2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
SessionHash
1EAAC68BEF1ABE20406450D2EA76120923784B9266859FB8642161F7565573DB
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
RegFiles0000
C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME06.CSS
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
RegFilesHash
5938DCCEDD63A1230096B5B73F3051E7BACF56FAEEE37869D8B2443460C39EAC
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
SessionHash
3A0B1A0B5F86BEB8724CD47069C972EFCB75E47EF1FC295997FFD4F4555D52F1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
RegFiles0000
C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32B.GIF
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
RegFilesHash
D7C7FA853971F672BEFB0E7C94E8040C3374935B361C5E25DCE1E8963B832B9B
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
SessionHash
7F34FF5F0AF4B029928C4A56B29B982F0F9AABDE398CEC7060507B3B87988231
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
RegFiles0000
C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44B.GIF
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
RegFilesHash
5F94DECA72E95EE7BDA84FFE14C78DAD2F11AA3862AEC22DFB684C026159CF13
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
SessionHash
B59C2C6726CC53139CEE88F6E53F78576ADC41ABCABB1C1A9553A7773DF711DD
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFiles0000
C:\Program Files\Microsoft Office\Office14\1033\XLINTL32.DLL
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFilesHash
3D86AC1C82E67AC63B1A91DBAEA2594646AEADA867726902BDD45F52AF12FAF6
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
SessionHash
EBA0C4DFB1C91C6A552C852B94434784EE3B6E308FA3E2014986F0B8B1D4A0B7
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFiles0000
C:\Program Files\Microsoft Office\Office14\CSS7DATA0009.DLL
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFilesHash
BE399122495FC07FD210739C7D694E2836C8790E22206FBDE38361C336E6E61C
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
SessionHash
9ADA829FD071FD0B6A832239E77672A166E782BCAB1A966092AB00852341D8FC
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFiles0000
C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDCNCLL.ICO
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFilesHash
C0D7CCFA04C0816AFB2B0962DDF799E592820867FD675DAC707BBB1352F1AE86
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
SessionHash
E5B480BB6CD655199349E004372FE517D194812C9A74CBC02A98B1AEF9A18C9A
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFiles0000
C:\Program Files\Microsoft Office\Office14\GKPowerPoint.dll
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFilesHash
2334A67319197DD8F4EA8228FC418A16A01C11FDFC8F6E571EDD5BC3515A1CF1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
SessionHash
341BF6A18C3D1DD81F40CCF563713B080837CCC61C4126C69195EE1ECD6CE8D6
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFiles0000
C:\Program Files\Microsoft Office\Office14\mscss7wre_fr.dub
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFilesHash
66F6E2FBF7D84954E749B784FA6987CB9187DB78F1E4AFFAA7D81A7049E105A9
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
SessionHash
7505EA8FDD3C7B0B17B629B5C7F99C658979A5EAB9FC9A25C0E9EB6C7D8E5807
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
RegFiles0000
C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.NZ.XML
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
RegFilesHash
E655E8535E35F2EC0888072541D2243CA3018619516D0EA479D5EA0CE965EEE4
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
SessionHash
B7D706EEE332DAB9F75B4E1653D6D395B909A101E4DB0CD2B5BFDD70C630DEDA
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFiles0000
C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL078.XML
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFilesHash
DFF27D1AD79B2E39BC60A873AB7A940F0B5DC694BDB094EA7B09323DF69B6FC0
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
SessionHash
163AC7E0CA43AB57DD18A9F36B94FE4ECB94B735D69F98D9D177B5CBB082A42B
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFiles0000
C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN002.XML
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFilesHash
FFF25BF1FF57F9F89F104E96F01E4A646BA147E0E908E49A8B499FD9242F9830
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
SessionHash
3792C8F84BC1EF4F1234D43DC42B15CD22911F3289A31FC3F73029A3F787735F
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFiles0000
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFilesHash
4229DA800407D064ABF58C9232B0F047E9E1D085F60E0BE4CBC8D175AB22370E
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
SessionHash
E85C62AC76441EB1E1DDD3E664FA2EE4681028CA7D504FC949A4FA3DA77B6FF3
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
RegFilesHash
9415E3F905AF44D1D6EE98775BE3E1B665AB48A846D75670B73E7936F86DF2F2
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
SessionHash
1A63EB7AADD5D1C8499815FC6C3FF7B9269DDD8A1449D94E777DB6E415B6A6C3
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
RegFiles0000
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
RegFilesHash
DACDAE154F9451B9B802BA39FB8F105BDD6C185BD4DB04DF877832A8A4FC61CC
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
SessionHash
B69F50A3ACAC9941AE8DA7CFD09BE8CCA971AAA31AE85A49285995466C04CF42
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
RegFiles0000
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
RegFilesHash
7F8AB1A1A2310D250C0872842E767F5156EBBB8B3681EE8C0F3A8CF89ADC1D29
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
SessionHash
7678228441CBE8FBC0AC891096E598C4884214B0313D18FEB7BFB09A635BA324
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
RegFilesHash
C3FF3384EADC6CC03ECA5CA690340BB0C54FE1645888592750922C959B0E1C32
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
SessionHash
1562E7E5484A77304DEA569F39B936418DB3989D0DC48FFF8E08679E0B9C814E
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
RegFilesHash
D1B74809D0EB008047EECB9E7F39062CEC1B341E715858A85FE9C9678F8AF0A3
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
SessionHash
5B8142D20188563382FFE3573F2C06420E5649085F4464C4D2D7676EFD77500E
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SIWW.cab
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
RegFilesHash
B1DF6FB66F4F0BD3EB57D6A6519586DF8A8CFAE44E0B497CB347C9EF480AE618
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
SessionHash
C66EB973B3877D572A160EB8BCC567172BE2CBCB5F25D77B7F00F6E855CF82AB
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
RegFilesHash
5E2AE91DD0CC46996BB1846696078A172DFB91C27A761F0D9996BAEC7DA1B662
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
SessionHash
072A11D2463413958B032EFC84DB7BF54E68250146ED27B29ED67F6CF887B96A
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
RegFilesHash
C9D14C10E61E03BD8DB5008B13D8DB207EC91BEB0D7D6452021DD1C32E1AC984
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
SessionHash
1176BF0D6C6DB1AFDF57B7D90E6A60F9D29B0E007B56BCE7827FEAE33E55EB4F
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFilesHash
85AD51CFD22F6D34ADCCAACEB86471ABDEDADA97E168A2900B59CD3F0B3FDED6
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
SessionHash
3D1C66477AB41D8694A7F6C4F75A8EF50A48355A723DD4B12D2D768ADE61805A
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\PidGenX.dll
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
RegFilesHash
6E9CF5339F3918780D1605066EE4FA04291D4CB20E3B9FFD8454767CA249BF98
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
SessionHash
A9B513BE4907AB9CD9819D7F9FEB4E987335D22BDEC3491EB347084979E0A431
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFiles0000
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFilesHash
0742E12B64F22C74B48D314B5B85A3ECC411E3ECF23A7AA5E39DE4013F1B627E
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
SessionHash
19656A53B4F30DF8BA203B311B8AC55A1A0039E36B15EE6C4AE5DDE2FBBF71E3
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
RegFilesHash
093AD121129FB038D5EC95C3DDE6D5E29026E6D135E88252641B44B8EA91F1BA
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
SessionHash
C580F6030259D27CB25EA43304FFE46890D41290C23901E9D4F2628509B1F6BE
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
RegFiles0000
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
RegFilesHash
7CD458A5733BAEFFF697E8A3E6D6A5C692040E167C78F84FE934F02F5803B937
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
SessionHash
0D4AF1A54EC69833BB996C5B8941883256933E0AE3F074EF7927D5E906F5E069
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
RegFilesHash
EC88B6154F8F092882F8AA862C767FA1D3B829D91DC9C07A93CD2C752B267FCE
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
SessionHash
B88B1128BE4CC025C596C7BC674F6513FFBC8A8FB9FB9C0DE367CBC9A1ECBF9C
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
RegFiles0000
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
RegFilesHash
A764B7F54591C790C545545B2A5AD5D43DA66420323CDC734F8C0DD02E3619BC
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
SessionHash
2F6095BF7767DDD109BDFB535982CF30C6895513802D59407C1D88ED724B6962
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFiles0000
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFilesHash
87AD7BCE5B823E2AD3388852DE405E060D8D7AA5566E9D7513F43C19C31FD464
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
SessionHash
67543AAF56E656C4413E974F09192EF5FEEA5B83D02AEE8909D2FEA82ACF2FD4
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
RegFilesHash
16CA44C2483FA0AA46B8C02139C71162F9EF867C7E4D70A3F1685347917EE6B4
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
SessionHash
1D27DBD9776E40D148D17C32661F3F09F99DCB54B80FDEADC0D92526CB98E64F
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
RegFiles0000
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
RegFilesHash
69D36127366709BC1815A98171B1A4D5617A718F25F406644FC6EC2115308686
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
SessionHash
E330065CA1361FC039875FF1844A28EF6D4101186C60318B7FF0818F3899B6F8
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFiles0000
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFilesHash
CBD4A7E5BB0C4F6FFC7620A9263619DC357B912232F4447839CB13E6EF7C98C8
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
SessionHash
023AD3E28E3D3FD012E4DA9D685A855E0FB8F432C7ECC06420B5B06057AA5F33
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFiles0000
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFilesHash
E51B31535C10ADEB0899BE09D6E11F071480D9517A1C511047E0D1FEC7A0A584
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
SessionHash
2F8E6E6EDD552AA294AF5853369ECB3BB42A374901F4C2DB4E0148A0723A305A
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\setup.exe
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFilesHash
E52100353468E91596191A7F4804B271D12C6E8C074C49620506F51BEE467A03
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
SessionHash
637A54033D334E0EF9E2892ECB85BB6605356749F7D9ACFF96D7CEF61FCAC250
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFiles0000
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFilesHash
02EA62E2C6D2623E7EE1380F47E485A19138D02011EC7268048DA61A868F6D46
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
SessionHash
862055B352B04C03CF783863A7E3498D7136F3050A1AF040933E087486543020
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
RegFilesHash
F6D64812B3203FCFB66C84A357A2DB84A8E1DFCF9653C25A01041F3271758F5E
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
SessionHash
FFA743C41BACDABA6484725108565104B7294BE28D98986EC5972703FF86809E
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
RegFiles0000
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
RegFilesHash
A6186BA067F49F44D3DE16F07E7027B491C6C6C8CA454E92F938F6887D24BBE0
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
SessionHash
B0A45F73AD8F022AF185F2B642E91536443533420CA93E7EF0C5F5B41B916FEB
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SingleImageWW.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
RegFilesHash
578AFFE769A1039E14784DF9F705C50AE52ECFDD6D38F9F8A68966286510A6A5
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
SessionHash
2405510ABC2CC96B9D69A6C363497808936D4428E166E76A0A0203B8169B1E18
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
RegFiles0000
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
RegFilesHash
FC89A1AA43B42745FF8A75C503A8E7C8041B36AEFB19DB363717071DF9103B87
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
SessionHash
FAB6119BE1C53809E0FA4A3D67A14497B310EC74CDD7B730AB6AE826710103B8
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
RegFilesHash
0F3B596168365447F64F07332A8EB6348E2BFD370210337BFD7C9B4CBC0BC55E
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
SessionHash
52DBDFD419D2E38D54D5C6B7DF430CC7E6A31A2F6441BCBAC2C05082D1965392
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFiles0000
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFilesHash
AD6D7C05A1B0A444E8F95CA97CD667DCA967A07FC1E8A7F274C09898AD5F072E
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
SessionHash
B10CD5401E4FD1745ADDC4C914528D2A730FD9188CE191EAF6C2E7C48C9644C1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\OWOW64WW.cab
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
RegFilesHash
2B739F019EBE258D98D40D66591A4305C290B8E9A3BAB404923A68FF23C9F859
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
SessionHash
FED03208ECF7CD66AD4430F34A8564AD626E7B075CA86E6A38535506A57662E4
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
RegFiles0000
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
RegFilesHash
21E6E2D33150A9B3907CC19A4500899E9E374B1A6A612BC1C58748F1CD1BA309
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
SessionHash
20CF88821F9F65F12E57257D41B9B21FFF97033435E9605D7F0BA5190EFA9B30
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
RegFiles0000
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
RegFilesHash
49108677F43055A06DDBB17395E3F33D3449E43F6F309D7F51F729F4F78F7314
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
SessionHash
15CA0AF77815681BA5B82E9901034AD1005608663E00418D37D25B4BC949A2C2
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFiles0000
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFilesHash
D6CACB9B3CCFAB0B6EE20914E23A26CF7EF17F7D7D4322B912E3C89DB819DC8E
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
SessionHash
74A6D384577FBD49D92C9801E5C4CFBC59ACD4982FB211C8142084BBD79B5C8B
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFilesHash
F12B21418071EB722D5B24C81FECBCFBA25F90398777D56720EEA8B3AD4FFD61
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
SessionHash
F1FFFC375D37DFF566A263EC45200ECBED11A24445705808413844B973DF414B
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
RegFiles0000
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
RegFilesHash
FF2FE65BFA469120B89108FC168C6E2A9AF3E44A86772CCF5F4A3E492D602B52
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
SessionHash
BA5BEE29EAF451C18E8503179AD9F0258A8BB06F1839FB8A78382A15851A4431
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
RegFiles0000
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
RegFilesHash
7B9FD59713B004907BE9B98E21C5A497EE291B2EA407A1C115AF5D8C3BFEA251
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
SessionHash
67679686B3FE63AF8E42518B2911E6E9913441E4CC8A9326AEA92888E8B5D8A1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
RegFiles0000
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
RegFilesHash
9B4B1C274F91B6A60C057BF5D76175EE2198BEA1062442BA160173BB3C48D72B
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
SessionHash
F8889C5298DEE25FF717979EA414A3E7E5065E75E3F04912A7B4EEAE2487AA46
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
RegFilesHash
1A2E0A9B7D7C442B231A24B647DB4576C2DAAA334BCEEB4D239FBDF6FDD8819F
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
SessionHash
68E020CC93D67E1E00F2E960FE78BCFA063FDCE5B5BC4A9505CC37C20A1F6012
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Office64WW.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
RegFilesHash
05FB9F011582CB1A9CF0FEFE9385A8056767EA2C35170F6F525749CAB0985CA0
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
SessionHash
8F6D8F84D34168D6F1D10E52950C67B30C58334EDA1B4F8AD9E5E3606E6DB969
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SIWW2.cab
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
RegFilesHash
AFE8310B0F3E53CBB57218C2D1FBF136CE65FF05C421F5E93B97DBAADE5BBBC3
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
SessionHash
6970251F505DC666901B9EA04CED62B78E6F6AE4E5C82CEE93F15E916B30D452
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
RegFiles0000
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
RegFilesHash
38A07B458574181165E76DA5DAA673ACF09E4C536A86B346BB5A3D4CD58C9960
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
SessionHash
1EFA6EF58CEF61E28C232EA3ED13073BABFBAE26C7DEDC63CD0D039E37DB7C7B
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\osetup.dll
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
RegFilesHash
B194A2D5F2A6B7146D4C6DBCAF80F775E252F0B52388BF630A80A570624C9A7E
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
SessionHash
B9943A1740F034BAFBE21714DE53E0EEDFAB4687F64C7B3D3A7239919FA662FD
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
RegFiles0000
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
RegFilesHash
7CD71B04A41CED0CE4871458783CE8BC9F990666C36C16BCA4663F8292E940C5
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
SessionHash
7035CA36EEEE72BEA684CF352FFE62C9B64D93EDE93ACED23BB990F406740E8E
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFiles0000
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFilesHash
15BDF03CF669FBDED53FD2D9E155E75DB37A11D7B4DED9E681FCFE0DAC81B73D
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
SessionHash
FDD6292A9972902FEAB138C6687BB105728F8413E8C917E37F0DA3C65A816804
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFilesHash
470312B6D8B627B5C8DAB0D3C63232BAAF021D45B8D71C5C7C13095C3C534DDC
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
SessionHash
1F68FA7B43489D8CFC1E7ECFB39B1CE2039C6271D90163BEBA9C073EA378CC41
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFilesHash
0CB3215B032786F6D4FCF1E3963FCDA51477C5166A2D270BBDA2A9298B36AA5D
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
SessionHash
43BF6D71F8D9BE334D86D23523EC31AA029EF17CD46ED18FA3B8A20E493DB77D
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFilesHash
7C6D28A44288D7CF1CF9230C2E73801F022EF29B6AEEF831398DBDD707290828
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
SessionHash
8C19A4288B39BC1188CC9D82CA94EAB069244F34045E3820C3D21F55CB61B887
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Setup.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFilesHash
15C767A6A75715A5E4F6B70283CA60201893AC907C8072AD364566FD1F8A0DD6
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
SessionHash
82B4D69A3F152E14DF0BAAB233D15780692331E032B1FB29742098979E46C616
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFiles0000
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFilesHash
7D61B81AF261D114F247D14F3F38A36602778C80112FD910A1D2632DEB21917D
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
SessionHash
E007C6D82ED5D2B36C883E8CFCA8CC5309735E15374E14383548766AB89CE2B4
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
RegFilesHash
B1878833F4505FD35A76EFDCBAFB67E94337418E99E7FC86FF8C361CE5939BF2
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
SessionHash
4AC1E88DAE99DF3645D0D24FD08233A01BB0F378DD98A776011426498CE0C85B
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
RegFilesHash
30132B0BF32DAE15481AD91F6CE783362E5FC0C153775A0917410D13AC14E63C
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
SessionHash
16861937C80D221210CDE91751C14DC48FC729963F0821658DFA93A8C59FC125
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SingleImageWW.msi
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
RegFilesHash
360C725A223AD11619F610538C8D29B03E751BCBD710D2EB62431CAF48792D7B
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
SessionHash
C70878C51A602353B77A5EFCFF10ED8AB6ACE95B72E5F4F4D988C5631B5A642C
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
RegFilesHash
63F6C304D280CFA4B4FA4983CA4FD115F0B3CFCFFC226F0261A505E587F4B331
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
SessionHash
6E88C58D05538C9A000FE4B597B6B15AB16D5A352057BD77C6642D5B5EC28F8A
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
RegFilesHash
6C552025D7744E53A78AB95E993E15E6A45B948A1D93DF817B42B44C54763D37
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
SessionHash
7EF57B63641E01F9D211C705FBD34B41FD45136A5339AFC77E6859CA75144A53
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Office64WW.msi
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
RegFilesHash
CB6304DC7656CEE55324AEF8889EF925D4C82043BED398DA33AB857B30FD27B0
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
SessionHash
F48F5604C5CDC700979FDFFAC162F44141A938E59B7CA1AB02C05ACE3DD0E507
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFilesHash
71C8709AD9F7800F8D039C0F3B7481700568272DA136EE3F4D261672CFABB8A9
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
SessionHash
5442868D88C1A812180A4C73C6A346043F4CD40B34885EB889449F71E4B52CEE
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFilesHash
FB3C79A1EAAC970CCD67D34E08F5E38C1C743588BB3DAB30497DAD12E9C1A7E3
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
SessionHash
9ECA8FABF010DD74BEB7F782584E7B177015879C128D39A46D100318B1DFECA0
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFilesHash
F38FA0CC88056A90CA934DE3EB815FD185AF7FE0E22C520A60E152E7E4856E19
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
SessionHash
926320C957360D16F46B13B28F57814ECFB3975659C439980D002D581B76FFF5
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
RegFilesHash
ED458A089E908C078A33E92BA07BA4BDB1CD3716079EC0CFEB41F2283A80EA16
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
SessionHash
551BEF67330C80C564C8B1796117FE15AAB5F0CFE7CA1818A10D9639437ABD92
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
RegFilesHash
17AE0D8199E3E249EDD9191CBCB1AD9B24F07B952C40263BAB4AFE57C308A0A2
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
SessionHash
6193D2C39E45601796CC2213449619C1CAF5F4AD3943BCB407143FBF5C7FA249
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
RegFilesHash
01DDAA92BB3F6AEB975105D072CE0EC47CFAC9C99763DAE574D60637EF29B3A1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
SessionHash
FC0CB2391042E75E33C6BCEEDB3FB41D38EF200F2A847AC5DF2FB6FEA72C1322
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
RegFiles0000
C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\SVE\CPDF_Full.aapp
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
RegFilesHash
4E61BC734FDF7A2B1B1A68038C37872F8032F8F1CD5EFE71F44AD6F7B934BBA5
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
SessionHash
73FA482CE4100B46E4889B1A60AF06FA1949EDB8DC54CF2B43107A94B244169E
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
RegFilesHash
7114D998D7E99E171C1B5577D00ED30F49437C14DA416F84C9C02207490309E5
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
SessionHash
81C69972F935633B3DE1840B54B47E95FD08C30546CA4C3BFABACA1076925738
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195254.WMF
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFilesHash
984B9BDCF2AA0DBE572B0A675289E5CA573BE5BAAA9C5D8BC4BBD4B2D0398B93
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
SessionHash
405C664ACB28D445EE87BE51D3E3441E09B2AA6E41ABAF3BA43F917B7E40EA49
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198494.WMF
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFilesHash
93433987E3DB8A96D6A4347E01F0301DF1B602F15E2F9E92B221B748A90AAFBC
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
SessionHash
732C0A14A00C9F2C7E3CE2AC9674A01F3321F6888FFD85F0C7AAF2D1CA5CA51B
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0217302.WMF
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
RegFilesHash
C6D82C8E35B38E702AFCCE84D84815D7BDEA3FEF494916B6AA1DD2CEFF2F73EC
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
SessionHash
2C4C4D8885996691689A46F3FFD59A9BB76E68309B3E9872EA4CC3C698EBC79F
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFilesHash
91D784321F713BBDB3E050E5BA529B2118A43124BEE6B766B63AB9328F5AB1EF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
SessionHash
7668DED1AD777C1DA962757A03DDC787D9E362D32A5FC6E33E510837166B3638
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFilesHash
9227A85A4106822ECC044EF3D8C500D927456F210CF3C78700F870F7584C9087
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
SessionHash
0B730D4DF8740685C9395B6ABF868F1F1516248F75F9EB2559D161070F4BAA93
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFilesHash
185DEF8F31734F8B265FD8D5A1345A9218083D157B49471AE89986BB2C10CB1A
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
SessionHash
A24F2E97F444ADC245198D5218E631BABE91FF468BBD02C5689ADDD95F32C440
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
RegFilesHash
9B8B8335B9F5D78ED806DB159163CC5571C968EC900E883396322FA678D67F85
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
SessionHash
615F25D840093C87BE2D055BE2B45166361B01ED793FBC09B9E98B22CE8DE7EE
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
RegFiles0000
C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\FRA\EPDF_RHP.aapp
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
RegFilesHash
9308E6F53D2CB24BB23A459EA6711C1881026D936AE88B3C4DAABADB542DA7AE
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
SessionHash
85D5FE8B2AE616BBD48E1A2782AA639C1DD4088FEED05FA9A30948FDDBAF29E4
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152876.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
RegFilesHash
F1D1CC1CFB846125653094D9BA965EA2B35A20A8EA9A91187BCECA4EADB14E49
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
SessionHash
50F3F128A019B87451C361AB3159124ABF245E9CAD587F9760BC67C3FC9C82A7
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188519.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
RegFilesHash
2B85F40CB29E6CBFC34A0F1DAA4A5A24047E0029A1627AE818829C0DD95CEF0B
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
SessionHash
09ECE4BF37D2649A8DD516B91D084B6494D48572BEDF3CE8CC6780F9356AED8C
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0196364.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
RegFilesHash
1D4E1037B259821AEB9E5D364903C1598F6E13D91E65715B6F79C672BBC2687E
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
SessionHash
ED341D60998E437DF22A4DEE10E7AA2F5416B3C36323C5F2EAB7B3E20F1E26CB
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200611.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
RegFilesHash
70A90ADDDCA87AB8E0E5EB0AF4320D9BE282B6C98C6680EB81557405F308F2A5
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
SessionHash
3502D657B87690434B0A1EE9B2D59F00EC6C4E4F6A6E18DA49731714CC5055FD
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0230553.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
RegFilesHash
BBB2A373DF5296233F03031E05B1183F6680B7A1E996B0E721EEA40E39DECA66
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
SessionHash
3CF109A7D75E57581C951844734AB987DF9D75F692595BC26B8C3B476F942A10
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238983.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFilesHash
8CFD1DC0ACDF8FD0F292EE4AEDEEA0C132F9FCA28D5862B418F6312E5FDC7751
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Owner
38010000E0DD75A3FFF2D401
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
SessionHash
2073AB4E1AA8D6499AAED292CCB199C3EB367CF894E8DB288E54AFE549CB875A
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Sequence
1
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFilesHash
B830AEEF2C77F73334518BEB73D73EE8009D8DF7544D1FDB7ACA6063B01C3845
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
Owner
38010000E0DD75A3FFF2D401
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
SessionHash
83A4E63C77047200D4DAEF74BA877E5C144A6A6D99F3B7DA48217B353356AB2F