90e58e654d07bb2f13b6ebe3ca124098c61da1c503500606a0fc8addf204bb76

Add for printing

File name:	Potential Phish_ _External Email_ New Encrypted Fax Notification.msg
Full analysis:	https://app.any.run/tasks/47ca32b6-ef4b-49b9-896b-ea3defb4f056
Verdict:	Malicious activity
Analysis date:	January 14, 2022, 20:44:53
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/vnd.ms-outlook
File info:	CDFV2 Microsoft Outlook Message
MD5:	9E5D490DA83A5E847A03F0473C11C5B5
SHA1:	557C1FFAEB5A515429B0FB143747802757E23650
SHA256:	90E58E654D07BB2F13B6EBE3CA124098C61DA1C503500606A0FC8ADDF204BB76
SSDEEP:	3072:B1ImZAENr2G69FXvQRNnbBWHg1HFqXvQ7:xNiGWWRNMaHF7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.0.9600.19596 KB4534251
Adobe Acrobat Reader DC (20.013.20064)
Adobe Flash Player 32 ActiveX (32.0.0.453)
Adobe Flash Player 32 NPAPI (32.0.0.453)
Adobe Flash Player 32 PPAPI (32.0.0.453)
Adobe Refresh Manager (1.8.0)
CCleaner (5.74)
FileZilla Client 3.51.0 (3.51.0)
Google Chrome (86.0.4240.198)
Google Update Helper (1.3.36.31)
Java 8 Update 271 (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft .NET Framework 4.5.2 (4.5.51209)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Groove MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office IME (Japanese) 2010 (14.0.4763.1000)
Microsoft Office IME (Korean) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (French) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (German) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Language Pack 2010 - French/Français (14.0.4763.1000)
Microsoft Office Language Pack 2010 - German/Deutsch (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Italian/Italiano (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Japanese/日本語 (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Korean/한국어 (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Portuguese/Português (Brasil) (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Russian/русский (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Spanish/Español (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Turkish/Türkçe (14.0.4763.1013)
Microsoft Office O MUI (French) 2010 (14.0.4763.1000)
Microsoft Office O MUI (German) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (French) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (German) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (French) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (German) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (Arabic) 2010 (14.0.4763.1000)
Microsoft Office Proof (Basque) 2010 (14.0.4763.1000)
Microsoft Office Proof (Catalan) 2010 (14.0.4763.1000)
Microsoft Office Proof (Dutch) 2010 (14.0.4763.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Galician) 2010 (14.0.4763.1000)
Microsoft Office Proof (German) 2010 (14.0.4763.1000)
Microsoft Office Proof (Italian) 2010 (14.0.4763.1000)
Microsoft Office Proof (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Proof (Korean) 2010 (14.0.4763.1000)
Microsoft Office Proof (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Proof (Russian) 2010 (14.0.4763.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proof (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Proof (Ukrainian) 2010 (14.0.4763.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Proofing (French) 2010 (14.0.4763.1000)
Microsoft Office Proofing (German) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Italian) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Korean) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Russian) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office SharePoint Designer MUI (French) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (German) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Word MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office X MUI (French) 2010 (14.0.4763.1000)
Microsoft Office X MUI (German) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 83.0 (x86 en-US) (83.0)
Mozilla Maintenance Service (83.0.0.7621)
Notepad++ (32-bit x86) (7.9.1)
Opera 12.15 (12.15.1748)
QGA (2.14.33)
Skype version 8.29 (8.29)
VLC media player (3.0.11)
WinRAR 5.91 (32-bit) (5.91.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Hyphenation Parent Package English
IE Spelling Parent Package English
IE Troubleshooters Package
InternetExplorer Optional Package
InternetExplorer Package TopLevel
KB2479943
KB2491683
KB2506212
KB2506928
KB2532531
KB2533552
KB2533623
KB2534111
KB2545698
KB2547666
KB2552343
KB2560656
KB2564958
KB2574819
KB2579686
KB2585542
KB2604115
KB2620704
KB2621440
KB2631813
KB2639308
KB2640148
KB2653956
KB2654428
KB2656356
KB2660075
KB2667402
KB2676562
KB2685811
KB2685813
KB2685939
KB2690533
KB2698365
KB2705219
KB2719857
KB2726535
KB2727528
KB2729094
KB2729452
KB2731771
KB2732059
KB2736422
KB2742599
KB2750841
KB2758857
KB2761217
KB2770660
KB2773072
KB2786081
KB2789645
KB2799926
KB2800095
KB2807986
KB2808679
KB2813347
KB2813430
KB2820331
KB2834140
KB2836942
KB2836943
KB2840631
KB2843630
KB2847927
KB2852386
KB2853952
KB2857650
KB2861698
KB2862152
KB2862330
KB2862335
KB2864202
KB2868038
KB2871997
KB2872035
KB2884256
KB2891804
KB2893294
KB2893519
KB2894844
KB2900986
KB2908783
KB2911501
KB2912390
KB2918077
KB2919469
KB2923545
KB2931356
KB2937610
KB2943357
KB2952664
KB2968294
KB2970228
KB2972100
KB2972211
KB2973112
KB2973201
KB2977292
KB2978120
KB2978742
KB2984972
KB2984976
KB2984976 SP1
KB2985461
KB2991963
KB2992611
KB2999226
KB3004375
KB3006121
KB3006137
KB3010788
KB3011780
KB3013531
KB3019978
KB3020370
KB3020388
KB3021674
KB3021917
KB3022777
KB3023215
KB3030377
KB3031432
KB3035126
KB3037574
KB3042058
KB3045685
KB3046017
KB3046269
KB3054476
KB3055642
KB3059317
KB3060716
KB3061518
KB3067903
KB3068708
KB3071756
KB3072305
KB3074543
KB3075226
KB3078667
KB3080149
KB3086255
KB3092601
KB3093513
KB3097989
KB3101722
KB3102429
KB3102810
KB3107998
KB3108371
KB3108664
KB3109103
KB3109560
KB3110329
KB3115858
KB3118401
KB3122648
KB3123479
KB3126587
KB3127220
KB3133977
KB3137061
KB3138378
KB3138612
KB3138910
KB3139398
KB3139914
KB3140245
KB3147071
KB3150220
KB3150513
KB3155178
KB3156016
KB3159398
KB3161102
KB3161949
KB3170735
KB3172605
KB3179573
KB3184143
KB3185319
KB4019990
KB4040980
KB4474419
KB4490628
KB4524752
KB4532945
KB4536952
KB4567409
KB958488
KB976902
KB982018
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
Package 21 for KB2984976
Package 38 for KB2984976
Package 45 for KB2984976
Package 59 for KB2984976
Package 7 for KB2984976
Package 76 for KB2984976
PlatformUpdate Win7 SRV08R2 Package TopLevel
ProfessionalEdition
RDP BlueIP Package TopLevel
RDP WinIP Package TopLevel
RollupFix
UltimateEdition
WUClient SelfUpdate ActiveX
WUClient SelfUpdate Aux TopLevel
WUClient SelfUpdate Core TopLevel
WinMan WinIP Package TopLevel

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Checks supported languages
  - OUTLOOK.EXE (PID: 1068)
  - firefox.exe (PID: 2752)
  - firefox.exe (PID: 2572)
  - firefox.exe (PID: 3372)
  - firefox.exe (PID: 2688)
  - firefox.exe (PID: 3424)
  - firefox.exe (PID: 4088)
  - firefox.exe (PID: 4028)
  - firefox.exe (PID: 2268)
- Reads the computer name
  - OUTLOOK.EXE (PID: 1068)
  - firefox.exe (PID: 3372)
  - firefox.exe (PID: 3424)
  - firefox.exe (PID: 2572)
  - firefox.exe (PID: 2688)
  - firefox.exe (PID: 2268)
  - firefox.exe (PID: 4088)
  - firefox.exe (PID: 4028)
- Application launched itself
  - firefox.exe (PID: 2752)
  - firefox.exe (PID: 2572)
- Manual execution by user
  - firefox.exe (PID: 2752)
- Reads CPU info
  - firefox.exe (PID: 2572)
- Searches for installed software
  - OUTLOOK.EXE (PID: 1068)
- Creates files in the user directory
  - OUTLOOK.EXE (PID: 1068)
  - firefox.exe (PID: 2572)
- Creates files in the program directory
  - firefox.exe (PID: 2572)
- Reads Microsoft Office registry keys
  - OUTLOOK.EXE (PID: 1068)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

TRiD

.msg	\|	Outlook Message (58.9)
.oft	\|	Outlook Form Template (34.4)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1068

"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Potential Phish_ _External Email_ New Encrypted Fax Notification.msg"

C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

Explorer.EXE

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Outlook

Version:

14.0.6025.1000

Modules

Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\ole32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\office14\mso.dll
c:\program files\common files\microsoft shared\office14\cultures\office.odf
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\program files\microsoft office\office14\addins\umoutlookaddin.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msimtf.dll
c:\program files\microsoft office\office14\1033\outllibr.dll
c:\program files\common files\microsoft shared\office14\msores.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\program files\common files\microsoft shared\office14\1033\msointl.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppc.dll
c:\program files\common files\microsoft shared\office14\riched20.dll
c:\program files\microsoft office\office14\olmapi32.dll
c:\program files\microsoft office\office14\1033\mapir.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\dwmapi.dll
c:\program files\microsoft office\office14\contab32.dll
c:\program files\microsoft office\office14\omsxp32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\program files\microsoft office\office14\mspst32.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\program files\microsoft office\office14\exsec32.dll
c:\windows\system32\tzres.dll
c:\windows\system32\uxtheme.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\program files\microsoft office\office14\rtfhtml.dll
c:\windows\system32\mlang.dll
c:\program files\microsoft office\office14\1033\omsintl.dll
c:\program files\microsoft office\office14\wwlib.dll
c:\program files\microsoft office\office14\gfx.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msimg32.dll
c:\program files\microsoft office\office14\oart.dll
c:\program files\microsoft office\office14\1033\wwintl.dll
c:\program files\common files\microsoft shared\office14\msptls.dll
c:\windows\system32\propsys.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\winspool.drv
c:\program files\common files\microsoft shared\office14\usp10.dll
c:\windows\system32\mssprxy.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\windowscodecs.dll
c:\windows\system32\imageres.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\slc.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\program files\microsoft office\office14\omsmain.dll
c:\windows\system32\winmm.dll
c:\program files\microsoft office\office14\addins\colleagueimport.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\program files\microsoft office\office14\onbttnol.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\program files\microsoft office\office14\socialconnector.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfc90u.dll
c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_49768ef57548175e\mfc90enu.dll
c:\windows\system32\mapi32.dll
c:\windows\system32\oleacc.dll
c:\program files\microsoft office\office14\1033\umoutlookstrings.dll
c:\program files\microsoft office\office14\sharepointprovider.dll
c:\windows\system32\sxs.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\wship6.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\npmproxy.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\wshqos.dll
c:\program files\microsoft office\office14\outlacct.dll
c:\windows\system32\msident.dll
c:\windows\system32\atl.dll
c:\windows\system32\pstorec.dll
c:\program files\common files\system\ole db\oledb32.dll
c:\windows\system32\msdart.dll
c:\program files\common files\system\ole db\oledb32r.dll
c:\windows\system32\comsvcs.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\tquery.dll
c:\windows\system32\structuredquery.dll
c:\program files\microsoft office\office14\msproof7.dll
c:\program files\common files\microsoft shared\proof\mslid.dll
c:\windows\system32\msoeacct.dll
c:\windows\system32\msoert2.dll
c:\windows\system32\inetcomm.dll
c:\windows\system32\inetres.dll
c:\windows\system32\acctres.dll
c:\windows\system32\msxml3.dll

2752

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\admin\Desktop\FX-Mary.kirk-54266316-54266316.htm"

C:\Program Files\Mozilla Firefox\firefox.exe

—

Explorer.EXE

User:

admin

Company:

Mozilla Corporation

Integrity Level:

MEDIUM

Description:

Firefox

Exit code:

Version:

83.0

Modules

Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\dbghelp.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\mozilla firefox\ucrtbase.dll
c:\program files\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l2-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

2572

"C:\Program Files\Mozilla Firefox\firefox.exe" -url C:\Users\admin\Desktop\FX-Mary.kirk-54266316-54266316.htm

C:\Program Files\Mozilla Firefox\firefox.exe

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

MEDIUM

Description:

Firefox

Version:

83.0

Modules

Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\wintrust.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\dbghelp.dll
c:\program files\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\mozilla firefox\ucrtbase.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l2-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll
c:\windows\system32\cryptbase.dll
c:\program files\mozilla firefox\api-ms-win-crt-multibyte-l1-1-0.dll
c:\program files\mozilla firefox\nss3.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\mozilla firefox\lgpllibs.dll
c:\program files\mozilla firefox\xul.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\avrt.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\ole32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\program files\mozilla firefox\d3dcompiler_47.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\kbdus.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\psapi.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\npmproxy.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn2.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\winsta.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\mscms.dll
c:\windows\system32\wpc.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\netutils.dll
c:\windows\system32\mmdevapi.dll
c:\windows\system32\propsys.dll
c:\windows\system32\audioses.dll
c:\windows\system32\d2d1.dll
c:\windows\system32\xmllite.dll
c:\windows\system32\msimg32.dll
c:\program files\mozilla firefox\softokn3.dll
c:\program files\mozilla firefox\freebl3.dll
c:\program files\mozilla firefox\nssckbi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\actxprxy.dll

2688

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.0.1292601068\501720356" -parentBuildID 20201112153044 -prefsHandle 868 -prefMapHandle 888 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 1196 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

MEDIUM

Description:

Firefox

Version:

83.0

Modules

Images
c:\windows\system32\ntdll.dll
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\version.dll
c:\windows\system32\dbghelp.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\mozilla firefox\ucrtbase.dll
c:\program files\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l2-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\mozilla firefox\api-ms-win-crt-multibyte-l1-1-0.dll
c:\windows\system32\winmm.dll
c:\program files\mozilla firefox\nss3.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\ws2_32.dll
c:\program files\mozilla firefox\lgpllibs.dll
c:\program files\mozilla firefox\xul.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\avrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\userenv.dll
c:\program files\mozilla firefox\d3dcompiler_47.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\mfplat.dll
c:\windows\system32\mf.dll
c:\windows\system32\atl.dll
c:\windows\system32\ksuser.dll
c:\windows\system32\dxva2.dll
c:\windows\system32\evr.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshqos.dll

3424

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.6.720723943\443174694" -childID 1 -isForBrowser -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 245 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 2368 tab

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

LOW

Description:

Firefox

Version:

83.0

Modules

Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\dbghelp.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\mozilla firefox\ucrtbase.dll
c:\program files\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l2-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-multibyte-l1-1-0.dll
c:\program files\mozilla firefox\nss3.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\mozilla firefox\lgpllibs.dll
c:\program files\mozilla firefox\xul.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\avrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\program files\mozilla firefox\d3dcompiler_47.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wpc.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\samlib.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
c:\program files\mozilla firefox\softokn3.dll
c:\program files\mozilla firefox\freebl3.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll

3372

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.13.1901890404\569382014" -childID 2 -isForBrowser -prefsHandle 3472 -prefMapHandle 3468 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 3484 tab

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

LOW

Description:

Firefox

Version:

83.0

Modules

Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\dbghelp.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\mozilla firefox\ucrtbase.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l2-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll
c:\windows\system32\winmm.dll
c:\program files\mozilla firefox\nss3.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\program files\mozilla firefox\api-ms-win-crt-multibyte-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\mozilla firefox\lgpllibs.dll
c:\program files\mozilla firefox\xul.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\avrt.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\ole32.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\program files\mozilla firefox\d3dcompiler_47.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\wpc.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\netutils.dll
c:\program files\mozilla firefox\softokn3.dll
c:\program files\mozilla firefox\freebl3.dll

2268

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.20.468459296\933825004" -childID 3 -isForBrowser -prefsHandle 3588 -prefMapHandle 7800 -prefsLen 7399 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 7788 tab

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

LOW

Description:

Firefox

Version:

83.0

Modules

Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\dbghelp.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll
c:\program files\mozilla firefox\ucrtbase.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l2-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-multibyte-l1-1-0.dll
c:\program files\mozilla firefox\nss3.dll
c:\windows\system32\winmm.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\mozilla firefox\xul.dll
c:\program files\mozilla firefox\lgpllibs.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\avrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\program files\mozilla firefox\d3dcompiler_47.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\wpc.dll
c:\windows\system32\samlib.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
c:\program files\mozilla firefox\softokn3.dll
c:\program files\mozilla firefox\freebl3.dll

4088

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.27.1974456774\1577446857" -childID 4 -isForBrowser -prefsHandle 7520 -prefMapHandle 7532 -prefsLen 7844 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 7496 tab

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

LOW

Description:

Firefox

Version:

83.0

Modules

Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\version.dll
c:\windows\system32\dbghelp.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\mozilla firefox\ucrtbase.dll
c:\program files\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l2-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-multibyte-l1-1-0.dll
c:\program files\mozilla firefox\nss3.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\mozilla firefox\lgpllibs.dll
c:\program files\mozilla firefox\xul.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\avrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\program files\mozilla firefox\d3dcompiler_47.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\dwrite.dll

4028

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.28.685725478\288459427" -childID 5 -isForBrowser -prefsHandle 7508 -prefMapHandle 7512 -prefsLen 7844 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 7544 tab

C:\Program Files\Mozilla Firefox\firefox.exe

—

firefox.exe

User:

admin

Company:

Mozilla Corporation

Integrity Level:

LOW

Description:

Firefox

Exit code:

Version:

83.0

Modules

Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\dbghelp.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\mozilla firefox\ucrtbase.dll
c:\program files\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-file-l2-1-0.dll
c:\program files\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll
c:\program files\mozilla firefox\api-ms-win-crt-multibyte-l1-1-0.dll
c:\program files\mozilla firefox\nss3.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\nsi.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\mozilla firefox\lgpllibs.dll
c:\program files\mozilla firefox\xul.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\avrt.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\ole32.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\profapi.dll
c:\program files\mozilla firefox\d3dcompiler_47.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\dwrite.dll

Add for printing

Total events

12 581

Read events

11 965

Write events

597

Delete events

Modification events


(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1041
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1046
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1036
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1031
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1040
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1049
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	3082
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1042
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1055
Value: Off
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1046
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1036
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1031
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1040
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1041
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1049
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	3082
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1042
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1055
Value: On
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	write	Name:	0o6
Value: 306F36002C040000010000000000000000000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook
Operation:	write	Name:	MTTT
Value: 2C0400000441C7978709D80100000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM
Operation:	write	Name:	SQMSessionNumber
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM
Operation:	write	Name:	SQMSessionDate
Value: 221443200
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\AutoDiscover\RedirectServers
Operation:	write	Name:	autodiscover-s.outlook.com
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\0a0d020000000000c000000000000046
Operation:	write	Name:	00030429
Value: 03000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676
Operation:	write	Name:	{ED475418-B0D6-11D2-8C3B-00104B2A6676}
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676
Operation:	write	Name:	LastChangeVer
Value: 1200000000000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109A10090400000000000F01FEC\Usage
Operation:	write	Name:	OutlookMAPI2Intl_1033
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:	write	Name:	LanguageList
Value: en-US
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:	write	Name:	C:\Windows\system32,@tzres.dll,-2670
Value: (UTC+00:00) Dublin, Edinburgh, Lisbon, London
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:	write	Name:	C:\Windows\system32,@tzres.dll,-262
Value: GMT Standard Time
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:	write	Name:	C:\Windows\system32,@tzres.dll,-261
Value: GMT Daylight Time
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	OUTLOOKFiles
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	ProductFiles
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	WORDFiles
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9207f3e0a3b11019908b08002b2a56c2
Operation:	delete value	Name:	01023d11
Value: 25D50E0DF9991942B4230F340501590B23F38B6EE8974A40BA16AF7A0CC96702
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:	write	Name:	@%SystemRoot%\system32\mlang.dll,-4608
Value: Unicode
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10021400000000000F01FEC\Usage
Operation:	write	Name:	StemmerFiles_1042
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	write	Name:	bq6
Value: 627136002C040000040000000000000096000000010000008E000000430043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C0045006D00610069006C002E0064006F0074006D00000000000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	delete value	Name:	bq6
Value: 627136002C040000040000000000000096000000010000008E000000430043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C0045006D00610069006C002E0064006F0074006D00000000000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	delete value	Name:	0o6
Value: 306F36002C040000010000000000000000000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	delete key	Name:	(default)
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\0a0d020000000000c000000000000046
Operation:	write	Name:	000b046b
Value: 0000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676
Operation:	write	Name:	LastChangeVer
Value: 1300000000000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676
Operation:	write	Name:	LastChangeVer
Value: 1400000000000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	write	Name:	9s6
Value: 397336002C040000020000000000000000010000010000008C0000006800000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C0061006400640069006E0073005C0063006F006C006C006500610067007500650069006D0070006F00720074002E0064006C006C0000006D006900630072006F0073006F006600740020007300680061007200650070006F0069006E0074002000730065007200760065007200200063006F006C006C0065006100670075006500200069006D0070006F007200740020006100640064002D0069006E000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	delete value	Name:	9s6
Value: 397336002C040000020000000000000000010000010000008C0000006800000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C0061006400640069006E0073005C0063006F006C006C006500610067007500650069006D0070006F00720074002E0064006C006C0000006D006900630072006F0073006F006600740020007300680061007200650070006F0069006E0074002000730065007200760065007200200063006F006C006C0065006100670075006500200069006D0070006F007200740020006100640064002D0069006E000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	write	Name:	is6
Value: 697336002C0400000200000000000000C000000001000000700000004400000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C006F006E006200740074006E006F006C002E0064006C006C0000006F006E0065006E006F007400650020006E006F007400650073002000610062006F007500740020006F00750074006C006F006F006B0020006900740065006D0073000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	delete value	Name:	is6
Value: 697336002C0400000200000000000000C000000001000000700000004400000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C006F006E006200740074006E006F006C002E0064006C006C0000006F006E0065006E006F007400650020006E006F007400650073002000610062006F007500740020006F00750074006C006F006F006B0020006900740065006D0073000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	write	Name:	ys6
Value: 797336002C0400000200000000000000D0000000010000007E0000004600000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C0073006F006300690061006C0063006F006E006E006500630074006F0072002E0064006C006C0000006D006900630072006F0073006F006600740020006F00750074006C006F006F006B00200073006F006300690061006C00200063006F006E006E006500630074006F0072000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	delete value	Name:	ys6
Value: 797336002C0400000200000000000000D0000000010000007E0000004600000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C0073006F006300690061006C0063006F006E006E006500630074006F0072002E0064006C006C0000006D006900630072006F0073006F006600740020006F00750074006C006F006F006B00200073006F006300690061006C00200063006F006E006E006500630074006F0072000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	write	Name:	's6
Value: 277336002C0400000200000000000000CA000000010000008A0000003400000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C0061006400640069006E0073005C0075006D006F00750074006C006F006F006B0061006400640069006E002E0064006C006C0000006D006900630072006F0073006F00660074002000650078006300680061006E006700650020006100640064002D0069006E000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109A10090400000000000F01FEC\Usage
Operation:	write	Name:	OUTLOOKFilesIntl_1033
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	delete value	Name:	's6
Value: 277336002C0400000200000000000000CA000000010000008A0000003400000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C0061006400640069006E0073005C0075006D006F00750074006C006F006F006B0061006400640069006E002E0064006C006C0000006D006900630072006F0073006F00660074002000650078006300680061006E006700650020006100640064002D0069006E000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	write	Name:	's6
Value: 277336002C0400000200000000000000C000000001000000700000004400000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C006F006E006200740074006E006F006C002E0064006C006C0000006F006E0065006E006F007400650020006E006F007400650073002000610062006F007500740020006F00750074006C006F006F006B0020006900740065006D0073000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	delete value	Name:	's6
Value: 277336002C0400000200000000000000C000000001000000700000004400000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C006F006E006200740074006E006F006C002E0064006C006C0000006F006E0065006E006F007400650020006E006F007400650073002000610062006F007500740020006F00750074006C006F006F006B0020006900740065006D0073000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	write	Name:	's6
Value: 277336002C0400000200000000000000D0000000010000007E0000004600000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C0073006F006300690061006C0063006F006E006E006500630074006F0072002E0064006C006C0000006D006900630072006F0073006F006600740020006F00750074006C006F006F006B00200073006F006300690061006C00200063006F006E006E006500630074006F0072000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems
Operation:	delete value	Name:	's6
Value: 277336002C0400000200000000000000D0000000010000007E0000004600000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C006F0066006600690063006500310034005C0073006F006300690061006C0063006F006E006E006500630074006F0072002E0064006C006C0000006D006900630072006F0073006F006600740020006F00750074006C006F006F006B00200073006F006300690061006C00200063006F006E006E006500630074006F0072000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\SocialConnector
Operation:	write	Name:	CleanupFolder
Value: C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{4E3A6965-17F1-4243-B49B-74EE32AFF6A3}
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\SocialConnector
Operation:	write	Name:	AlertTypes
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\SocialConnector
Operation:	write	Name:	RestartsSinceAlerts
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\SocialConnector
Operation:	write	Name:	AlertInsertStrings
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\SocialConnector
Operation:	write	Name:	PeoplePaneModeInspector
Value: 3
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:	write	Name:	ProxyEnable
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:	write	Name:	SavedLegacySettings
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:	write	Name:	WpadDecisionReason
Value: 1
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:	write	Name:	WpadDecisionTime
Value: 4E729B988709D801
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:	write	Name:	WpadDecision
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:	write	Name:	WpadNetworkName
Value: Network 4
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:	write	Name:	WpadDecisionReason
Value: 1
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:	write	Name:	WpadDecisionTime
Value: 4E729B988709D801
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:	write	Name:	WpadDecision
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Identities
Operation:	write	Name:	Identity Ordinal
Value: 2
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\24B3A62F61238241880F5E6F5085144E
Operation:	write	Name:	WriterId
Value: 4744375
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\24B3A62F61238241880F5E6F5085144E
Operation:	write	Name:	LastModification
Value: D0BEC2805A48D401
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\24B3A62F61238241880F5E6F5085144E
Operation:	write	Name:	MsgEID
Value: 00000000EE353A6753D116479D0919B95E8B889A88001000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\CF14372EFC763840BAC11A8C1F0B8F44
Operation:	write	Name:	WriterId
Value: 4744390
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\CF14372EFC763840BAC11A8C1F0B8F44
Operation:	write	Name:	LastModification
Value: D02FC5805A48D401
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\CF14372EFC763840BAC11A8C1F0B8F44
Operation:	write	Name:	MsgEID
Value: 00000000EE353A6753D116479D0919B95E8B889AA8001000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\5BFF177DE1D85041B599A808F99C8815
Operation:	write	Name:	WriterId
Value: 4744390
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\5BFF177DE1D85041B599A808F99C8815
Operation:	write	Name:	LastModification
Value: D02FC5805A48D401
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\5BFF177DE1D85041B599A808F99C8815
Operation:	write	Name:	MsgEID
Value: 00000000EE353A6753D116479D0919B95E8B889AC8001000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\C98EFDA14604C34D9F23EFEC5C5AF89D
Operation:	write	Name:	WriterId
Value: 4744390
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\C98EFDA14604C34D9F23EFEC5C5AF89D
Operation:	write	Name:	LastModification
Value: D02FC5805A48D401
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\C98EFDA14604C34D9F23EFEC5C5AF89D
Operation:	write	Name:	MsgEID
Value: 00000000EE353A6753D116479D0919B95E8B889AE8001000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\0a0d020000000000c000000000000046
Operation:	write	Name:	00030487
Value: 5CF9320D
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\C2489E4FCD9F344E952D5800C66FE0C6
Operation:	write	Name:	WriterId
Value: 4744390
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\C2489E4FCD9F344E952D5800C66FE0C6
Operation:	write	Name:	LastModification
Value: D02FC5805A48D401
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\C2489E4FCD9F344E952D5800C66FE0C6
Operation:	write	Name:	MsgEID
Value: 00000000EE353A6753D116479D0919B95E8B889A08011000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\6AC9CC0241A99E41A18862DF1C01B9C6
Operation:	write	Name:	WriterId
Value: 4744390
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\6AC9CC0241A99E41A18862DF1C01B9C6
Operation:	write	Name:	LastModification
Value: D02FC5805A48D401
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\6AC9CC0241A99E41A18862DF1C01B9C6
Operation:	write	Name:	MsgEID
Value: 00000000EE353A6753D116479D0919B95E8B889A28011000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\D0570303DBB6284D87B3DC07F3A99AAB
Operation:	write	Name:	WriterId
Value: 4744390
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\D0570303DBB6284D87B3DC07F3A99AAB
Operation:	write	Name:	LastModification
Value: D02FC5805A48D401
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Perf\RoamingStreamsCache\D0570303DBB6284D87B3DC07F3A99AAB
Operation:	write	Name:	MsgEID
Value: 00000000EE353A6753D116479D0919B95E8B889A48011000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Search
Operation:	write	Name:	C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst
Value: 3690740
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Licensing
Operation:	write	Name:	CFF13DD86EF249EBB265E3BFC6501C1D
Value: 01000000270000007B39303134303030302D303033442D303030302D303030302D3030303030303046463143457D005A0000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F00660065007300730069006F006E0061006C002D00520065007400610069006C002000650064006900740069006F006E000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Security
Operation:	write	Name:	OutlookSecureTempFolder
Value: C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\KNXSWUMK\
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:	delete value	Name:	FontInfoCacheW
Value: 6000000060000000F5FFFFFF000000000000000000000000BC02000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B000000020000000200000000000000060000001A000000BC0200000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C0290000000000000001000000000028200700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B0000000200000002000000000000000500000017000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282006000000F7FFFFFF0000000000000000000000009001000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000B000000090000000200000002000000000000000400000013000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282005000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\3517490d76624c419a828607e2a54604
Operation:	write	Name:	001f6000
Value: 4E006F004D00610069006C000000
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Ami R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Arial Unicode MS
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Batang
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@BatangChe
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@DFKai-SB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Dotum
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@DotumChe
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Expo M
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@FangSong
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Gulim
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@GulimChe
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Gungsuh
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@GungsuhChe
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Headline R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGGothicE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGGothicM
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGGyoshotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGKyokashotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGMaruGothicMPRO
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGMinchoB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGMinchoE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGPGothicE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGPGothicM
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGPGyoshotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGPKyokashotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGPMinchoB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGPMinchoE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGPSoeiKakugothicUB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGPSoeiKakupoptai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGPSoeiPresenceEB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSeikaishotaiPRO
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSGothicE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSGothicM
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSGyoshotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSKyokashotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSMinchoB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSMinchoE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSoeiKakugothicUB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSoeiKakupoptai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSoeiPresenceEB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSSoeiKakugothicUB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSSoeiKakupoptai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HGSSoeiPresenceEB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYGothic-Extra
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYGothic-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYGraphic-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYGungSo-Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYHeadLine-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYMyeongJo-Extra
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYPMokGak-Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYPost-Light
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYPost-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYShortSamul-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@HYSinMyeongJo-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@KaiTi
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Magic R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Malgun Gothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Meiryo
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Meiryo UI
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Microsoft JhengHei
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Microsoft YaHei
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MingLiU
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MingLiU_HKSCS
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MingLiU_HKSCS-ExtB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MingLiU-ExtB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MoeumT R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MS Gothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MS Mincho
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MS PGothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MS PMincho
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@MS UI Gothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@New Gulim
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@NSimSun
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@PMingLiU
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@PMingLiU-ExtB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Pyunji R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@SimHei
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@SimSun
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@SimSun-ExtB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	@Yet R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Agency FB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Aharoni
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Algerian
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Ami R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Andalus
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Angsana New
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	AngsanaUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Aparajita
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Arabic Typesetting
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Arial
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Arial Black
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Arial Narrow
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Arial Rounded MT Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Arial Unicode MS
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Baskerville Old Face
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Batang
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	BatangChe
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bauhaus 93
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bell MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Berlin Sans FB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Berlin Sans FB Demi
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bernard MT Condensed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Blackadder ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bodoni MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bodoni MT Black
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bodoni MT Condensed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bodoni MT Poster Compressed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Book Antiqua
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bookman Old Style
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bookshelf Symbol 7
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Bradley Hand ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Britannic Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Broadway
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Browallia New
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	BrowalliaUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Brush Script MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Calibri
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Calibri Light
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Californian FB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Calisto MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Cambria
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Cambria Math
Value: 1
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Candara
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Castellar
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Centaur
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Century
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Century Gothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Century Schoolbook
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Chiller
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Colonna MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Comic Sans MS
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Consolas
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Constantia
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Cooper Black
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Copperplate Gothic Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Copperplate Gothic Light
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Corbel
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Cordia New
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	CordiaUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Courier
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Courier New
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Curlz MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	DaunPenh
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	David
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	DFKai-SB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	DilleniaUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	DokChampa
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Dotum
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	DotumChe
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Ebrima
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Edwardian Script ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Elephant
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Engravers MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Eras Bold ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Eras Demi ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Eras Light ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Eras Medium ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Estrangelo Edessa
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	EucrosiaUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Euphemia
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Expo M
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	FangSong
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Felix Titling
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Fixedsys
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Footlight MT Light
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Forte
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Franklin Gothic Book
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Franklin Gothic Demi
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Franklin Gothic Demi Cond
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Franklin Gothic Heavy
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Franklin Gothic Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Franklin Gothic Medium Cond
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	FrankRuehl
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	FreesiaUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Freestyle Script
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	French Script MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gabriola
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Garamond
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gautami
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Georgia
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gigi
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gill Sans MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gill Sans MT Condensed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gill Sans MT Ext Condensed Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gill Sans Ultra Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gill Sans Ultra Bold Condensed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gisha
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gloucester MT Extra Condensed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Goudy Old Style
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Goudy Stout
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gulim
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	GulimChe
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Gungsuh
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	GungsuhChe
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Haettenschweiler
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Harlow Solid Italic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Harrington
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Headline R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGGothicE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGGothicM
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGGyoshotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGKyokashotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGMaruGothicMPRO
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGMinchoB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGMinchoE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGPGothicE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGPGothicM
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGPGyoshotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGPKyokashotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGPMinchoB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGPMinchoE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGPSoeiKakugothicUB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGPSoeiKakupoptai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGPSoeiPresenceEB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSeikaishotaiPRO
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSGothicE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSGothicM
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSGyoshotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSKyokashotai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSMinchoB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSMinchoE
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSoeiKakugothicUB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSoeiKakupoptai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSoeiPresenceEB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSSoeiKakugothicUB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSSoeiKakupoptai
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HGSSoeiPresenceEB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	High Tower Text
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYGothic-Extra
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYGothic-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYGraphic-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYGungSo-Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYHeadLine-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYMyeongJo-Extra
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYPMokGak-Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYPost-Light
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYPost-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYShortSamul-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	HYSinMyeongJo-Medium
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Impact
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Imprint MT Shadow
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Informal Roman
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	IrisUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Iskoola Pota
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	JasmineUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Jokerman
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Juice ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	KaiTi
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Kalinga
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Kartika
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Khmer UI
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	KodchiangUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Kokila
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Kristen ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Kunstler Script
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Lao UI
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Latha
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Leelawadee
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Levenim MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	LilyUPC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Lucida Bright
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Lucida Calligraphy
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Lucida Console
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Lucida Fax
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Lucida Handwriting
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Lucida Sans
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Lucida Sans Typewriter
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Lucida Sans Unicode
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Magic R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Magneto
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Maiandra GD
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Malgun Gothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Mangal
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Marlett
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Matura MT Script Capitals
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Meiryo
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Meiryo UI
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Microsoft Himalaya
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Microsoft JhengHei
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Microsoft New Tai Lue
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Microsoft PhagsPa
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Microsoft Sans Serif
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Microsoft Tai Le
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Microsoft Uighur
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Microsoft YaHei
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Microsoft Yi Baiti
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MingLiU
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MingLiU_HKSCS
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MingLiU_HKSCS-ExtB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MingLiU-ExtB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Miriam
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Miriam Fixed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Mistral
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Modern No. 20
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MoeumT R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Mongolian Baiti
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Monotype Corsiva
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MoolBoran
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS Gothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS Mincho
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS Outlook
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS PGothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS PMincho
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS Reference Sans Serif
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS Reference Specialty
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS Sans Serif
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS Serif
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MS UI Gothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MT Extra
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	MV Boli
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Narkisim
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	New Gulim
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Niagara Engraved
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Niagara Solid
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	NSimSun
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Nyala
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	OCR A Extended
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	OCRB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Old English Text MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Onyx
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Palace Script MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Palatino Linotype
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Papyrus
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Parchment
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Perpetua
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Perpetua Titling MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Plantagenet Cherokee
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Playbill
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	PMingLiU
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	PMingLiU-ExtB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Poor Richard
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Pristina
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Pyunji R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Raavi
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Rage Italic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Ravie
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Rockwell
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Rockwell Condensed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Rockwell Extra Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Rod
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Sakkal Majalla
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Script MT Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Segoe Print
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Segoe Script
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Segoe UI
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Segoe UI Light
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Segoe UI Semibold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Segoe UI Symbol
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Shonar Bangla
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Showcard Gothic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Shruti
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	SimHei
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Simplified Arabic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Simplified Arabic Fixed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	SimSun
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	SimSun-ExtB
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Small Fonts
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Snap ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Stencil
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Sylfaen
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Symbol
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	System
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Tahoma
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Tempus Sans ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Terminal
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Times New Roman
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Traditional Arabic
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Trebuchet MS
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Tunga
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Tw Cen MT
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Tw Cen MT Condensed
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Tw Cen MT Condensed Extra Bold
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Utsaah
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Vani
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Verdana
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Vijaya
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Viner Hand ITC
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Vivaldi
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Vladimir Script
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Vrinda
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Webdings
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Wide Latin
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Wingdings
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Wingdings 2
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Wingdings 3
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Operation:	write	Name:	Yet R
Value: 0
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFiles_3082
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFiles_1036
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFiles_1033
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10061400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp1_1046
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10031400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp1_1043
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10070400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFiles_1031
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10010400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp1_1025
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10001400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp1_1040
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10022400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp2_1058
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10091400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp1_1049
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10065400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp2_1110
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100D2400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp2_1069
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10030400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp2_1027
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10021400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp6_1042
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100F1400000000000F01FEC\Usage
Operation:	write	Name:	SpellingAndGrammarFilesExp1_1055
Value:
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\IAM
Operation:	write	Name:	Server ID
Value: 2
(PID) Process:	(2752) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Launcher
Value: 03C7D1CC60000000
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Browser
Value: 4FCFD1CC60000000
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe\|Telemetry
Value: 0
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\firefox.exe
Value: 0
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\|DisableTelemetry
Value: 1
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\|DisableDefaultBrowserAgent
Value: 0
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\|ServicesSettingsServer
Value: https://firefox.settings.services.mozilla.com/v1
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:	write	Name:	C:\Program Files\Mozilla Firefox\|SecurityContentSignatureRootHash
Value: 97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:	write	Name:	ProxyEnable
Value: 0
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:	write	Name:	SavedLegacySettings
Value: 460000003C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8649A000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(2572) firefox.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:	write	Name:	LanguageList
Value: en-US
(PID) Process:	(1068) OUTLOOK.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\0a0d020000000000c000000000000046
Operation:	write	Name:	000b0340
Value: 0100

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Temp\CVR2B80.tmp.cvr		—
		MD5:—	SHA256:—
1068	OUTLOOK.EXE	C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst		—
		MD5:—	SHA256:—
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin		—
		MD5:—	SHA256:—
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_C98EFDA14604C34D9F23EFEC5C5AF89D.dat		xml
		MD5:D8B37ED0410FB241C283F72B76987F18	SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_C2489E4FCD9F344E952D5800C66FE0C6.dat		xml
		MD5:BBCF400BD7AE536EB03054021D6A6398	SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm		pgc
		MD5:72DFD89675A42581F728F0EEF67ED657	SHA256:E87DDE6DE70047086A13216F73C2BD8FB69D623AE5E9D47751AA290C5283D67A
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log		text
		MD5:106B697DF4CB0DDE0EF28B14216EC5AD	SHA256:EE62AB399996F9A07B7AC9E1F5EE8EFDCB7A4B3A49661BC9E4EBB49E2E72B301
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf		text
		MD5:F3B25701FE362EC84616A93A45CE9998	SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{4E3A6965-17F1-4243-B49B-74EE32AFF6A3}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.png		image
		MD5:4C61C12EDBC453D7AE184976E95258E1	SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_CF14372EFC763840BAC11A8C1F0B8F44.dat		xml
		MD5:EEAA832C12F20DE6AAAA9C7B77626E72	SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_5BFF177DE1D85041B599A808F99C8815.dat		xml
		MD5:807EF0FC900FEB3DA82927990083D6E7	SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_24B3A62F61238241880F5E6F5085144E.dat		xml
		MD5:B21ED3BD946332FF6EBC41A87776C6BB	SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_6AC9CC0241A99E41A18862DF1C01B9C6.dat		xml
		MD5:57F30B1BCA811C2FCB81F4C13F6A927B	SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TCPrefs_2_D0570303DBB6284D87B3DC07F3A99AAB.dat		xml
		MD5:F194B1FA12F9B6F46A47391FAE8BEEC2	SHA256:FCD8D7E030BE6EA7588E5C6CB568E3F1BDFC263942074B693942A27DF9521A74
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite		—
		MD5:—	SHA256:—
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\KNXSWUMK\FX-Mary kirk-54266316-54266316.htm		html
		MD5:D6B7E9F745A97CD8FCBFA67A8336AF9C	SHA256:DC2A558AB6C67829DC9891DFC21E6B00ED034DBED40297F671BC725FA21C7B93
1068	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\KNXSWUMK\FX-Mary kirk-54266316-54266316.htm:Zone.Identifier		text
		MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B	SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js		text
		MD5:45EF9A4166EDA02F826E4C88805DA4D7	SHA256:A92F489DB14813CC58287734FB24A245254098D1EFEB743F2BB8C8EDFB53F7C9
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin		binary
		MD5:994A33896BB41A278A315D0D796422B6	SHA256:54EC50A20FFF8CC016710E49437CF6A11D3FE5EE7B28C185E4A9AAFEE2908B63
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json		binary
		MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A	SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite-wal		sqlite-wal
		MD5:6701786A42060F725A48F69D6D34D1F5	SHA256:F7A437C7F32AB24DD61671AD3DC3F9FC1F2FF6EE5D32106F68A132A9214F4D3B
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js		text
		MD5:45EF9A4166EDA02F826E4C88805DA4D7	SHA256:A92F489DB14813CC58287734FB24A245254098D1EFEB743F2BB8C8EDFB53F7C9
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp		binary
		MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A	SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2572	firefox.exe	C:\Users\admin\AppData\Local\Temp\mz_etilqs_a18ceDCl0uEhnUw		binary
		MD5:69944FDC91FFA75783ED9AA59A12FB5C	SHA256:0ECF22BF6A99E8EAB58653A88F7291583172368C1A4C679B0F6070E57360B073
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal		binary
		MD5:39681B8E9420B4BA3DB499F0D149F93A	SHA256:28ECE969A3339E9E2963E55F1479399DF7203F205B810B01B5DC13701403FEDC
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp		jsonlz4
		MD5:B17F8D93B0C43D6B72DC03752C20A2D9	SHA256:ADA0F70D374223FB63C2F19471FAB45D986A681E2485692E63F00F5071F19D76
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4.tmp		jsonlz4
		MD5:01DAE35763819EE4C2BD72553B33C337	SHA256:674E499CCF7E955DEFFEB21B94C092DE0A8EA1DD308C426DCF04BC84DBDFA377
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\QLDYZ5~1.DEF\cert9.db-journal		binary
		MD5:85ED9588410F78E6BF33BCB52B0BF70D	SHA256:51F8B2BDB5879CDB158984F6FE020B51D80BD11D979E256586E1C0680F9181BE
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\QLDYZ5~1.DEF\cert9.db		sqlite
		MD5:9B0DC7D0F9F7CA765F2520926A1AC875	SHA256:859BC0057D819E083F50B10836F91096E434DB703CFF92B704F98A87CE29CFBF
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4		jsonlz4
		MD5:B17F8D93B0C43D6B72DC03752C20A2D9	SHA256:ADA0F70D374223FB63C2F19471FAB45D986A681E2485692E63F00F5071F19D76
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm		binary
		MD5:B7C14EC6110FA820CA6B65F5AEC85911	SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\settings\main\ms-language-packs\asrouter.ftl.tmp		text
		MD5:3625F1DDA6D119478AD89D13950C9ACA	SHA256:CB40F6A8D58901D612A86690A41D4E273F24936FC926E98F82C0918CBEF4FC64
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4		jsonlz4
		MD5:01DAE35763819EE4C2BD72553B33C337	SHA256:674E499CCF7E955DEFFEB21B94C092DE0A8EA1DD308C426DCF04BC84DBDFA377
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\settings\main\ms-language-packs\asrouter.ftl		text
		MD5:3625F1DDA6D119478AD89D13950C9ACA	SHA256:CB40F6A8D58901D612A86690A41D4E273F24936FC926E98F82C0918CBEF4FC64
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-phish-proto.vlpset		—
		MD5:—	SHA256:—
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-phish-proto-1.vlpset		—
		MD5:—	SHA256:—
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\recovery.jsonlz4		jsonlz4
		MD5:FCC9B12DC90062C80F6AF2C3310EF77B	SHA256:06637FF88BA829EB3BDA57F429D62AC37236A39D98BA9A939FEC22516BDB90C3
2572	firefox.exe	C:\Users\admin\AppData\Local\Temp\mz_etilqs_LsacsWlBdFzCi78		binary
		MD5:F5645E561334909DEE513598046BC76E	SHA256:B5FFC294C878C8A052D845FB40D10CCA1B3E0A9C041F964972F19FFA88AFDF66
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\1		binary
		MD5:B4DDF33E1DC200BE3FFE7BA3A6FD9F3C	SHA256:D148685CE5590081B04DC0014A8F5B074AE16E65C5728AFCFDE5757896A37550
2572	firefox.exe	C:\Users\admin\AppData\Local\Temp\mz_etilqs_YeNEnRparWPrrqW		binary
		MD5:19DB3CCFCE2DA754F1BACC0D3CC96383	SHA256:579D8989BBB5A1D99F6B392B43B87867D50738601292481DA0FD46EFE8C12884
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-downloadwhite-proto.metadata		abr
		MD5:1EF5E829303A139CE967440E0CDCA10C	SHA256:98CE42DEEF51D40269D542F5314BEF2C7468D401AD5D85168BFAB4C0108F75F7
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\recovery.jsonlz4.tmp		jsonlz4
		MD5:FCC9B12DC90062C80F6AF2C3310EF77B	SHA256:06637FF88BA829EB3BDA57F429D62AC37236A39D98BA9A939FEC22516BDB90C3
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-badbinurl-proto.metadata		abr
		MD5:53553242D57214AAA5726A09B05FE7BC	SHA256:1BE2B3990B410CA4FB38D1F79019C4018CD8820B69618646C81D22DFCBDDC802
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-badbinurl-proto.vlpset		binary
		MD5:D6FE27E6FA4C59AE30F10D3ED3C4E643	SHA256:1E4376B6D787AAF51254B1D04124E5F1734FB0209D3B28096228657E6AEEAAC2
2572	firefox.exe	C:\Users\admin\AppData\Local\Temp\mz_etilqs_x7kiPzPBDVj9jaB		mpg
		MD5:949CD1A9B1184DFF0CEFBC489F798495	SHA256:3EBFA421A21D650A46A0B1850BFCF44E919E63B5D67431BF3E6900AAC7FFB1CC
2572	firefox.exe	C:\Users\admin\AppData\Local\Temp\mz_etilqs_B0k6rLql4trW2an		binary
		MD5:F56C8CBC4229F51334EC7F1D8B1DDFAB	SHA256:77954144217CC22929856A27379A337E5494D748422554B5D835DF262C14649D
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-downloadwhite-proto.vlpset		binary
		MD5:EA86E0097B81FDBDEE3F12AC90CA6410	SHA256:6A242B62530E38DDCFD272643F6CC44EDC0208C69DC3022D6CC273F4C7E79AF8
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-malware-proto.metadata		abr
		MD5:53553242D57214AAA5726A09B05FE7BC	SHA256:1BE2B3990B410CA4FB38D1F79019C4018CD8820B69618646C81D22DFCBDDC802
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-badbinurl-proto-1.vlpset		binary
		MD5:1771828C3D3AB11DA28008F4D80E0D7A	SHA256:C309B54EE8E0CA735CB99E9669CE140C673065149FF8648DDE1EC5025705A508
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-unwanted-proto.vlpset		binary
		MD5:6C7BD66A4404B7128ED3CDB1E071827D	SHA256:3C91EC10984682B15DDAC25FFE9E70359FA28B8878AA701E75EB235004445629
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-malware-proto-1.vlpset		binary
		MD5:115566BDF49858C98B4A1B110CF6463E	SHA256:A49542481A579C3944B50A5AE6875405E1EE5CEC4E6C7F1B79AEB0E6CE13E079
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-unwanted-proto.metadata		abr
		MD5:53553242D57214AAA5726A09B05FE7BC	SHA256:1BE2B3990B410CA4FB38D1F79019C4018CD8820B69618646C81D22DFCBDDC802
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal		—
		MD5:—	SHA256:—
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-unwanted-proto-1.vlpset		binary
		MD5:0F60A117D4A5462F18C51B30B5F1CA1B	SHA256:C43C724AE3F9A937D8E87E8AFA288EB2EB4B280F087B599989941CCBDAC14EE7
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-phish-proto.metadata		abr
		MD5:53553242D57214AAA5726A09B05FE7BC	SHA256:1BE2B3990B410CA4FB38D1F79019C4018CD8820B69618646C81D22DFCBDDC802
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-malware-proto.vlpset		binary
		MD5:E4FE13A7FB7B2F22B44B786D234FB402	SHA256:2B22D4F40C144D94634D04421F41F9BD5E99134DD1B901A85247A1E81F22357C
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google4\goog-downloadwhite-proto-1.vlpset		binary
		MD5:B0272F5CF9F56F11C856155DC5F40BE1	SHA256:74AB81A1929A8806D559A13140947F076CABA52BF882364C416EF4D8E9B155F4
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-new.bin		binary
		MD5:8780B0A03FCE30A4EC3FF093FF1EA50F	SHA256:87CBAA08A5DA06F81783BA8E0B99111AAFB6F0A73649BBA9EC5B51F7FA9B7970
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-new.bin		binary
		MD5:187E7A7401DC9107FC2005F68F2F999D	SHA256:E93774B9FD577F80E134AB22AE1984FA3142DFDD596FC577822B5B846B022CA3
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\broadcast-listeners.json		binary
		MD5:521ACE7C66AAA7290BD8D493DC5AF462	SHA256:227B3889D25BF76B0E73EC12D31229FB650A7FDF5ECC12FA1E31F4A454F499A6
2572	firefox.exe	C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\broadcast-listeners.json.tmp		binary
		MD5:521ACE7C66AAA7290BD8D493DC5AF462	SHA256:227B3889D25BF76B0E73EC12D31229FB650A7FDF5ECC12FA1E31F4A454F499A6
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache.bin		binary
		MD5:187E7A7401DC9107FC2005F68F2F999D	SHA256:E93774B9FD577F80E134AB22AE1984FA3142DFDD596FC577822B5B846B022CA3
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child.bin		binary
		MD5:8780B0A03FCE30A4EC3FF093FF1EA50F	SHA256:87CBAA08A5DA06F81783BA8E0B99111AAFB6F0A73649BBA9EC5B51F7FA9B7970
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\mozplugin-block-digest256.sbstore		binary
		MD5:519BEB1B01FC355BB388F1F75BE997FD	SHA256:FFE2D3077B81AE6F51B220C1C661B276C823FA67DAD1D64FC5F17249FC54BDC0
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\mozplugin-block-digest256.vlpset		binary
		MD5:FCC9C2C9B611A3264B68EBE180EB4248	SHA256:6ECD378A537EEFE350B45CFA353741383F407D99D776BF23155A7825DC5DD2BC
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\social-track-digest256.sbstore		binary
		MD5:59D2D3A9FF42621AE974078BCAABD9BC	SHA256:7371E8534C31C4BFF73E340413D77C988593A0E559418B0F2A5B34B9C82DDDD2
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\analytics-track-digest256.vlpset		binary
		MD5:1E1C0442F3FE16B185D5DB74F0E91FCE	SHA256:43ACC2D047C7988E9073ECF32AC619DE0D080C45B061D441D1D671D305BB4F08
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\ads-track-digest256.sbstore		binary
		MD5:A03E51212AD01CFE7EB3A87C8CE51744	SHA256:2328A7569AB3D1E0C8638282E09860C82DB28EDD1C1BE75CAAD91FC7015E966C
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\content-track-digest256.vlpset		binary
		MD5:897401403F6A9BBC2727BF8ACFA8BBAF	SHA256:75157865105C44C1220C337AEFF723E7B2E4AEF506CE7DB00E2621D5CEAF45B8
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\social-track-digest256.vlpset		binary
		MD5:E1EDDE17E24B61C5B26D7B76BA039463	SHA256:C2C4612B7B9545751F37B302EE345ABD0F22170C7CC2497320897B385D508B7F
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\ads-track-digest256.vlpset		binary
		MD5:38F55098AB1772E8A7B90A05CB33CFAE	SHA256:FD44A8121E20CF102D8FD79D6EE45D55CCB0D92893907091BB7587ED3B274244
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\content-track-digest256.sbstore		binary
		MD5:2BE5027A476EFB5FE011AE8257E6B428	SHA256:26D0EF7103DBC0516ADD2DA8029CA43567B98BDA1EF8D8E4CDA42F09AA9A4B36
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\analytics-track-digest256.sbstore		binary
		MD5:AE706ABFAECFD90D67E5C965091E004E	SHA256:13CBF8A5389A33A562E6DD10660F68E8964313536A109AA80ACFD8838BF45E73
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\mozstd-trackwhite-digest256.vlpset		binary
		MD5:C8663695A49BB5FB5A301D1A7233DB6C	SHA256:498D10D381ED91BE12CFF65292813BCCCD676176BCF614534AB7BA0E5536306E
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\mozstd-trackwhite-digest256.sbstore		binary
		MD5:92A93E4C81027F5788873296C6E2875B	SHA256:4358B8F0AF157CF2EF36A3A8BD152A528D32CFE98A2E0AE66207DBDB1D943EFA
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google-trackwhite-digest256.vlpset		binary
		MD5:E54E5B84194EEE15E64D2A03F1136BB7	SHA256:07707B589BE3DBA3BB0BDAC67760A2B180EA3531E9D7976B73E4C1D8DF9DBB1E
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\google-trackwhite-digest256.sbstore		binary
		MD5:FEC9BC354A7EE92C6FEEFE63E6B0FA26	SHA256:258EF8E6994A09FFB54BD0D5AFEC97C13C31F2EEFB7FE90A2A4C487C87817519
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flashallow-digest256.sbstore		binary
		MD5:DD0458514C9A922B45DA6A8BEBE47320	SHA256:D27D5B27030F4725249377951BEB89E84A90A0E8241F0D5FD80EA59C1606E761
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flashallow-digest256.vlpset		binary
		MD5:7194B6BFF691A056852A51E2E06CE8FE	SHA256:CBE2DC6ABFE25BEAD60F4DFAF419FC0F441FF8A8DD4A2FEBF5553BE1CBD90C49
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\allow-flashallow-digest256.sbstore		binary
		MD5:DD0458514C9A922B45DA6A8BEBE47320	SHA256:D27D5B27030F4725249377951BEB89E84A90A0E8241F0D5FD80EA59C1606E761
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\allow-flashallow-digest256.vlpset		binary
		MD5:DE0D88480C24350C59E1E9A3583DE0D1	SHA256:01BA9F0B913E04ED10BD7166796483DD4F72005F249D6EE68B12117BE4B5D3C7
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.sbstore		binary
		MD5:9F6B331AA1E070DCFEED473E76CE56C3	SHA256:7DBBEA2DD387EEB85E1F56E02FC9989ACDE570CD43BFEF2C2A827093BA87DA6D
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.vlpset		binary
		MD5:130B9AC2BEEC5ADA274561105D81AE36	SHA256:7D99FEC08182A5B95D18D1569EDAA2C60C2AAFBD15A56D8882F22F3B395E6460
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flash-digest256.sbstore		binary
		MD5:D5D6B4D59B4AE4E2DE4B40D0DA083571	SHA256:000E3A78C72A210CA3B5417A3CDD294FBCE2A31661601C9D594C75CF2800571C
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flashsubdoc-digest256.vlpset		binary
		MD5:40165280FF1345B5241EC2A9D1DA2AF0	SHA256:F80BDD5341D8B1EE946E344E258EF2D35C3C0BB6B13EB7B3E6A77467DFA8B97F
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flash-digest256.vlpset		binary
		MD5:C2994D388F8780C87D35C352D9582985	SHA256:7ED09F7D2BD632F70077A4AE4F2BD2F3FB654B03CD72652F51678B0C7D027F25
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-fingerprinting-track-digest256.sbstore		binary
		MD5:DAA7ABDB5ED1DBF8877F4028092E32F6	SHA256:B8F20B14AD5291B4528DF859129B301F367A9885F417F9807821D5A386352530
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-fingerprinting-track-digest256.vlpset		binary
		MD5:FA7667EEED0B53973506278ECE958E62	SHA256:0D55A21E6694FCE19F366F9E5351A02D215D378541DBC38DF68645B63B56D8BF
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-cryptomining-track-digest256.sbstore		binary
		MD5:D6C5C2E242DF3EC5FF8E17DD8EE15F73	SHA256:F0C6512E42F2732B3AA401F9AB4DF84C0A89C9755968B158796706A48B9F492A
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flashsubdoc-digest256.sbstore		binary
		MD5:22698B4CF784DBBAE2D583F00491D43D	SHA256:3849563088AE0677D61702A1310FDE26DE5DDD846D53037222D3EFE012197BF5
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flashsubdoc-digest256.sbstore		binary
		MD5:B9556D03AFF392142AD5691D2F867310	SHA256:CFD3909B41C1EE3CBCB8B7D2B1378065E7D3B543FFF1F2FB7A4F25C5FF41722C
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\social-tracking-protection-facebook-digest256.sbstore		binary
		MD5:58FBC7F7687CC8798AEA35B7066EB198	SHA256:3A2035AD8446C71242DAA9EAF3818B87F673D0429E4F5334621905B47A1C3DF5
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\except-flashsubdoc-digest256.vlpset		binary
		MD5:0C0D67875BD75A0227C02DD8529BA01A	SHA256:614BE0169EC36E67223EB9645A98DA66DBFDE5DFBB89BB064F428AAEABDD9D97
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-cryptomining-track-digest256.vlpset		binary
		MD5:7D532B89A987D92DEF1D7AABBAAD62AB	SHA256:7CB574BE3E783D6876740DBCA525D868677307A52DDDD67AC84665CCFAAE895E
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\social-tracking-protection-facebook-digest256.vlpset		binary
		MD5:86B1ACDBF1FC7201D0EB7C85EE75F5AF	SHA256:A0F4C83316CD66525F663CD72A2DC8BD1B2AA2E40D599B8B6F334D61C5D03098
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\social-tracking-protection-linkedin-digest256.vlpset		binary
		MD5:3303AA4BCB02D27F1A8B6AFF30C1DD9C	SHA256:6F33CCFCF9767B612657242C2819C325CFDF17B8D92224DB588A886F7EC2D26E
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\social-tracking-protection-twitter-digest256.vlpset		binary
		MD5:35D8FD43D868D7BBA7041362EB8101B3	SHA256:104C2467E4F7BC7CAC0CE0E456D5ABD8C192C2C8C44F7C9A38412A59ABDD1772
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\social-tracking-protection-linkedin-digest256.sbstore		binary
		MD5:3B11B562807FEF504FE671DED4D0E8CE	SHA256:9BF05ADC119CDD219347572787A9B7E18308C4465A8F440C34C697B2F5CD479F
2572	firefox.exe	C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\social-tracking-protection-twitter-digest256.sbstore		binary
		MD5:373411CEBF6E3BCB89D8BFA632409BF1	SHA256:C1D5B95B18FF02514BDA0EC7865D9468C3A89E5C3BA2EBD3D4284FD8FCD463D4

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1068	OUTLOOK.EXE	GET	—	64.4.26.155:80	http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig	US	—	—	shared
2572	firefox.exe	GET	200	34.107.221.82:80	http://detectportal.firefox.com/success.txt	US	text	8 b	whitelisted
2572	firefox.exe	POST	200	142.250.186.35:80	http://ocsp.pki.goog/gts1c3	US	der	471 b	whitelisted
2572	firefox.exe	POST	200	142.250.186.35:80	http://ocsp.pki.goog/gts1c3	US	der	471 b	whitelisted
2572	firefox.exe	POST	200	142.250.186.35:80	http://ocsp.pki.goog/gts1c3	US	der	471 b	whitelisted
2572	firefox.exe	POST	200	142.250.186.35:80	http://ocsp.pki.goog/gts1c3	US	der	471 b	whitelisted
2572	firefox.exe	POST	200	93.184.220.29:80	http://ocsp.digicert.com/	US	der	471 b	shared
2572	firefox.exe	POST	200	93.184.220.29:80	http://ocsp.digicert.com/	US	der	471 b	shared
2572	firefox.exe	POST	200	93.184.220.29:80	http://ocsp.digicert.com/	US	der	471 b	shared
2572	firefox.exe	GET	200	34.107.221.82:80	http://detectportal.firefox.com/success.txt?ipv4	US	text	8 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2572	firefox.exe	34.107.221.82:80	detectportal.firefox.com	—	US	whitelisted
1068	OUTLOOK.EXE	64.4.26.155:80	config.messenger.msn.com	Microsoft Corporation	US	whitelisted
2572	firefox.exe	13.32.121.96:443	firefox.settings.services.mozilla.com	Amazon.com, Inc.	US	unknown
2572	firefox.exe	104.16.18.94:443	cdnjs.cloudflare.com	Cloudflare Inc	US	suspicious
2572	firefox.exe	142.250.186.42:443	ajax.googleapis.com	Google Inc.	US	whitelisted
2572	firefox.exe	52.42.77.140:443	location.services.mozilla.com	Amazon.com, Inc.	US	unknown
2572	firefox.exe	142.250.184.202:443	fonts.googleapis.com	Google Inc.	US	whitelisted
2572	firefox.exe	142.250.186.35:80	ocsp.pki.goog	Google Inc.	US	whitelisted
2572	firefox.exe	104.18.10.207:443	maxcdn.bootstrapcdn.com	Cloudflare Inc	US	suspicious
2572	firefox.exe	104.21.78.7:443	use.fontawesome.com	Cloudflare Inc	US	suspicious
2572	firefox.exe	69.16.175.42:443	code.jquery.com	Highwinds Network Group, Inc.	US	malicious
2572	firefox.exe	13.32.121.5:443	firefox-settings-attachments.cdn.mozilla.net	Amazon.com, Inc.	US	suspicious
—	—	13.32.121.96:443	firefox.settings.services.mozilla.com	Amazon.com, Inc.	US	unknown
2572	firefox.exe	93.184.220.29:80	ocsp.digicert.com	MCI Communications Services, Inc. d/b/a Verizon Business	US	whitelisted
2572	firefox.exe	142.250.186.106:443	safebrowsing.googleapis.com	Google Inc.	US	whitelisted
2572	firefox.exe	34.213.133.213:443	push.services.mozilla.com	Amazon.com, Inc.	US	unknown
2572	firefox.exe	18.65.116.99:443	content-signature-2.cdn.mozilla.net	Massachusetts Institute of Technology	US	unknown
2572	firefox.exe	172.67.223.7:443	todosec.org	—	US	suspicious
—	—	142.250.186.35:80	ocsp.pki.goog	Google Inc.	US	whitelisted
2572	firefox.exe	13.32.121.15:443	snippets.cdn.mozilla.net	Amazon.com, Inc.	US	suspicious
2572	firefox.exe	13.107.246.44:443	aadcdn.msauth.net	Microsoft Corporation	US	malicious
2572	firefox.exe	54.190.2.244:443	shavar.services.mozilla.com	Amazon.com, Inc.	US	unknown
—	—	54.190.2.244:443	shavar.services.mozilla.com	Amazon.com, Inc.	US	unknown
2572	firefox.exe	18.66.97.122:443	tracking-protection.cdn.mozilla.net	Massachusetts Institute of Technology	US	unknown
—	—	93.184.220.29:80	ocsp.digicert.com	MCI Communications Services, Inc. d/b/a Verizon Business	US	whitelisted

DNS requests

Domain	IP	Reputation
config.messenger.msn.com	64.4.26.155	shared
detectportal.firefox.com	34.107.221.82	whitelisted
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82 2600:1901:0:38d7::	whitelisted
example.org	93.184.216.34	shared
ipv4only.arpa	192.0.0.170 192.0.0.171	whitelisted
firefox.settings.services.mozilla.com	13.32.121.96 13.32.121.70 13.32.121.7 13.32.121.6	whitelisted
location.services.mozilla.com	52.42.77.140 52.89.115.53 35.163.137.0 35.163.35.154 52.11.104.45 52.26.7.9	shared
locprod2-elb-us-west-2.prod.mozaws.net	52.26.7.9 52.11.104.45 35.163.35.154 35.163.137.0 52.89.115.53 52.42.77.140	whitelisted
ajax.googleapis.com	142.250.186.42 2a00:1450:4001:829::200a	whitelisted
code.jquery.com	69.16.175.42 69.16.175.10	whitelisted
fonts.googleapis.com	142.250.184.202 2a00:1450:4001:830::200a	whitelisted
use.fontawesome.com	104.21.78.7 172.67.214.69	whitelisted
aadcdn.msauth.net	13.107.246.44 13.107.213.44	whitelisted
cdnjs.cloudflare.com	104.16.18.94 104.16.19.94 2606:4700::6810:135e 2606:4700::6810:125e	whitelisted
maxcdn.bootstrapcdn.com	104.18.10.207 104.18.11.207 2606:4700::6812:bcf 2606:4700::6812:acf	whitelisted
cds.s5x3j6q5.hwcdn.net	69.16.175.10 69.16.175.42 2001:4de0:ac18::1:a:2b 2001:4de0:ac18::1:a:1a 2001:4de0:ac18::1:a:1b 2001:4de0:ac18::1:a:3a 2001:4de0:ac18::1:a:2a 2001:4de0:ac18::1:a:3b	whitelisted
use.fontawesome.com.cdn.cloudflare.net	172.67.214.69 104.21.78.7 2606:4700:3031::ac43:d645 2606:4700:3037::6815:4e07	whitelisted
part-0016.t-0009.t-msedge.net	13.107.213.44 13.107.246.44 2620:1ec:bdf::44 2620:1ec:46::44	malicious
ocsp.pki.goog	142.250.186.35	whitelisted
pki-goog.l.google.com	142.250.186.35 2a00:1450:4001:827::2003	whitelisted
ocsp.digicert.com	93.184.220.29	shared
cs9.wac.phicdn.net	93.184.220.29	whitelisted
content-signature-2.cdn.mozilla.net	18.65.116.99 18.65.116.85 18.65.116.14 18.65.116.40 13.32.99.117 13.32.99.100 13.32.99.116 13.32.99.50	whitelisted
d2nxq2uap88usk.cloudfront.net	18.65.116.40 18.65.116.14 18.65.116.85 18.65.116.99 2600:9000:225e:bc00:a:da5e:7900:93a1 2600:9000:225e:f800:a:da5e:7900:93a1 2600:9000:225e:7600:a:da5e:7900:93a1 2600:9000:225e:2400:a:da5e:7900:93a1 2600:9000:225e:2e00:a:da5e:7900:93a1 2600:9000:225e:4800:a:da5e:7900:93a1 2600:9000:225e:b400:a:da5e:7900:93a1 2600:9000:225e:e200:a:da5e:7900:93a1 13.32.99.50 13.32.99.116 13.32.99.100 13.32.99.117	shared
safebrowsing.googleapis.com	142.250.186.106 2a00:1450:4001:829::200a	whitelisted
push.services.mozilla.com	34.213.133.213	shared
autopush.prod.mozaws.net	34.213.133.213	whitelisted
todosec.org	172.67.223.7 104.21.78.148 2606:4700:3031::ac43:df07 2606:4700:3035::6815:4e94	whitelisted
firefox-settings-attachments.cdn.mozilla.net	13.32.121.5 13.32.121.102 13.32.121.84 13.32.121.24	whitelisted
fennec-catalog-cdn.prod.mozaws.net	13.32.121.24 13.32.121.84 13.32.121.102 13.32.121.5	shared
snippets.cdn.mozilla.net	13.32.121.15 13.32.121.85 13.32.121.49 13.32.121.112	whitelisted
d228z91au11ukj.cloudfront.net	13.32.121.112 13.32.121.49 13.32.121.85 13.32.121.15	whitelisted
www.youtube.com	142.250.186.46 142.250.186.78 142.250.186.110 142.250.186.142 142.250.186.174 142.250.184.206 142.250.184.238 216.58.212.142 142.250.185.78 142.250.185.110 142.250.185.142 142.250.185.174 142.250.185.206 142.250.185.238 172.217.18.110 142.250.181.238	shared
www.facebook.com	185.60.216.35	whitelisted
www.ebay.de	2.18.234.244	whitelisted
star-mini.c10r.facebook.com	185.60.216.35 2a03:2880:f12d:83:face:b00c:0:25de	whitelisted
youtube-ui.l.google.com	142.250.181.238 172.217.18.110 142.250.185.238 142.250.185.206 142.250.185.174 142.250.185.142 142.250.185.110 142.250.185.78 216.58.212.142 142.250.184.238 142.250.184.206 142.250.186.174 142.250.186.142 142.250.186.110 142.250.186.78 142.250.186.46 2a00:1450:4001:813::200e 2a00:1450:4001:809::200e 2a00:1450:4001:82f::200e 2a00:1450:4001:808::200e	whitelisted

General Info

Potential Phish_ _External Email_ New Encrypted Fax Notification.msg

9E5D490DA83A5E847A03F0473C11C5B5

557C1FFAEB5A515429B0FB143747802757E23650

90E58E654D07BB2F13B6EBE3CA124098C61DA1C503500606A0FC8ADDF204BB76

3072:B1ImZAENr2G69FXvQRNnbBWHg1HFqXvQ7:xNiGWWRNMaHF7

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Checks supported languages

Reads the computer name

Application launched itself

Manual execution by user

Reads CPU info

Searches for installed software

Creates files in the user directory

Creates files in the program directory

Reads Microsoft Office registry keys

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests