b47cea2ffa843a3e9bf943e027d637845ac
a5ad371e0b89328c6d2cbdb112e8de1e841a8627bb1
Ssdeep
3:0/l3lldHllXl/0slllhllrllrllrll:8F
Yara
无匹配
VirusTotal
搜索相关分析
MSO1033.acl
文件名
MSO1033.acl
相关文件
C:\Documents and Settings\test\Application Data\Microsoft\Office\MSO1033.acl
文件大小
30 bytes
文件类型
data
MD5
fbad93d1c017213f94c90c3d29061e54
SHA1
d649e05ee4115bac13bdebde05eaf6b633854799
SHA256
6edae3ddd552a859c3fc3b94cbecf39a9647495d6d288bca1e1b880283cde23d
SHA512
f15f6b61f63bb1041934bfba284d28eb79d69bb3ba2928a85ad7bf78f882ca1256372edca8c30fda9c2021
3c7e1b5ad2f429dee927849588895148612e68dd55
Ssdeep
3:mtglX:mtgl
Yara
无匹配
VirusTotal
搜索相关分析
Templates.LNK
文件名
Templates.LNK
相关文件
C:\Documents and Settings\test\Application Data\Microsoft\Office\Recent\Templates.LNK
文件大小
763 bytes
文件类型
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory,
ctime=Sun Jun 28 22:16:50 2015, mtime=Sun Mar 6 01:51:28 2016, atime=Sun Mar 6 01:51:28 2016,
length=0, window=hide
MD5
ffb3299b75d7be2a9e3d6bb62f071c0a
SHA1
ac4af4953d5e2b1c75cfa035bda0550a86611b27
SHA256
80f031ebe5340b461571c8ecab8bd906d9e8854f214685d4ab8cee4f75949f3c
SHA512
dbf9ab9121da46253d0f9bac8846731368ff7675abf5f1ce4afefbb9b797fedf03bde4da6580b6ef4683892
7a9fc3a391d3c673d2569966e21747a24c3039aec
Ssdeep
12:8rD0H9IXomT/r+Xmgrf33xGtUpXQ3kxKPIBp+mXr1Agqnx9LilojAGjbUeT1lil7:8n0vXvfHoapEk48+qr6r
BAkfT7czHpHX
Yara
无匹配
VirusTotal
搜索相关分析
~$Normal.dotm
文件名
相关文件
~$Normal.dotm
文件大小
162 bytes
文件类型
data
MD5
be6fe1c974030f67f1f3da2b3886bb43
SHA1
56d3bee127fc4bbca4876856c6f58e56e4465a5e
SHA256
4572d7e569e0f5fb9ad044fcd94b31adb361eca8cd105241e6f7cd8e41d40d57
SHA512
8fd7a6f50a19566821da06b8f72d075606aec0b21dcbddc448ff6b119e6a502c31bf74a64fa08b1b4f9b59
10ee562e2d89aade4a197756073162cc003cc71cb2
Ssdeep
3:TDllrR/NAligl3RAQBQSzRP//HblC7lRvX:nllrZSlichzVm5
Yara
无匹配
VirusTotal
搜索相关分析
_______.docx
文件名
相关文件
_______.docx
C:\Documents and Settings\test\Local Settings\Temp\_______.docx
文件大小
30043 bytes
文件类型
MD5
5dd117d04abf82f4f04f630215032850
SHA1
481f4d14bbb6c73c94166e85451c10db5a532190
SHA256
b4ba01b59051603e96aa53f237385b974139f327bd364f8b519e5521d28f55b7
SHA512
b5dc03896ab3b9d985ab8768f239820fd7e2130d5c0348e7b656b6c5aec7da027a173b20a7b57cf68af56
a8ad1545a03df4df6f11d1a04672e44a921adf96b13
Ssdeep
768:QIlGJehGGNLcSNdIJQux8zNypPPu6ysr1p:phGGN4MI+ux8Oe6ys5p
Yara
无匹配
VirusTotal
搜索相关分析
Normal.dotm
文件名
相关文件
Normal.dotm
C:\Documents and Settings\test\Application Data\Microsoft\Templates\Normal.dotm
文件大小
16025 bytes
文件类型
MD5
98e761ad3cf20f85010fdd0cac8d0759
SHA1
1ff376e7880a6273b5d7387cbade8eaace209b40
SHA256
c8f10533951f146b868ab921d0b4676f8f42405e683e8b5308aae40566e4a38e
SHA512
bd31129a0ade0cde197507fa75be980ecad432911b961ecbcae38ae495b9b3d816e9f736d7623e0dcbe8
fa189a11960e17883d637594c535ce7470e424ecddf0
Ssdeep
384:A9FHwAjY4Hv+RgKAojODGXW4LTUnosJQw2vYYEhy:A/pU4LojbLTUnnQw1y
Yara
无匹配
VirusTotal
搜索相关分析
行为分析
互斥量(Mutexes)
Global\MTX_MSO_Formal1_S-1-5-21-682003330-1214440339-725345543-1003
Global\MTX_MSO_AdHoc1_S-1-5-21-682003330-1214440339-725345543-1003
MutexMSPYXpFsltZx
GlobalMutexMSPYtestPerUserHlDhzQlWhJl
GlobalMutexMSPYXpFsltZx
CTF.TimListCache.FMPDefaultS-1-5-21-682003330-1214440339-725345543-1003MUTEX.DefaultS-1-5-21-6820033301214440339-725345543-1003
Global\MsoShellExtRegAccess_S-1-5-21-682003330-1214440339-725345543-1003
执行的命令无信息
创建的服务无信息
启动的服务无信息
进程
WINWORD.EXE
PID: 2128, 上一级进程 PID: 3712
访问的文件
C:\Documents and Settings\test\Local Settings\Temp\Normal.dotm
C:\Documents and Settings\test\Local Settings\Temp\
C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.Word
C:\Documents and Settings\test\Local Settings\Temporary Internet Files\
C:\Documents and Settings\test\Local Settings\Temp\:\Documents and Settings\test\Local Settings\Temporary Internet
Files\Content.Word
C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.Word\~WRS{18FC246A-B79B-4B13B0DA-C6B465C9B611}.tmp
C:\Documents and Settings\test\Application Data\Microsoft\Templates\
C:\Documents and Settings\test\Application Data\Microsoft\Templates
C:\Documents and Settings\test\Application Data\
C:\Documents and Settings\test\Application Data\Microsoft\Office\
C:\Documents and Settings\test\Application Data\Microsoft\Office\review.rcd
C:\Documents and Settings\test\Application Data\Microsoft\Office\adhoc.rcd
C:\Documents and Settings\test\Local Settings\Temp
C:\Documents and Settings
C:\Documents and Settings\test
C:\Documents and Settings\test\Local Settings
C:\Documents and Settings\test\Local Settings\Application Data\Microsoft\Schemas\MS Word_restart.xml
C:\Documents and Settings\test\Application Data\Microsoft\Word\STARTUP\
C:\Documents and Settings\test\Application Data\Microsoft\Word
C:\Documents and Settings\test\Application Data\Microsoft
C:\Documents and Settings\test\Application Data\Microsoft\Word\STARTUP
C:\Documents and Settings\test\Application Data\Microsoft\Word\STARTUP\*.*
C:\Program Files\Microsoft Office\OFFICE12\STARTUP\*.*
C:\WINDOWS\ime\imkr6_1\imekrcic.dll
C:\WINDOWS\ime\SPTIP.dll
C:\Program Files\Microsoft Office\OFFICE12\PINTLGNT.IME
C:\WINDOWS\system32\PINTLGNT.IME
C:\WINDOWS\system32\input.dll
C:\WINDOWS\AppPatch\sysmain.sdb
C:\WINDOWS\AppPatch\systest.sdb
\Device\NamedPipe\ShimViewer
C:\WINDOWS\system32\
C:\WINDOWS
C:\WINDOWS\system32
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGC.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGD.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGDX.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGDM.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGI.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGIX.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGS.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGR.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGL.IMD
C:\Program Files\Microsoft Office\OFFICE12\MSOSTYLE.DLL
C:\Program Files\Microsoft Office\OFFICE12\FM20.DLL
C:\WINDOWS\system32\MSOSTYLE.DLL
C:\WINDOWS\system\MSOSTYLE.DLL
C:\WINDOWS\MSOSTYLE.DLL
C:\Documents and Settings\test\Local Settings\Temp\MSOSTYLE.DLL
C:\WINDOWS\system32\wbem\MSOSTYLE.DLL
C:\Documents and Settings\test\Application Data\Microsoft\Document Building Blocks\
C:\Documents and Settings\test\Application Data\Microsoft\Document Building Blocks
C:\Documents and Settings\test\Application Data\Microsoft\Document Building Blocks\*.*
C:\Documents and Settings\test\Application Data\Microsoft\Document Building Blocks\2052\*.*
C:\Program Files\Microsoft Office\OFFICE12\
C:\Program Files\Microsoft Office\OFFICE12\mssp3??.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\
C:\Documents and Settings\test\Application Data\Microsoft\Proof
C:\Documents and Settings\test\Application Data\Microsoft\Proof\mssp3??.dll
C:\Program Files\Common Files\Microsoft Shared\
C:\Program Files\Common Files\Microsoft Shared
C:\Program Files\Common Files\Microsoft Shared\mssp3??.dll
C:\Program Files\Microsoft Office\OFFICE12\mssp??32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\mssp??32.dll
C:\Program Files\Common Files\Microsoft Shared\mssp??32.dll
C:\Program Files\Microsoft Office\OFFICE12\msp??32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\msp??32.dll
C:\Program Files\Common Files\Microsoft Shared\msp??32.dll
C:\Program Files\Microsoft Office\OFFICE12\mssp232.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\mssp232.dll
C:\Program Files\Common Files\Microsoft Shared\mssp232.dll
C:\Program Files\Microsoft Office\OFFICE12\mssp32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\mssp32.dll
C:\Program Files\Common Files\Microsoft Shared\mssp32.dll
C:\Program Files\Microsoft Office\OFFICE12\msgr2??.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\msgr2??.dll
C:\Program Files\Common Files\Microsoft Shared\msgr2??.dll
C:\Program Files\Microsoft Office\OFFICE12\msgr??32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\msgr??32.dll
C:\Program Files\Common Files\Microsoft Shared\msgr??32.dll
C:\Program Files\Microsoft Office\OFFICE12\gram??32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\gram??32.dll
C:\Program Files\Common Files\Microsoft Shared\gram??32.dll
C:\Program Files\Microsoft Office\OFFICE12\msth3??.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\msth3??.dll
C:\Program Files\Common Files\Microsoft Shared\msth3??.dll
C:\Program Files\Microsoft Office\OFFICE12\msth32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\msth32.dll
C:\Program Files\Common Files\Microsoft Shared\msth32.dll
C:\Program Files\Microsoft Office\OFFICE12\msth??32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\msth??32.dll
C:\Program Files\Common Files\Microsoft Shared\msth??32.dll
C:\Program Files\Microsoft Office\OFFICE12\msth232.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\msth232.dll
C:\Program Files\Common Files\Microsoft Shared\msth232.dll
C:\Program Files\Microsoft Office\OFFICE12\mshy3??.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\mshy3??.dll
C:\Program Files\Common Files\Microsoft Shared\mshy3??.dll
C:\Program Files\Microsoft Office\OFFICE12\hyph??32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\hyph??32.dll
C:\Program Files\Common Files\Microsoft Shared\hyph??32.dll
C:\Program Files\Microsoft Office\OFFICE12\mshy32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\mshy32.dll
C:\Program Files\Common Files\Microsoft Shared\mshy32.dll
C:\Program Files\Microsoft Office\OFFICE12\hyph32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\hyph32.dll
C:\Program Files\Common Files\Microsoft Shared\hyph32.dll
C:\Program Files\Microsoft Office\OFFICE12\hhc32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\hhc32.dll
C:\Program Files\Common Files\Microsoft Shared\hhc32.dll
C:\Program Files\Microsoft Office\OFFICE12\msdcsc32.dll
C:\Documents and Settings\test\Application Data\Microsoft\Proof\msdcsc32.dll
C:\Program Files\Common Files\Microsoft Shared\msdcsc32.dll
C:\Program Files\Microsoft Office\OFFICE12\msproof6.dll
C:\Program Files\Microsoft Office\OFFICE12\msproof6.dll.2.Manifest
C:\Program Files\Microsoft Office\OFFICE12\msproof6.dll.2.Config
C:\Program Files\Microsoft Office\OFFICE12\WINWORD.EXE.Local\
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
C:\Documents and Settings\test\Application Data\Microsoft\UProof\
C:\Documents and Settings\test\Application Data\Microsoft\UProof
C:\Documents and Settings\test\Local Settings\Application Data\Microsoft\Office\
C:\Documents and Settings\test\Local Settings\Application Data\Microsoft\Office\Word.qat
C:\Documents and Settings\test\Local Settings\Temp\_______.docx:Zone.Identifier
C:\Program Files\Microsoft Office\OFFICE12\ID_00030.DPC
C:\Program Files\Microsoft Office\OFFICE12\OGL.DLL
C:\Program Files\Microsoft Office\OFFICE12\OGL.DLL.2.Manifest
C:\Program Files\Microsoft Office\OFFICE12\OGL.DLL.2.Config
C:\Program Files\Microsoft Office\OFFICE12\RICHED20.DLL
C:\Program Files\Common Files\Microsoft Shared\TextConv\html32.cnv
C:\Program Files\Common Files\Microsoft Shared\TextConv\write32.wpc
C:\Program Files\Common Files\Microsoft Shared\TextConv\mswrd632.wpc
C:\Program Files\Common Files\Microsoft Shared\TextConv\mswrd832.cnv
C:\Documents and Settings\test\Application Data
C:\Documents and Settings\test\Application Data\desktop.ini
C:\Documents and Settings\test\Application Data\Microsoft\desktop.ini
C:\Documents and Settings\test\Application Data\Microsoft\Templates\Normal.dotm\*.*
C:\Documents and Settings\test\Application Data\Microsoft\Office\Recent\
C:\Documents and Settings\test\Application Data\Microsoft\Office
C:\Documents and Settings\test\Application Data\Microsoft\Office\Recent
C:\Documents and Settings\test\Application Data\Microsoft\Office\Recent\Templates
C:\Documents and Settings\test\Application Data\Microsoft\Office\Recent\Templates\*.*
\??\PIPE\srvsvc
C:\DosDevices\pipe\
C:\Documents and Settings\test\Application Data\Microsoft\Templates\~WRD0000.tmp
C:\Documents and Settings\test\Application Data\Microsoft\Templates\*.*
C:\
C:\Documents and Settings\test\Application Data\Microsoft\
C:\Documents and Settings\test\Start Menu
C:\Documents and Settings\test\Start Menu\desktop.ini
C:\Documents and Settings\All Users\Start Menu
C:\Documents and Settings\All Users
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\All Users\Application Data
C:\Documents and Settings\All Users\Application Data\desktop.ini
C:\Documents and Settings\test\My Documents\My Pictures
C:\Documents and Settings\test\My Documents
C:\Documents and Settings\test\My Documents\desktop.ini
C:\Documents and Settings\test\My Documents\My Pictures\Desktop.ini
C:\Program Files
C:\Program Files\desktop.ini
C:\Documents and Settings\All Users\Documents\My Pictures
C:\Documents and Settings\All Users\Documents
C:\Documents and Settings\All Users\Documents\desktop.ini
C:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini
C:\Documents and Settings\All Users\Documents\My Music
C:\Documents and Settings\All Users\Documents\My Music\Desktop.ini
C:\Documents and Settings\All Users\Documents\My Videos
C:\Documents and Settings\All Users\Documents\My Videos\Desktop.ini
C:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.MSO\WordWebPagePreview
C:\Program Files\Microsoft Office\OFFICE12\MSACCESS.EXE
C:\Program Files\Microsoft Office\OFFICE12\EXCEL.EXE
C:\Program Files\Microsoft Office\OFFICE12\POWERPNT.EXE
C:\Program Files\Microsoft Office\OFFICE12\WINWORD.EXE
C:\Program Files\Microsoft Office\OFFICE12\EXP_PDF.DLL
C:\Program Files\Microsoft Office\OFFICE12\EXP_XPS.DLL
C:\Documents and Settings\test\Local Settings\Application Data\Microsoft\Office\12.0\
读取的文件
C:\Documents and Settings\test\Application Data\Microsoft\Office\review.rcd
C:\Documents and Settings\test\Application Data\Microsoft\Office\adhoc.rcd
C:\WINDOWS\ime\imkr6_1\imekrcic.dll
C:\WINDOWS\ime\SPTIP.dll
C:\WINDOWS\system32\PINTLGNT.IME
C:\WINDOWS\system32\input.dll
C:\WINDOWS\AppPatch\sysmain.sdb
C:\WINDOWS\AppPatch\systest.sdb
C:\WINDOWS\system32\
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGC.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGD.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGDX.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGDM.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGI.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGIX.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGS.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGR.IMD
C:\WINDOWS\system32\IME\PINTLGNT\PINTLGL.IMD
C:\Program Files\Microsoft Office\OFFICE12\msproof6.dll.2.Manifest
C:\Program Files\Microsoft Office\OFFICE12\msproof6.dll.2.Config
C:\Program Files\Microsoft Office\OFFICE12\ID_00030.DPC
C:\Program Files\Microsoft Office\OFFICE12\OGL.DLL.2.Manifest
C:\Program Files\Microsoft Office\OFFICE12\OGL.DLL.2.Config
C:\Documents and Settings\test\Application Data\desktop.ini
\??\PIPE\srvsvc
C:\
C:\Documents and Settings\test\Start Menu\desktop.ini
C:\Documents and Settings\All Users\Start Menu\desktop.ini
C:\Documents and Settings\All Users\Application Data\desktop.ini
C:\Documents and Settings\test\My Documents\desktop.ini
C:\Documents and Settings\test\My Documents\My Pictures\Desktop.ini
C:\Documents and Settings\All Users\Documents\desktop.ini
C:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini
C:\Documents and Settings\All Users\Documents\My Music\Desktop.ini
C:\Documents and Settings\All Users\Documents\My Videos\Desktop.ini
修改的文件
\Device\NamedPipe\ShimViewer
\??\PIPE\srvsvc
删除的文件
C:\Documents and Settings\test\Local Settings\Temp\:\Documents and Settings\test\Local Settings\Temporary Internet
Files\Content.Word
C:\Documents and Settings\test\Local Settings\Application Data\Microsoft\Schemas\MS Word_restart.xml
注册表键
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Offline
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Offline\Files
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\DefaultCPG
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Security\FileOpenBlock
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\NoTrack
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\12.0\Common\Security
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\12.0\Common\OpenXMLFormat
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\XMLOpenFilter
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Publisher\Internet
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\PowerPoint\Internet
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version
HKEY_LOCAL_MACHINE\Software\Netscape\Netscape Navigator
HKEY_LOCAL_MACHINE\Software\Netscape\Netscape Navigator Gold
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Internet
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Internet
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\a
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\GlobalDotName
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ReviewCycle
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ReviewCycle\ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\DoNotDismissFileNewTaskPane
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Toolbars\Word
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\RibbonMinAppWidth
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\RibbonMinAppHeight
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Toolbars\Settings
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\RespectSystemFontSmooth
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU\Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU\Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{051b37c21c1c-11e5-a1ca-806d6172696f}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{051b37c21c1c-11e5-a1ca-806d6172696f}\Generation
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e409d6c4515e9}\DriveMask
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx
HKEY_CLASSES_ROOT\.docx
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.docx\(Default)
HKEY_CLASSES_ROOT\Word.Document.12
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Workflow\Cache
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Workflow\WorkgroupCache
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\ShellEx\IconHandler
HKEY_CLASSES_ROOT\SystemFileAssociations\.docx
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.docx\PerceivedType
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\CLSID\(Default)
HKEY_CLASSES_ROOT\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\Implemented Categories\{00021490-00000000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\EditFlags
HKEY_CLASSES_ROOT\*
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\EditFlags
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\DWS
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Security\Trusted Locations
HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Common\Security\Trusted Locations
HKEY_CURRENT_USER\Environment
HKEY_CURRENT_USER\Environment\TEMP
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\DocumentRecovery
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\DocumentRecovery\14C4CCA
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\DocumentRecovery\14C4CCA\14C4CCA
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Restore Workspace
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\6>u
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\TrustCenter
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\DisableDocumentAssemblies
HKEY_CURRENT_USER\Software\Microsoft\Office\Common
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\AssertTimerVerboseLog
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\LBBreakpoint
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\STARTUP-PATH
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\Startup
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\7ct
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-95900000E843503E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDDE988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC20F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\TIP\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E13-10CFCA2519FE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{E9BA4710-1D6A-11D3-9983-00C04F7AD1A3}
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{E9BA4710-1D6A-11D3-9983-00C04F7AD1A3}
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{E9BA4710-1D6A-11D3-9983-00C04F7AD1A3}\LanguageProfile
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{E9BA4710-1D6A-11D3-998300C04F7AD1A3}\LanguageProfile\0x00000411
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{E9BA4710-1D6A-11D3-998300C04F7AD1A3}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{E9BA4710-1D6A-11D3-998300C04F7AD1A3}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA-0080C882687E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\LanguageProfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C77E8F3D1AA80}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-95900000E843503E}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDDE988C088EC82}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC20F816C09F4EE}\Category\Category\{246ECB87-C2F2-4ABE-905B-C8B38ADD2C43}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C77E8F3D1AA80}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-95900000E843503E}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDDE988C088EC82}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC20F816C09F4EE}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-867B3EBF38D2}\LanguageProfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C77E8F3D1AA80}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-95900000E843503E}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDDE988C088EC82}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-
0F816C09F4EE}\Category\Category\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C77E8F3D1AA80}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-95900000E843503E}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDDE988C088EC82}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC20F816C09F4EE}\Category\Category\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C77E8F3D1AA80}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-95900000E843503E}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDDE988C088EC82}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC20F816C09F4EE}\Category\Category\{B5A73CD1-8355-426B-A161-259808F26B14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C77E8F3D1AA80}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-95900000E843503E}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDDE988C088EC82}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC20F816C09F4EE}\Category\Category\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{E47ABB1E-46AC-45F3-8A89-34F9D706DA83}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{E47ABB1E-46AC-45F3-8A89-34F9D706DA83}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{E47ABB1E-46AC-45F3-8A89-34F9D706DA83}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-
867B3EBF38D2}\LanguageProfile\0x00000412\{E47ABB1E-46AC-45F3-8A89-34F9D706DA83}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{E47ABB1E-46AC-45F3-8A89-34F9D706DA83}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A-867B3EBF38D2}\LanguageProfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}\Display Description
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\ime\imkr6_1\imekrcic.dll,-22
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\LanguageProfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-9590-0000E843503E}\LanguageProfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E13-10CFCA2519FE}\LanguageProfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\LanguageProfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\Display Description
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\ime\sptip.dll,-600
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA-0080C882687E}\LanguageProfile\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}\Display Description
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@PINTLGNT.IME,-61697
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA-
0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\LanguageProfile\
HKEY_CURRENT_USER\Keyboard Layout\Preload
HKEY_CURRENT_USER\Keyboard Layout\Substitutes
HKEY_CURRENT_USER\Keyboard Layout\Preload\1
HKEY_CURRENT_USER\Keyboard Layout\Substitutes\00000409
HKEY_CURRENT_USER\Keyboard Layout\Substitutes\e00e0804
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\e00e0804
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E00E0804\Layout Display Name
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%SystemRoot%\system32\input.dll,-5091
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\Assemblies\0x00000404
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\Enable
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x00000404\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x00000404\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\Enable
HKEY_CURRENT_USER\Software\Microsoft\CTF\Assemblies\0x00000412\{34745C63-B2F0-4784-8B67-5E12C8701A31}
HKEY_CURRENT_USER\Software\Microsoft\CTF\Assemblies\0x00000412\{34745C63-B2F0-4784-8B675E12C8701A31}\Default
HKEY_CURRENT_USER\Software\Microsoft\CTF\Assemblies\0x00000412\{34745C63-B2F0-4784-8B675E12C8701A31}\Profile
HKEY_CURRENT_USER\Software\Microsoft\CTF\Assemblies\0x00000412\{34745C63-B2F0-4784-8B675E12C8701A31}\KeyboardLayout
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}\Enable
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\Enable
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\Enable
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-
00C04FC324A1}\LanguageProfile\0x00000804\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\Enable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility\DisableAppCompat
HKEY_LOCAL_MACHINE\System\WPA\TabletPC
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter\Installed
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\PINTLGNT.IME
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\Sid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-682003330-1214440339725345543-1003
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-682003330-1214440339725345543-1003\Sid
HKEY_USERS\S-1-5-21-682003330-1214440339-725345543-1003\Software\Microsoft\Windows\CurrentVersion
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSSCIPY
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSSCIPY\Default Comp UI style
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PINTLGNT
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PINTLGNT\Default Comp UI style
HKEY_LOCAL_MACHINE\SYSTEM\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\OobeInProgress
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSSCIPY\Eudc Dictionary
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PINTLGNT\Eudc Dictionary
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSSCIPY\User Define Phrase File
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PINTLGNT\User Define Phrase File
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSSCIPY\Learning File
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PINTLGNT\Learning File
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\LangBar\
HKEY_CURRENT_USER\Software\Microsoft\CTF\LangBar\ShowStatus
HKEY_CURRENT_USER\Software\Microsoft\CTF\LangBar\Transparency
HKEY_CURRENT_USER\Software\Microsoft\CTF\LangBar\Label
HKEY_CURRENT_USER\Software\Microsoft\CTF\LangBar\ExtraIconsOnMinimized
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Products\00002109030000000000000000F01FEC
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Products\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\5120EEDE039486F42830D8D2552797F6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\5120EEDE039486F42830D8D2552797F6\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Features\00002109030000000000000000F01FEC
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Features\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\ProductFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Products\00002109030000000000000000F01FEC\Features
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Products\00002109030000000000000000F01FEC\Features\ProductFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\379E92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\379E92CC2CB71D119A12000A9CE1A22A\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\748B2526ADAB4D3429253E7976AF041A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\748B2526ADAB4D3429253E7976AF041A\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\CCABF232126726445BC57F4CDE05C5EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\CCABF232126726445BC57F4CDE05C5EB\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\47155108894E68A409FDC1FC6E8DA2CB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\47155108894E68A409FDC1FC6E8DA2CB\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9B271454ED4348B47B365F93ADEAC015
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9B271454ED4348B47B365F93ADEAC015\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9D6BD49C8A516ED41BB0C0D31B0F52BC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9D6BD49C8A516ED41BB0C0D31B0F52BC\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\4006F64980E4BACB0EF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\4006F64980E4BACB0EF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\1FA18F7974E099CD0AF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\1FA18F7974E099CD0AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\1FA18F7974E099CD0CF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\1FA18F7974E099CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\1FA18F7974E099CD0BF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\1FA18F7974E099CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\4006F64980E4BACB0DF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\4006F64980E4BACB0DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\DA42BC89BF25F5BD0AF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\DA42BC89BF25F5BD0AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\DA42BC89BF25F5BD0CF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\DA42BC89BF25F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\DA42BC89BF25F5BD0BF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\DA42BC89BF25F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\82DE7549CF3F8CCB0DF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\82DE7549CF3F8CCB0DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2A31EAB9FA7E3C6D0AF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2A31EAB9FA7E3C6D0AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2A31EAB9FA7E3C6D0CF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2A31EAB9FA7E3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2A31EAB9FA7E3C6D0BF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2A31EAB9FA7E3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\B92D5049E11C93DB0DF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\B92D5049E11C93DB0DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6EC3DF47D8A2C9E00AF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6EC3DF47D8A2C9E00AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6EC3DF47D8A2C9E00CF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6EC3DF47D8A2C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6EC3DF47D8A2C9E00BF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6EC3DF47D8A2C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\77AE531D63D456630DF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\77AE531D63D456630DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\D94C8360B8BB1DC41B1950E0F8237563
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\D94C8360B8BB1DC41B1950E0F8237563\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2562336682C91B850AF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2562336682C91B850AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2562336682C91B850CF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2562336682C91B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6F949E36CB3004C50AF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6F949E36CB3004C50AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6F949E36CB3004C50CF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6F949E36CB3004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9D6C7B862FD11C450AF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9D6C7B862FD11C450AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9D6C7B862FD11C450CF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9D6C7B862FD11C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\F3D0372D14C348850AF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\F3D0372D14C348850AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\F3D0372D14C348850CF18C3B9B1A1EE8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\F3D0372D14C348850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\11B564CAA807C694ABE73044DC90516B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\11B564CAA807C694ABE73044DC90516B\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\E3F997A2790938844ACDF81020B32415
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\E3F997A2790938844ACDF81020B32415\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9C1D6229422D71045BFB2F8BCE017AA4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9C1D6229422D71045BFB2F8BCE017AA4\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6C9A6F846E2818A47A408CAF13381C71
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6C9A6F846E2818A47A408CAF13381C71\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\C733A8B34D26AF4458B43E09EFC2C77F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\C733A8B34D26AF4458B43E09EFC2C77F\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2227A34C816D4F94EB598446F9BD8B17
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2227A34C816D4F94EB598446F9BD8B17\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\7AA6F3DBF3CE139469FE63D56E7AF446
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\7AA6F3DBF3CE139469FE63D56E7AF446\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\F7CD01816C53D32438CF043106011676
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\F7CD01816C53D32438CF043106011676\00002109030000000000000000F01FEC
HKEY_CLASSES_ROOT\.pip
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-6820033301214440339-725345543-1003\Components\5120EEDE039486F42830D8D2552797F6
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\UserInfo\UserName
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\UserInfo\UserInitials
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\UserInfo\Company
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Document Parts
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\117F07725AB58D043B52E957346D4E0C
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Products\00002109030000000000000000F01FEC\InstallProperties
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Products\00002109030000000000000000F01FEC\InstallProperties\WindowsInstaller
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\WORDNonBootFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-6820033301214440339-725345543-1003\Components\117F07725AB58D043B52E957346D4E0C
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\SharedDocumentParts
HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Outlook\Options\Mail
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office Test\Special
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\IgnorePTSLayoutReg
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ShowShipScribble
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Cursors
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Proof Type
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Override
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\A01FEFDE8C822B9408582AC21997CABB
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Components\A01FEFDE8C822B9408582AC21997CABB
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\A01FEFDE8C822B9408582AC21997CABB
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Grammar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Language Auto Detect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing
Tools\\xe6\xa0\xbc\xe5\xbc\x8f\xe4\xb8\x80\xe8\x87\xb4\xe6\x80\xa7\xe6\xa3\x80\xe6\x9f\xa5\xe5\x99\xa8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Smart Tag
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\34BE92CC2CB71D119A12000A9CE1A22A
HKEY_USERS\S-1-5-21-682003330-1214440339-725345543-
1003\Software\Microsoft\Installer\Components\34BE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\34BE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Thesaurus
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\53BE92CC2CB71D119A12000A9CE1A22A
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Components\53BE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\53BE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Hyphenation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\HangulHanjaConv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Dictionary
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\F4BE92CC2CB71D119A12000A9CE1A22A
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Components\F4BE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\F4BE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\Word Forms
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\TOOLS-PATH
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\Proof
HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools Location
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools Location\proof
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Office
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2447246F41EC398429FCD2997760A0F5
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\OfficeMSProof6
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-6820033301214440339-725345543-1003\Components\2447246F41EC398429FCD2997760A0F5
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVCP80.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msproof6.dll
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\UProof
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries\1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries\UpdateComplete
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries\
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries\1_state
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries\1_culturetag
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\SpecialtyLexicons
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\PTWatson
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\InstallRoot
HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Registration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-00000000000FF1CE}\DigitalProductID
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Main\FeatureControl\FEATURE_VALIDATE_URLHOSTNAME
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-6820033301214440339-725345543-1003\Components\D94C8360B8BB1DC41B1950E1F8237563
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\WORDFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Products\00002109030000000000000000F01FEC\Features\WORDFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\00002109030000000000000000F01FEC\ProductName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\General
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-00000000000FF1CE}\WordName
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\12.0\Common\General
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\WordName
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Viewer
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Registration
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Registration\TEST-5E5BC23A81\{90120000-0030-0000-00000000000FF1CE}
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Registration\TEST-5E5BC23A81\{90120000-0030-0000-00000000000FF1CE}\EULADis
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-00000000000FF1CE}\EULADis
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\Authorized
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\ShownOptIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\14355655CBD54D944A7518EDDF19EA2D
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\ProductNonBootFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-6820033301214440339-725345543-1003\Components\14355655CBD54D944A7518EDDF19EA2D
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OGL.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF
HKEY_CURRENT_USER\Software\Microsoft\CTF\Disable Thread Input Manager
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Toolbars
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\REGDBVersion
HKEY_CURRENT_USER\Software\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\TreatAs
HKEY_CURRENT_USER\Software\Classes\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\InprocServerX86
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4679732AC0607}\LocalServer32\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\InprocHandler32\
(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32\
(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{00020906-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServerX86
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\InprocHandlerX86
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\AppID
HKEY_CURRENT_USER\Software\Classes\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}
HKEY_CURRENT_USER\Software\Classes\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}
HKEY_CURRENT_USER\Software\Classes\CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}
HKEY_CURRENT_USER\Software\Classes\CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}
HKEY_CURRENT_USER\Software\Classes\CLSID\{00020907-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Typelib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.4\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.4\0\win32\
(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{000209F0-0000-0000-C000-000000000046}
HKEY_CURRENT_USER\Software\Classes\CLSID\{000CDB0D-0000-0000-C000-000000000046}
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Data
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Data\Toolbars
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Toolbars\Settings\Microsoft Office Word
AWDropdownHidden
HKEY_CURRENT_USER\Software\Microsoft\Web Service Providers
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\DontAddToMRUIfURL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\58CE92CC2CB71D119A12000A9CE1A22A
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Components\58CE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\58CE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\96CE92CC2CB71D119A12000A9CE1A22A
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Components\96CE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\96CE92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Word\Text Converters\Import
HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Word\Text Converters\Export
HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Import
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\HTML
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\HTML\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\HTML\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\HTML\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\HTML\Address Book Converter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc\Address Book
Converter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc\Address Book
Converter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord8\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord8\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord8\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord8\Address Book Converter
HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Text Converters\Export
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\HTML
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\HTML\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\HTML\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\HTML\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\HTML\Address Book Converter
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Open Find\Places
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Open Find
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\RecentFiles
HKEY_CLASSES_ROOT\Network\SharingHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Network\SharingHandler\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Security\FileSaveBlock
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Bitmap
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Panose
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Panose\Calibri
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Panose\\xe5\xae\x8b\xe4\xbd\x93
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Panose\Times New Roman
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Panose\Cambria
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Panose\Wingdings
HKEY_CURRENT_USER\Software\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F0040963251E5}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InprocServerX86
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InProcServer32\
(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InprocHandlerX86
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\AppID
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ProductOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions\ProductType
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\DefaultSecurity
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\DefaultSecurity\SrvsvcDefaultShareInfo
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Start Menu
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Start Menu
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\DisableRobustifiedUNC
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\Bidi Spelling
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\HangulHanjaConv
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\AutoSpell
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\AutoGrammar
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\DefaultFormat
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\BackgroundSave
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\BackgroundPrint
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\PlainTextAutoFormat
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\InsertFloating
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Data\Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\My Pictures
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\My Pictures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonPictures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProfilesDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\AllUsersProfile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonPictures
HKEY_CLASSES_ROOT\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\InProcServer32\
(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSharedDocuments
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonMusic
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonMusic
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\12.0\Word\Security
HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Word\Security
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ShipAsserts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonVideo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonVideo
HKEY_CURRENT_USER\Software\Microsoft\Shared\WPP
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Open Find\Places\StandardPlaces\Recent\CacheSize
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\DrawAlerts\FTP Sites
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation\CurrentProvider
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\QMEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\66FC3C3413AAD6740B92D672E4648FC6
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\D94C8360B8BB1DC41B1950ECF8237563
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\D94C8360B8BB1DC41B1950EDF8237563
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-6820033301214440339-725345543-1003\Installer\Components\12B306B24E250DD428FC7016B6FB4BD8
HKEY_USERS\S-1-5-21-682003330-1214440339-7253455431003\Software\Microsoft\Installer\Components\12B306B24E250DD428FC7016B6FB4BD8
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Components\12B306B24E250DD428FC7016B6FB4BD8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\LanguageResources\InstalledUIs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-00000000000FF1CE}\ProductID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Common\Config
HKEY_CLASSES_ROOT\.htm
HKEY_CURRENT_USER\Software\Classes\.htm\(Default)
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Control Panel\International\Geo
HKEY_CURRENT_USER\Control Panel\International\Geo\Nation
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\FirstRunTime
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\CustomizableAlertBaseURL
HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ShellHandler
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\OffDiag
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\OSession\Microsoft Office 12 Sessions
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\MTTF
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\MTTA
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\MTTT
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
读取的注册表键
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\DefaultCPG
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\NoTrack
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\XMLOpenFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\a
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\GlobalDotName
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ReviewCycle\ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\DoNotDismissFileNewTaskPane
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\RibbonMinAppWidth
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\RibbonMinAppHeight
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\RespectSystemFontSmooth
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{051b37c21c1c-11e5-a1ca-806d6172696f}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.docx\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.docx\PerceivedType
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.12\EditFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\EditFlags
HKEY_CURRENT_USER\Environment\TEMP
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Smart Tag\DisableDocumentAssemblies
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\AssertTimerVerboseLog
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\LBBreakpoint
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\STARTUP-PATH
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\Startup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-
867B3EBF38D2}\LanguageProfile\0x00000412\{E47ABB1E-46AC-45F3-8A89-34F9D706DA83}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{E47ABB1E-46AC-45F3-8A89-34F9D706DA83}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{E47ABB1E-46AC-45F3-8A89-34F9D706DA83}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{E47ABB1E-46AC-45F3-8A89-34F9D706DA83}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}\Display Description
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\DisabledOnTransitory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}\SubstituteLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}\Display Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}\DisabledOnTransitory
HKEY_CURRENT_USER\Keyboard Layout\Substitutes\e00e0804
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E00E0804\Layout Display Name
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA960E8FCDC732}\LanguageProfile\0x00000404\{B2F9C502-1742-11D4-9790-0080C882687E}\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\Enable
HKEY_CURRENT_USER\Software\Microsoft\CTF\Assemblies\0x00000412\{34745C63-B2F0-4784-8B675E12C8701A31}\Default
HKEY_CURRENT_USER\Software\Microsoft\CTF\Assemblies\0x00000412\{34745C63-B2F0-4784-8B675E12C8701A31}\Profile
HKEY_CURRENT_USER\Software\Microsoft\CTF\Assemblies\0x00000412\{34745C63-B2F0-4784-8B675E12C8701A31}\KeyboardLayout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A867B3EBF38D2}\LanguageProfile\0x00000412\{83C18F16-5DD8-4157-A34A-3C5AB2089E11}\Enable
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{75E61AD7-8D9E-4436-A0BE-2098C0DDA2C1}\Enable
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E1310CFCA2519FE}\LanguageProfile\0x00000411\{DAF93FA4-C39D-4AD8-BE61-16A1DFA3A1DA}\Enable
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA0080C882687E}\LanguageProfile\0x00000804\{F3BA9077-6C7E-11D4-97FA-0080C882687E}\Enable
HKEY_CURRENT_USER\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B100C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}\Enable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility\DisableAppCompat
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter\Installed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-682003330-1214440339725345543-1003\Sid
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSSCIPY\Default Comp UI style
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PINTLGNT\Default Comp UI style
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\OobeInProgress
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSSCIPY\Eudc Dictionary
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PINTLGNT\Eudc Dictionary
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSSCIPY\User Define Phrase File
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PINTLGNT\User Define Phrase File
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSSCIPY\Learning File
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PINTLGNT\Learning File
HKEY_CURRENT_USER\Software\Microsoft\CTF\LangBar\ShowStatus
HKEY_CURRENT_USER\Software\Microsoft\CTF\LangBar\Transparency
HKEY_CURRENT_USER\Software\Microsoft\CTF\LangBar\Label
HKEY_CURRENT_USER\Software\Microsoft\CTF\LangBar\ExtraIconsOnMinimized
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\5120EEDE039486F42830D8D2552797F6\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Products\00002109030000000000000000F01FEC\Features\ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\379E92CC2CB71D119A12000A9CE1A22A\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\748B2526ADAB4D3429253E7976AF041A\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\CCABF232126726445BC57F4CDE05C5EB\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\47155108894E68A409FDC1FC6E8DA2CB\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9B271454ED4348B47B365F93ADEAC015\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9D6BD49C8A516ED41BB0C0D31B0F52BC\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\4006F64980E4BACB0EF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\1FA18F7974E099CD0AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\1FA18F7974E099CD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\1FA18F7974E099CD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\4006F64980E4BACB0DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\DA42BC89BF25F5BD0AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\DA42BC89BF25F5BD0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\DA42BC89BF25F5BD0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\82DE7549CF3F8CCB0DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2A31EAB9FA7E3C6D0AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2A31EAB9FA7E3C6D0CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-
18\Components\2A31EAB9FA7E3C6D0BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\B92D5049E11C93DB0DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6EC3DF47D8A2C9E00AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6EC3DF47D8A2C9E00CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6EC3DF47D8A2C9E00BF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\77AE531D63D456630DF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2562336682C91B850AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2562336682C91B850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6F949E36CB3004C50AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6F949E36CB3004C50CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9D6C7B862FD11C450AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9D6C7B862FD11C450CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\F3D0372D14C348850AF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\F3D0372D14C348850CF18C3B9B1A1EE8\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\11B564CAA807C694ABE73044DC90516B\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\E3F997A2790938844ACDF81020B32415\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\9C1D6229422D71045BFB2F8BCE017AA4\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\6C9A6F846E2818A47A408CAF13381C71\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\C733A8B34D26AF4458B43E09EFC2C77F\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\2227A34C816D4F94EB598446F9BD8B17\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\7AA6F3DBF3CE139469FE63D56E7AF446\00002109030000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Components\F7CD01816C53D32438CF043106011676\00002109030000000000000000F01FEC
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\UserInfo\UserName
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\UserInfo\UserInitials
HKEY_CURRENT_USER\Software\Microsoft\Office\Common\UserInfo\Company
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Products\00002109030000000000000000F01FEC\InstallProperties\WindowsInstaller
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\WORDNonBootFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\SharedDocumentParts
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\IgnorePTSLayoutReg
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\ShowShipScribble
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\TOOLS-PATH
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\Proof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools Location\proof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\OfficeMSProof6
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\UProof
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries\1_state
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries\1_culturetag
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-00000000000FF1CE}\DigitalProductID
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\WORDFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-518\Products\00002109030000000000000000F01FEC\Features\WORDFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\00002109030000000000000000F01FEC\ProductName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-00000000000FF1CE}\WordName
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Viewer
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Registration\TEST-5E5BC23A81\{90120000-0030-0000-00000000000FF1CE}\EULADis
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-00000000000FF1CE}\EULADis
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\Authorized
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\ShownOptIn
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00002109030000000000000000F01FEC\ProductNonBootFiles
HKEY_CURRENT_USER\Software\Microsoft\CTF\Disable Thread Input Manager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\REGDBVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4679732AC0607}\LocalServer32\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\InprocHandler32\
(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32\
(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.4\0\win32\
(Default)
AWDropdownHidden
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\DontAddToMRUIfURL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\HTML\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\HTML\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\HTML\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\HTML\Address Book Converter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWinWrite.wpc\Address Book
Converter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord6.wpc\Address Book
Converter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord8\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord8\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord8\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MSWord8\Address Book Converter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\HTML\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\HTML\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\HTML\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\HTML\Address Book Converter
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\RecentFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Network\SharingHandler\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Panose\Calibri
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Panose\Wingdings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F0040963251E5}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\InProcServer32\
(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EF-F192-11D4-A65F-0040963251E5}\AppID
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions\ProductType
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\DefaultSecurity\SrvsvcDefaultShareInfo
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\DisableRobustifiedUNC
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\Bidi Spelling
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\AutoSpell
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\AutoGrammar
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\DefaultFormat
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\BackgroundSave
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\BackgroundPrint
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\PlainTextAutoFormat
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\InsertFloating
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common AppData
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\My Pictures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonPictures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProfilesDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\AllUsersProfile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\InProcServer32\
(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSharedDocuments
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonMusic
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonVideo
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\QMEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Registration\{90120000-0030-0000-00000000000FF1CE}\ProductID
HKEY_CURRENT_USER\Software\Classes\.htm\(Default)
HKEY_CURRENT_USER\Control Panel\International\Geo\Nation
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\General\CustomizableAlertBaseURL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
修改的注册表键
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\DocumentRecovery
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\DocumentRecovery\14C4CCA
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Data
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Data\Toolbars
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Toolbars\Settings
HKEY_CURRENT_USER\Software\Microsoft\Web Service Providers
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Panose
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\My Pictures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonPictures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonMusic
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonVideo
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\DrawAlerts\FTP Sites
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\Research\Translation\CurrentProvider
删除的注册表键
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\6>u
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\7ct
API解析
mso.dll.#403
mso.dll.#6768
mso.dll.#9183
mso.dll.#8399
mso.dll.#9942
mso.dll.#9943
mso.dll.#9299
gdi32.dll.GdiTransparentBlt
gdi32.dll.GdiAlphaBlend
gdi32.dll.GdiGradientFill
mso.dll.#8703
mso.dll.#7351
mso.dll.#929
mso.dll.#7348
mso.dll.#5347
mso.dll.#147
mso.dll.#8041
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#12
mso.dll.#8652
mso.dll.#7896
mso.dll.#8422
oleaut32.dll.#4
kernel32.dll.NlsGetCacheUpdateCount
mso.dll.#8033
mso.dll.#8751
mso.dll.#1879
mso.dll.#2734
mso.dll.#1895
mso.dll.#1882
mso.dll.#1889
mso.dll.#1883
mso.dll.#1884
mso.dll.#8653
mso.dll.#4227
mso.dll.#8752
mso.dll.#8066
mso.dll.#8060
mso.dll.#8782
mso.dll.#8011
mso.dll.#8062
mso.dll.#8002
mso.dll.#6401
mso.dll.#597
mso.dll.#3286
mso.dll.#7033
mso.dll.#7014
mso.dll.#1196
mso.dll.#7632
mso.dll.#731
mso.dll.#1811
mso.dll.#741
mso.dll.#1737
mso.dll.#388
mso.dll.#742
mso.dll.#1489
mso.dll.#931
mso.dll.#804
mso.dll.#6788
mso.dll.#7966
mso.dll.#7206
mso.dll.#601
mso.dll.#609
mso.dll.#797
mso.dll.#603
mso.dll.#300
mso.dll.#771
mso.dll.#2983
mso.dll.#607
mso.dll.#302
mso.dll.#368
mso.dll.#604
mso.dll.#440
mso.dll.#438
mso.dll.#521
mso.dll.#426
mso.dll.#1189
mso.dll.#1537
mso.dll.#6782
mso.dll.#6798
mso.dll.#7668
mso.dll.#7593
mso.dll.#6098
mso.dll.#3335
mso.dll.#669
mso.dll.#8107
mso.dll.#9987
mso.dll.#2599
mso.dll.#9399
mso.dll.#1000
mso.dll.#8541
mso.dll.#8044
mso.dll.#1660
mso.dll.#8793
mso.dll.#1696
mso.dll.#1727
mso.dll.#1191
mso.dll.#8498
mso.dll.#393
mso.dll.#3174
mso.dll.#3175
mso.dll.#383
mso.dll.#6276
mso.dll.#2796
msptls.dll.#127
msptls.dll.#244
mso.dll.#4738
msptls.dll.#3
mso.dll.#3334
mso.dll.#306
mso.dll.#2525
mso.dll.#1731
msptls.dll.#97
msptls.dll.#4
msptls.dll.#5
msptls.dll.#189
msptls.dll.#193
msptls.dll.#194
msptls.dll.#200
msptls.dll.#201
msptls.dll.#203
msptls.dll.#204
msptls.dll.#211
msptls.dll.#212
msptls.dll.#213
msptls.dll.#214
msptls.dll.#133
msptls.dll.#134
mso.dll.#746
mso.dll.#747
mso.dll.#387
msptls.dll.#132
msptls.dll.#125
mso.dll.#745
msptls.dll.#96
msptls.dll.#91
mso.dll.#722
mso.dll.#1931
mso.dll.#3041
mso.dll.#9256
mso.dll.#995
mso.dll.#1028
mso.dll.#1032
mso.dll.#1496
mso.dll.#8040
mso.dll.#5816
mso.dll.#1886
mso.dll.#7795
mso.dll.#6787
mso.dll.#8165
shlwapi.dll.wnsprintfW
shlwapi.dll.PathQuoteSpacesW
shlwapi.dll.PathFindFileNameW
shlwapi.dll.PathRemoveArgsW
shlwapi.dll.PathUnquoteSpacesW
shlwapi.dll.PathRemoveFileSpecW
shlwapi.dll.PathIsURLW
shlwapi.dll.SHOpenRegStreamA
shlwapi.dll.SHOpenRegStreamW
shlwapi.dll.wnsprintfA
shlwapi.dll.wvnsprintfA
shlwapi.dll.wvnsprintfW
shlwapi.dll.StrRetToBufW
shlwapi.dll.StrRetToStrW
shlwapi.dll.SHLoadIndirectString
mso.dll.#6282
mso.dll.#6553
mso.dll.#1914
mso.dll.#1739
mso.dll.#9142
mso.dll.#9141
mso.dll.#8193
mso.dll.#671
mso.dll.#1659
mso.dll.#6318
mso.dll.#7836
mso.dll.#8052
mso.dll.#8057
mso.dll.#6492
mso.dll.#6625
mso.dll.#6355
mso.dll.#7620
oleaut32.dll.#7
mso.dll.#8549
mso.dll.#2820
mso.dll.#3021
mso.dll.#3132
mso.dll.#2652
mso.dll.#7664
mso.dll.#8304
mso.dll.#1178
mso.dll.#5871
mso.dll.#6406
mso.dll.#6636
mso.dll.#7956
mso.dll.#497
mso.dll.#7315
mso.dll.#7312
mso.dll.#7910
mso.dll.#6372
mso.dll.#7306
mso.dll.#6647
mso.dll.#9999
mso.dll.#6779
mso.dll.#6797
mso.dll.#2329
mso.dll.#6065
mso.dll.#6653
mso.dll.#1325
mso.dll.#1668
mso.dll.#1213
mso.dll.#9364
mso.dll.#1713
mso.dll.#337
mso.dll.#2389
shlwapi.dll.#439
kernel32.dll.GetUserDefaultUILanguage
apphelp.dll.ApphelpCheckIME
pintlgnt.ime.ImeInquire
pintlgnt.ime.ImeConversionList
pintlgnt.ime.ImeRegisterWord
pintlgnt.ime.ImeUnregisterWord
pintlgnt.ime.ImeGetRegisterWordStyle
pintlgnt.ime.ImeEnumRegisterWord
pintlgnt.ime.ImeConfigure
pintlgnt.ime.ImeDestroy
pintlgnt.ime.ImeEscape
pintlgnt.ime.ImeProcessKey
pintlgnt.ime.ImeSelect
pintlgnt.ime.ImeSetActiveContext
pintlgnt.ime.ImeToAsciiEx
pintlgnt.ime.NotifyIME
pintlgnt.ime.ImeSetCompositionString
imm32.dll.ImmRequestMessageW
user32.dll.GetSystemMetrics
user32.dll.MonitorFromWindow
user32.dll.MonitorFromRect
user32.dll.MonitorFromPoint
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesW
user32.dll.GetMonitorInfoW
advapi32.dll.CheckTokenMembership
msctf.dll.TF_CreateLangBarMgr
mso.dll.#1835
mso.dll.#8018
mso.dll.#8024
mso.dll.#7356
mso.dll.#2029
mso.dll.#1546
mso.dll.#454
mso.dll.#9507
mso.dll.#9505
mso.dll.#1372
mso.dll.#8181
mso.dll.#6780
mso.dll.#800
mso.dll.#490
mso.dll.#1358
mso.dll.#560
mso.dll.#7880
mso.dll.#8474
msptls.dll.#63
mso.dll.#1803
mso.dll.#340
mso.dll.#1678
mso.dll.#2695
mso.dll.#468
msptls.dll.#120
msptls.dll.#92
mso.dll.#1597
mso.dll.#9325
mso.dll.#1870
mso.dll.#1507
mso.dll.#1818
mso.dll.#9356
kernel32.dll.HeapSetInformation
msproof6.dll.DllGetClassObject
msproof6.dll.DllCanUnloadNow
mso.dll.#8215
mso.dll.#6784
mso.dll.#4979
mso.dll.#7487
mso.dll.#7929
mso.dll.#17
mso.dll.#19
mso.dll.#21
kernel32.dll.GetLongPathNameW
shell32.dll.SHGetFolderPathW
mso.dll.#6395
mso.dll.#7798
mso.dll.#7900
ogl.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayDevicesA
wtsapi32.dll.WTSRegisterSessionNotification
wtsapi32.dll.WTSUnRegisterSessionNotification
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
ogl.dll.GdipCreatePath
ogl.dll.GdipStartPathFigure
ogl.dll.GdipAddPathLine2
ogl.dll.GdipCreateMatrix2
ogl.dll.GdipTransformPath
ogl.dll.GdipDeleteMatrix
ogl.dll.GdipGetPathWorldBounds
ogl.dll.GdipClonePath
ogl.dll.GdipCreatePathIter
ogl.dll.GdipPathIterRewind
ogl.dll.GdipPathIterNextSubpath
ogl.dll.GdipPathIterCopyData
ogl.dll.GdipDeletePathIter
ogl.dll.GdipDeletePath
msptls.dll.#243
msptls.dll.#245
mso.dll.#286
msptls.dll.#216
msptls.dll.#217
mso.dll.#9392
msptls.dll.#186
msptls.dll.#250
msptls.dll.#177
msptls.dll.#249
msptls.dll.#135
msptls.dll.#178
msptls.dll.#248
msptls.dll.#247
msptls.dll.#145
msptls.dll.#205
msptls.dll.#206
msptls.dll.#220
msptls.dll.#223
msptls.dll.#224
msptls.dll.#225
msptls.dll.#226
msptls.dll.#143
msptls.dll.#221
msptls.dll.#140
msptls.dll.#188
mso.dll.#9219
mso.dll.#4487
mso.dll.#4546
mso.dll.#4203
msptls.dll.#66
mso.dll.#2832
mso.dll.#581
mso.dll.#574
mso.dll.#453
mso.dll.#3333
mso.dll.#2954
sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid
mso.dll.#6593
mso.dll.#7777
mso.dll.#2027
mso.dll.#9540
mso.dll.#8548
mso.dll.#6153
mso.dll.#6624
mso.dll.#8725
mso.dll.#6799
mso.dll.#6942
mso.dll.#6943
mso.dll.#724
mso.dll.#2630
mso.dll.#2616
mso.dll.#2977
mso.dll.#9169
oleaut32.dll.#6
mso.dll.#8577
mso.dll.#7052
mso.dll.#12001
mso.dll.#6570
mso.dll.#998
mso.dll.#7352
mso.dll.#556
mso.dll.#791
mso.dll.#6172
mso.dll.#1242
mso.dll.#1689
mso.dll.#3148
mso.dll.#2827
mso.dll.#1440
mso.dll.#6626
mso.dll.#7659
mso.dll.#8056
mso.dll.#1904
mso.dll.#1339
mso.dll.#1222
mso.dll.#1342
mso.dll.#25
mso.dll.#27
mso.dll.#26
mso.dll.#7028
ntshrui.dll.IsPathSharedW
mso.dll.#7945
mso.dll.#2598
mso.dll.#3341
mso.dll.#8106
mso.dll.#442
mso.dll.#768
mso.dll.#1823
mso.dll.#6541
mso.dll.#3056
mso.dll.#3057
mso.dll.#1063
mso.dll.#1107
mso.dll.#3413
mso.dll.#1106
mso.dll.#321
mso.dll.#6486
mso.dll.#8009
mso.dll.#1874
mso.dll.#1343
mso.dll.#8014
mso.dll.#7921
mso.dll.#8537
mso.dll.#926
mso.dll.#12345
mso.dll.#8423
oleaut32.dll.#147
mso.dll.#2913
mso.dll.#6174
mso.dll.#6729
oleaut32.dll.#411
oleaut32.dll.#17
oleaut32.dll.#20
oleaut32.dll.#19
oleaut32.dll.#23
oleaut32.dll.#24
linkinfo.dll.CreateLinkInfoW
linkinfo.dll.DestroyLinkInfo
shell32.dll.SHChangeNotify
mso.dll.#3147
mso.dll.#3271
mso.dll.#7999
mso.dll.#1998
mso.dll.#1571
mso.dll.#1858
mso.dll.#1934
mso.dll.#7354
mso.dll.#8028
mso.dll.#9188
mso.dll.#3565
mso.dll.#7473
mso.dll.#4931
mso.dll.#7469
mso.dll.#4834
mso.dll.#3504
mso.dll.#3527
mso.dll.#9267
mso.dll.#9262
mso.dll.#1799
mso.dll.#1916
msctfime.ime.CtfImeThreadDetach
msctf.dll.TF_DllDetachInOther
mso.dll.#6066
mso.dll.#895
mso.dll.#13
msptls.dll.#2
mso.dll.#6862
mso.dll.#2967
userenv.dll.GetAllUsersProfileDirectoryW
netapi32.dll.NetGetJoinInformation
netapi32.dll.NetApiBufferFree
mso.dll.#1944
mso.dll.#322
mso.dll.#1683
mso.dll.#6484
mso.dll.#6239
mso.dll.#1898
mso.dll.#893
mso.dll.#7885
mso.dll.#894
kernel32.dll.GetUserGeoID
msi.dll.DllGetVersion
shell32.dll.SHGetDesktopFolder
shell32.dll.SHGetMalloc
shell32.dll.SHGetPathFromIDList
shell32.dll.SHGetPathFromIDListW
shell32.dll.SHGetDataFromIDListA
shell32.dll.SHGetDataFromIDListW
shell32.dll.SHBrowseForFolderA
shell32.dll.SHBrowseForFolderW
shell32.dll.SHGetSpecialFolderLocation
shell32.dll.SHGetFileInfoA
shell32.dll.SHGetFileInfoW
shell32.dll.ExtractIconExA
shell32.dll.ExtractIconW
shell32.dll.DllGetClassObject
shell32.dll.DragQueryPoint
shell32.dll.DragQueryFileA
shell32.dll.DragQueryFileW
shell32.dll.DragFinish
shell32.dll.DragAcceptFiles
shell32.dll.ExtractIconA
shell32.dll.ShellExecuteA
shell32.dll.ShellExecuteW
shell32.dll.ShellExecuteExA
shell32.dll.ShellExecuteExW
shell32.dll.SHAppBarMessage
shell32.dll.FindExecutableA
shell32.dll.FindExecutableW
shell32.dll.#65
shell32.dll.SHGetSpecialFolderPathA
shell32.dll.SHGetSpecialFolderPathW
shell32.dll.SHAddToRecentDocs
shell32.dll.SHFileOperationA
shell32.dll.SHFileOperationW
shell32.dll.ExtractIconExW
shell32.dll.#102
shell32.dll.#83
shell32.dll.#172
shell32.dll.Shell_NotifyIconA
shell32.dll.Shell_NotifyIconW
shell32.dll.#18
shell32.dll.#152
shell32.dll.#153
shell32.dll.#16
shell32.dll.#19
shell32.dll.#17
shell32.dll.#21
shell32.dll.#25
shell32.dll.#23
shell32.dll.#24
shell32.dll.#155
shell32.dll.SHBindToParent
shell32.dll.SHRestricted
mso.dll.#788
mso.dll.#896
kernel32.dll.ReleaseActCtx
comctl32.dll.#336
comctl32.dll.#329
©2016 上海魔盾信息科技有限公司

下载 - 魔盾安全分析

Transcription

Similar documents

魔盾安全分析报告文件详细信息特征

下载 - 魔盾安全分析

Transcription

Similar documents

魔盾安全分析报告 文件详细信息 特征

魔盾安全分析报告文件详细信息特征