Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
lockbit_unpacked.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
C:\$WinREAgent\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\ProgramData\AAE7.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\ProgramData\HLJkNskOq.bmp
|
PC bitmap, Windows 3.x format, 1280 x 1024 x 16, image size 2621440, cbSize 2621494, bits offset 54
|
dropped
|
||
C:\Users\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\AAAAAAAAAAAAAAAAAAAA (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\BBBBBBBBBBBBBBBBBBBB (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\CCCCCCCCCCCCCCCCCCCC (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\DDDDDDDDDDDDDDDDDDDD (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\EEEEEEEEEEEEEEEEEEEE (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\FFFFFFFFFFFFFFFFFFFF (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\GGGGGGGGGGGGGGGGGGGG (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\HHHHHHHHHHHHHHHHHHHH (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\IIIIIIIIIIIIIIIIIIII (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\JJJJJJJJJJJJJJJJJJJJ (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\KKKKKKKKKKKKKKKKKKKK (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\LLLLLLLLLLLLLLLLLLLL (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\MMMMMMMMMMMMMMMMMMMM (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\NNNNNNNNNNNNNNNNNNNN (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\OOOOOOOOOOOOOOOOOOOO (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\PPPPPPPPPPPPPPPPPPPP (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\QQQQQQQQQQQQQQQQQQQQ (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\RRRRRRRRRRRRRRRRRRRR (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\SSSSSSSSSSSSSSSSSSSS (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\TTTTTTTTTTTTTTTTTTTT (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\UUUUUUUUUUUUUUUUUUUU (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\VVVVVVVVVVVVVVVVVVVV (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\WWWWWWWWWWWWWWWWWWWW (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\XXXXXXXXXXXXXXXXXXXX (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\YYYYYYYYYYYYYYYYYYYY (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\ZZZZZZZZZZZZZZZZZZZZ (copy)
|
data
|
dropped
|
||
C:\Users\user\Desktop\lockbit_unpacked.exe
|
data
|
modified
|
||
C:\Users\user\Documents\DTBZGIOOSO\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\DTBZGIOOSO\dElxyVy.HLJkNskOq
|
DOS executable (COM)
|
dropped
|
||
C:\Users\user\Documents\FENIVHOIKN\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\JSDNGYCOWY\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\KATAXZVCPS\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\LSBIHQFDVT\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\MXPXCVPDVN\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Videos\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\AAAAAAAAAAA (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\BBBBBBBBBBB (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\CCCCCCCCCCC (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\DDDDDDDDDDD (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\EEEEEEEEEEE (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\FFFFFFFFFFF (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\GGGGGGGGGGG (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HHHHHHHHHHH (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\IIIIIIIIIII (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\JJJJJJJJJJJ (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\KKKKKKKKKKK (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\LLLLLLLLLLL (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\MMMMMMMMMMM (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\NNNNNNNNNNN (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\OOOOOOOOOOO (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\PPPPPPPPPPP (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\QQQQQQQQQQQ (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\RRRRRRRRRRR (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\SSSSSSSSSSS (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\TTTTTTTTTTT (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\UUUUUUUUUUU (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\VVVVVVVVVVV (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\WWWWWWWWWWW (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\XXXXXXXXXXX (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\YYYYYYYYYYY (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\ZZZZZZZZZZZ (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\AAAAAAAAAAA (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\BBBBBBBBBBB (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\CCCCCCCCCCC (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\DDDDDDDDDDD (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\EEEEEEEEEEE (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\FFFFFFFFFFF (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\GGGGGGGGGGG (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\HHHHHHHHHHH (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\IIIIIIIIIII (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\JJJJJJJJJJJ (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\KKKKKKKKKKK (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\LLLLLLLLLLL (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\MMMMMMMMMMM (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\NNNNNNNNNNN (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\OOOOOOOOOOO (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\PPPPPPPPPPP (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\QQQQQQQQQQQ (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\RRRRRRRRRRR (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\SSSSSSSSSSS (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\TTTTTTTTTTT (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\UUUUUUUUUUU (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\VVVVVVVVVVV (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\WWWWWWWWWWW (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\XXXXXXXXXXX (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\YYYYYYYYYYY (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\ZZZZZZZZZZZ (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\AAAAAAAAAAA (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\BBBBBBBBBBB (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\CCCCCCCCCCC (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\DDDDDDDDDDD (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\EEEEEEEEEEE (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\FFFFFFFFFFF (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\GGGGGGGGGGG (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\HHHHHHHHHHH (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\IIIIIIIIIII (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\JJJJJJJJJJJ (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\KKKKKKKKKKK (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\LLLLLLLLLLL (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\MMMMMMMMMMM (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\NNNNNNNNNNN (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\OOOOOOOOOOO (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\PPPPPPPPPPP (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\QQQQQQQQQQQ (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\RRRRRRRRRRR (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\SSSSSSSSSSS (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\TTTTTTTTTTT (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\UUUUUUUUUUU (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\VVVVVVVVVVV (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\WWWWWWWWWWW (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\XXXXXXXXXXX (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\YYYYYYYYYYY (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\ZZZZZZZZZZZ (copy)
|
data
|
dropped
|
||
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini
|
data
|
dropped
|
||
C:\$WinREAgent\Scratch\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\ProgramData\HLJkNskOq.ico
|
MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
|
dropped
|
||
C:\Users\user\.ms-ad\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\3D Objects\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\46bYB87.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E3F7C98E-ABFD-4F9E-8090-D272080A4F30
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db
|
SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database
pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-journal
|
SQLite Rollback Journal
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-shm
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-wal
|
SQLite Write-Ahead Log, version 3007000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000000.bin
|
OpenPGP Public Key
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000001.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000002.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000003.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000A.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000B.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000E.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin (copy)
|
big endian ispell hash file (?),
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000K.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000019.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001A.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001B.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001C.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001D.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001E.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001F.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001G.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001H.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001I.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001J.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001K.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001L.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001M.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001N.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001O.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001P.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001Q.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001R.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001S.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001T.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001U.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001V.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000020.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000021.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000022.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000023.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000024.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000025.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000026.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000027.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000028.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000029.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002A.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002B.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002C.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002D.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002E.bin (copy)
|
PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002F.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002G.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002H.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002I.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002J.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002K.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002L.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002M.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002N.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002O.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002P.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002Q.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002R.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002S.bin (copy)
|
PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002T.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002U.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002V.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000030.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000031.bin (copy)
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000032.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000033.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000034.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000035.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000036.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000037.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000038.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000039.bin (copy)
|
PNG image data, 40 x 623, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003A.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003B.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003C.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003D.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003E.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003F.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003G.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003H.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003I.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003J.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003K.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003L.bin (copy)
|
PNG image data, 60 x 336, 4-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003M.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003N.bin (copy)
|
PNG image data, 40 x 617, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003O.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003P.bin (copy)
|
PNG image data, 50 x 600, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003Q.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003R.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003S.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003T.bin (copy)
|
PNG image data, 77 x 627, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003U.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003V.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000040.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000041.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000042.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000043.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000044.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000045.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000046.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000047.bin (copy)
|
PNG image data, 176 x 513, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000048.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000049.bin (copy)
|
PNG image data, 40 x 650, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004A.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004B.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004C.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004D.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004E.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004F.bin (copy)
|
PNG image data, 50 x 556, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004G.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004H.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004I.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004J.bin (copy)
|
PNG image data, 171 x 552, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004K.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004L.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004M.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004N.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004O.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004P.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004Q.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004R.bin (copy)
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004S.bin (copy)
|
PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000051.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000053.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000055.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin (copy)
|
PNG image data, 50 x 500, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000057.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000059.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005A.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005B.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005C.bin (copy)
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005D.bin (copy)
|
PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005E.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005F.bin (copy)
|
PNG image data, 39 x 600, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005G.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005H.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005I.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005J.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005K.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005L.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005M.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005N.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005O.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005P.bin (copy)
|
PNG image data, 39 x 579, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005Q.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005R.bin (copy)
|
PNG image data, 30 x 700, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005S.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005T.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005U.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005V.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000060.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000061.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000062.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000063.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000064.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000065.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000066.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000067.bin (copy)
|
PNG image data, 85 x 470, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000068.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000069.bin (copy)
|
PNG image data, 88 x 574, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006A.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006B.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006C.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006E.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006G.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006I.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006K.bin (copy)
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin (copy)
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006M.bin (copy)
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\header
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000001.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000002.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000003.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000004.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000005.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000006.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000007.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000008.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000009.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000A.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000B.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000C.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000D.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000E.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000F.bin
|
big endian ispell hash file (?),
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000G.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000H.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000I.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000J.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000K.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000L.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000M.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000N.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000O.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000P.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000Q.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000R.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000S.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000T.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000U.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000V.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000010.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000011.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000012.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000013.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000014.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000015.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000016.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000017.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000018.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000019.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001A.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001B.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001C.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001D.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001E.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001F.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001G.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001H.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001I.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001J.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001K.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001L.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001M.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001N.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001O.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001P.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001Q.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001R.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001S.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001T.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001U.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001V.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000020.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000021.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000022.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000023.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000024.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000025.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000026.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000027.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000028.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000029.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002A.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002B.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002C.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002D.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002E.bin
|
PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002F.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002G.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002H.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002I.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002J.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002K.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002L.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002M.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002N.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002O.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002P.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002Q.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002R.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002S.bin
|
PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002T.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002U.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002V.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000030.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000031.bin
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000032.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000033.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000034.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000035.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000036.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000037.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000038.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000039.bin
|
PNG image data, 40 x 623, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003A.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003B.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003C.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003D.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003E.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003F.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003G.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003H.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003I.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003J.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003K.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003L.bin
|
PNG image data, 60 x 336, 4-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003M.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003N.bin
|
PNG image data, 40 x 617, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003O.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003P.bin
|
PNG image data, 50 x 600, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003Q.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003R.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003S.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003T.bin
|
PNG image data, 77 x 627, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003U.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003V.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000040.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000041.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000042.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000043.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000044.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000045.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000046.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000047.bin
|
PNG image data, 176 x 513, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000048.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000049.bin
|
PNG image data, 40 x 650, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004A.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004B.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004C.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004D.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004E.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004F.bin
|
PNG image data, 50 x 556, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004G.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004H.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004I.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004J.bin
|
PNG image data, 171 x 552, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004K.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004L.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004M.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004N.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004O.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004P.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004Q.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004R.bin
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004S.bin
|
PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004T.bin
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004U.bin
|
PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004V.bin
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000050.bin
|
PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000051.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000052.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000053.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000054.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000055.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000056.bin
|
PNG image data, 50 x 500, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000057.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000058.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000059.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005A.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005B.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005C.bin
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005D.bin
|
PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005E.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005F.bin
|
PNG image data, 39 x 600, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005G.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005H.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005I.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005J.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005K.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005L.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005M.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005N.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005O.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005P.bin
|
PNG image data, 39 x 579, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005Q.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005R.bin
|
PNG image data, 30 x 700, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005S.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005T.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005U.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005V.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000060.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000061.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000062.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000063.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000064.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000065.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000066.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000067.bin
|
PNG image data, 85 x 470, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000068.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000069.bin
|
PNG image data, 88 x 574, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006A.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006B.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006C.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006D.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006E.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006F.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006G.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006H.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006I.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006J.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006K.bin
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006L.bin
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006M.bin
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
modified
|
||
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\Diagnostics\ONENOTE\App1711642759026090000_106DFC69-E3BA-4A7C-8657-0DB152D5B192.log
|
ASCII text, with very long lines (1299), with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\Diagnostics\ONENOTE\App1711642759027102300_106DFC69-E3BA-4A7C-8657-0DB152D5B192.log
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\SPL6755.tmp
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{03C0A865-8193-4A1A-8C11-BECD36F7DB5F}
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{04DFFEC8-99A3-4D7D-9869-9F9277C7FB39}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{08EF261F-5440-4C97-888E-2F1A67445C76}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{1853B891-740D-488D-A890-862B0B1D863B}
|
PNG image data, 176 x 513, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{1A05BEE4-1310-4284-8BDA-360A63D4EA39}
|
PNG image data, 60 x 336, 4-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{1A28C433-2EAC-42E2-92A8-525A078C3C34}
|
PNG image data, 30 x 700, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{21A15E50-9E78-40F3-AD6C-858414CFAD21}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{2252B1B6-7D87-4F49-8748-3132FEA4D05C}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{284BF59A-7564-4220-AE42-4452987735A0}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{29C8B759-D228-40CE-A230-FD5A7EC339A3}
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{2AA936F1-199C-4A00-81E3-0AB9DBD6CDB6}
|
PNG image data, 50 x 556, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{2B066BDD-66EF-4A4E-8E75-3C07C29BE33B}
|
PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{2C143CE5-33B7-4B9E-9FE8-392C15BDCB97}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{2E9040B1-BF1D-4F6C-8045-1D5433AC1283}
|
PNG image data, 40 x 650, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{329FA21E-ACAD-4515-9327-6A0389F27948}
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{3337A229-56A7-4C14-B334-AACE3F4CE24C}
|
PNG image data, 88 x 574, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{400CABFB-464A-4C9A-9770-ED2E64C13AF2}
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{4378286D-E42D-4F3B-9A03-A46B351218EC}
|
PNG image data, 39 x 600, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{4634D9ED-D923-4B90-A4A6-4DA82D2359B0}
|
PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{476E726A-BB45-4613-A754-06ACE1D1B340}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{48B5D939-67BE-495A-AF20-4AD8191FEE20}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{49C3A4D3-BAC0-4293-8850-799E19289AFE}
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{49C8249D-17B4-4F53-A84A-7EEFE849A753}
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{4D338F32-4F36-4BDC-B4D6-989CEEFB95E9}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{4DBEAADB-2A59-4B5F-B0AF-19AD6B40ABA5}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{50867978-051F-4E61-953F-DA0A3644068B}
|
PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{55C31EBD-6327-4A30-862E-291D227B83EC}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{563D528A-11A6-44FF-92C4-885DB54BBAB6}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{5662A036-608B-442C-BB34-87C6C88F92A1}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{5826F2CC-8ACA-4C13-9073-4B0286786C9A}
|
PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{60B173B6-2CA6-4919-8583-11DE0D9772CD}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{61E1DE1B-16F8-4620-9F81-A3D13DCB26CD}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{6283727F-818A-4D4F-8B8B-2B866FD16984}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{66BB7318-A26B-4A2B-A33D-1F0BD2AC4DA1}
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{686B13CC-944C-4303-A831-948A665F0FB7}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{6B13D270-69E8-4DA3-81BB-4E7899CD56FA}
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{6B67B82A-23B7-420A-B7DF-0A13FFD26FB9}
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{71166787-64D4-4FF2-BB2B-31E6585DB8F4}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{7289CAED-BF18-4D39-B954-C291E6589181}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{73984F18-F034-43E6-85AA-64ECE56E4D9C}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{763E56A9-4351-4B50-BD49-928B49F20FAA}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{7817DD0E-3FDA-4733-8964-34CA636E3A67}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{7924140B-0559-4F64-89AF-2E447A128842}
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{7931C8DF-08D3-469C-B701-00A3360F7157}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{7EF2E945-48A1-4AAF-92BA-D793D48E3587}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{83354BDD-D8CA-4D14-B640-ECF3548E4368}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{838093D6-29CA-476C-95F3-F2AE0E907F81}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{84C6D021-2044-49BB-A0DE-147C1A539DF1}
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{8D91468A-B2D0-48BA-B1B8-BAD7FD461EFD}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{8FB17390-C092-45BC-8F77-809801161E98}
|
PNG image data, 85 x 470, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{90423BD6-8BE5-4BC9-8926-F1BB31C34D06}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{926A35B3-FB5E-4942-A79F-BFE7EEC7219D}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{96087ED6-6731-4771-BCB9-7640AA2DBE1E}
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{9696475A-A79A-4C80-A865-461552A5CB14}
|
PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{97BB1E0A-A7B0-463C-9B3E-47F831FB549A}
|
PNG image data, 50 x 500, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{980A7261-745C-409D-9270-47AD0E50E411}
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{A101F26D-FE59-414F-9558-E940918111F3}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{A266AF3C-A1E8-4B7B-BD47-2194B6198FAE}
|
PNG image data, 50 x 600, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{A361967A-F992-483E-ABD4-9EF7A6B2B25E}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{A596B688-A9F1-4473-9A80-CA78529D85E8}
|
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139,
components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{AB5D6ACA-27E9-47BC-9912-11FE14E88842}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{ADA58423-FC51-450C-ABC4-F1A45D4B4C46}
|
PNG image data, 40 x 617, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{B08E7B17-0A23-45F7-B221-272A65D0B475}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{B27340F9-62FF-4917-80A9-10FBE58CBF03}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{B5165027-4848-4F70-B7C1-F7B97BC7156A}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{BD01F242-2BE9-4CAC-ADE2-D128C11EF4A7}
|
PNG image data, 39 x 579, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{BE06BDF6-81DE-445B-A00F-D3041F428682}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{BF5A7275-8B95-44F1-A883-B0069E38B4BB}
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{BF9D44E2-6877-4CDD-93DF-EB46531AF450}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{C0EB3C6F-A108-406D-91FE-BF35533B9731}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{C2CE07CE-FE71-4515-AB6D-4043DF72B203}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{C54291FB-F42A-430E-A455-03538926FC03}
|
PNG image data, 40 x 623, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{C821AF53-399C-4F2F-9EA2-30D645FB1F16}
|
PNG image data, 77 x 627, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{D2C8A452-8F61-4AE1-8D50-F0EF9F3B70C7}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{D462828A-B4AB-4FD9-B2EA-CBB941D5F52D}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{D4BD618D-0EF3-4B13-B231-ACD510B6898D}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{D50407C8-2CB8-4C5C-81AC-8D4189B30694}
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{D96BAEBD-7A6F-4702-AB0C-02EA47C793A0}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{E639CFD0-12DB-40F0-810A-1FB6A9F6A2F3}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{E70E3189-1921-4577-9201-0459B3FD09C1}
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{EA8A747C-831A-48F9-B42C-A7D6B89C7761}
|
PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{EB47A44A-21CA-4D3E-8062-CF07C6D2AB06}
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{F6D0ECDD-3C3D-4850-9209-2828017ECEB1}
|
PNG image data, 171 x 552, 8-bit colormap, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{F70131EF-1083-4AC3-BA56-1565017361F1}
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{F805F655-BDC5-4210-88E1-C10ED90AF533}
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{F86ADBD3-63BA-4F16-ACBC-3D5C709D2E79}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{FBF5FE42-FB0E-47F0-B33D-19F48BDD6B3E}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{FC7D440A-1016-4C3A-9E9A-ADE457CA4056}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{FCCA8720-D6A0-4459-9ECF-3093138E1F23}
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{FDFB09E7-66B9-4169-BBC1-5A9C0DB872A6}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\{FE4A89E9-4A65-4C8C-9100-2C05422A9DC8}
|
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components
3
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat
|
data
|
dropped
|
||
C:\Users\user\Contacts\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\0dQ66ai.HLJkNskOq
|
OpenPGP Public Key
|
dropped
|
||
C:\Users\user\Desktop\3GNmow7.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\7pP0App.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\9cCkux9.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\AIXACVYBSB\16CVaRV.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\AIXACVYBSB\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\AIXACVYBSB\RmoW6nm.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\AIXACVYBSB\XtNWV8p.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\AIXACVYBSB\bF9LZgG.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\AIXACVYBSB\hHmvCUZ.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\AIXACVYBSB\u4S45CB.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\B9dHP35.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\DTBZGIOOSO\FCuD6Gr.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\DTBZGIOOSO\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\DTBZGIOOSO\X9BYCVS.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\DTBZGIOOSO\cm4uNMp.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\DTBZGIOOSO\d7fvsjC.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\DTBZGIOOSO\hSHmmnI.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\DTBZGIOOSO\kQuFqeP.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\FENIVHOIKN\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\GxsZ3vG.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\IkSms7D.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\JSDNGYCOWY\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\KATAXZVCPS\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\LSBIHQFDVT\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\M4ZGyqh.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\MXPXCVPDVN\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\NHPKIZUUSG\7oQS4Cl.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\NHPKIZUUSG\CtsQb6Y.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\NHPKIZUUSG\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\NHPKIZUUSG\HmzEsLi.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\NHPKIZUUSG\f18wdWH.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\NHPKIZUUSG\qoRcOSe.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\NHPKIZUUSG\rv39z3I.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\O2AQHcF.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\OIy2J1j.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\Q0MnSe6.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\R2vAqpe.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\UMMBDNEQBN\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\VshWE0s.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\WJbqoxj.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\XGby1dV.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\XZXHAVGRAG\53QfVo5.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\XZXHAVGRAG\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\XZXHAVGRAG\NQYjoKg.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\XZXHAVGRAG\OogDJ38.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\XZXHAVGRAG\Qf6ysU1.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\XZXHAVGRAG\RvqgkSg.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\XZXHAVGRAG\a76T1AA.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\YPSIACHYXW\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\ZTGJILHXQB\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\b4FyorT.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\c8lytgw.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\cot6yAD.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\d9sST6W.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\lyJcZ1N.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\o8PhKbB.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\ob2RjiM.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Desktop\uQbQF3A.HLJkNskOq
|
OpenPGP Secret Key
|
dropped
|
||
C:\Users\user\Desktop\vALuLDm.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\4K0WamF.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\65qLeZg.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\6r2cRVo.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\847YcAS.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\AIXACVYBSB\0E3yJUk.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\AIXACVYBSB\2TKK8W1.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\AIXACVYBSB\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\AIXACVYBSB\NakLo3f.HLJkNskOq
|
OpenPGP Secret Key
|
dropped
|
||
C:\Users\user\Documents\AIXACVYBSB\ZixcgHZ.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\AIXACVYBSB\fpuiosh.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\AIXACVYBSB\i0DYj4T.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\DTBZGIOOSO\B0rtZkF.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\DTBZGIOOSO\L5IUMKj.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\DTBZGIOOSO\TSAcByz.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\DTBZGIOOSO\nR3juUa.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\DTBZGIOOSO\qELHCfX.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\DdWZX7A.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\DdYFwIb.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\E49F9qo.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\ERljUxB.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\FbAAVFR.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\JmS9fmj.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\LF4KXPi.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\MbATNY1.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\Mk1zWvG.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\NHPKIZUUSG\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\NHPKIZUUSG\UFELjiD.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\NHPKIZUUSG\XQuxiUC.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\NHPKIZUUSG\aOuecSU.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\NHPKIZUUSG\bz9o0cS.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\NHPKIZUUSG\oTKf9jl.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\NHPKIZUUSG\uORwct4.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\SDWWMfz.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\UMMBDNEQBN\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\XZXHAVGRAG\CDEIWRq.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\XZXHAVGRAG\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\XZXHAVGRAG\HuUUSUS.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\XZXHAVGRAG\K763kTw.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\XZXHAVGRAG\QNedPBy.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\XZXHAVGRAG\VS8qoan.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\XZXHAVGRAG\Ya1mlRw.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\YPSIACHYXW\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\ZTGJILHXQB\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Documents\dRkHAKW.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\ghmi8IQ.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\iEnsDmu.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\kUlZmAv.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\lnwg9ZQ.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\moo4lBc.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\rCvvZNe.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\rNDpdqS.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\ttjXe86.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Documents\xsn9qCJ.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\0f1Erbe.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\4XUCO2j.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\5FjnMH3.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\5yWEuDr.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\BgpUCvD.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\EGmp0bB.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\EnPTaKW.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\FwdSPIr.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\H8BA3Yt.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Downloads\LeyTFwt.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\NgxMN0p.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\QCiaqyC.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\Xrtfzys.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\aBm2fd6.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\eYDLM9n.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\gUGyh5D.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\iRPNAMj.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\irLd3wo.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\qKZQDAz.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\qtEzntH.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\xT8y39o.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\yVEM5iv.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\yWOZFIa.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Downloads\yz8una2.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\9He1CYR.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\AcUeR3j.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\EszqA9S.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\FlL33FG.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Favorites\Links\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Favorites\PB2xuoJ.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\VUrVDKV.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\WgIV9Sk.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\gGoI7ow.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\gVqYVqB.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Favorites\hZUBADj.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Links\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Music\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\OneDrive\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Pictures\Camera Roll\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Pictures\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Pictures\Saved Pictures\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Recent\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Saved Games\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Searches\AI5I5yl.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Searches\BjfqbZ2.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\Searches\HLJkNskOq.README.txt
|
ASCII text, with very long lines (1934), with CRLF line terminators
|
dropped
|
||
C:\Users\user\Searches\QAGBZeZ.HLJkNskOq
|
data
|
dropped
|
||
C:\Users\user\p6oifjl.HLJkNskOq
|
data
|
dropped
|
||
C:\Windows\System32\spool\PRINTERS\00002.SPL
|
Microsoft OOXML
|
dropped
|
||
\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON
|
data
|
dropped
|
||
\Device\Null
|
ASCII text, with CRLF line terminators
|
dropped
|
There are 814 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\lockbit_unpacked.exe
|
"C:\Users\user\Desktop\lockbit_unpacked.exe"
|
||
C:\ProgramData\AAE7.tmp
|
"C:\ProgramData\AAE7.tmp"
|
||
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AAE7.tmp >> NUL
|
||
C:\Windows\splwow64.exe
|
C:\Windows\splwow64.exe 12288
|
||
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
|
/insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{0D643B02-E56A-464A-8546-5C1D855FFE97}.xps" 133561163380990000
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
|
unknown
|
||
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onione5
|
unknown
|
||
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
|
unknown
|
||
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
|
unknown
|
||
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionug
|
unknown
|
||
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
|
unknown
|
||
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
|
unknown
|
||
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
|
unknown
|
||
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
|
unknown
|
||
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
|
unknown
|
||
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
|
unknown
|
||
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
|
unknown
|
||
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
|
unknown
|
||
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionedC
|
unknown
|
||
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
|
unknown
|
||
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
|
unknown
|
||
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
|
unknown
|
||
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
|
unknown
|
||
https://shell.suite.office.com:1443
|
unknown
|
||
https://twitter.com/hashtag/lockbit?f=live
|
unknown
|
||
https://autodiscover-s.outlook.com/
|
unknown
|
||
https://useraudit.o365auditrealtimeingestion.manage.office.com
|
unknown
|
||
https://outlook.office365.com/connectors
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
|
unknown
|
||
https://cdn.entity.
|
unknown
|
||
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
|
unknown
|
||
https://rpsticket.partnerservices.getmicrosoftkey.com
|
unknown
|
||
https://lookup.onenote.com/lookup/geolocation/v1
|
unknown
|
||
https://www.torproject.org/
|
unknown
|
||
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
|
unknown
|
||
https://api.aadrm.com/
|
unknown
|
||
https://www.yammer.com
|
unknown
|
||
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
|
unknown
|
||
https://api.microsoftstream.com/api/
|
unknown
|
||
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
|
unknown
|
||
https://cr.office.com
|
unknown
|
||
https://messagebroker.mobile.m365.svc.cloud.microsoft
|
unknown
|
||
https://otelrules.svc.static.microsoft
|
unknown
|
||
http://lockbitsupp.uzFFFFFFFFFFFFFFFFFFFFF
|
unknown
|
||
https://edge.skype.com/registrar/prod
|
unknown
|
||
https://res.getmicrosoftkey.com/api/redemptionevents
|
unknown
|
||
https://tasks.office.com
|
unknown
|
||
https://officeci.azurewebsites.net/api/
|
unknown
|
||
https://my.microsoftpersonalcontent.com
|
unknown
|
||
https://store.office.cn/addinstemplate
|
unknown
|
||
https://wwrproject.org/
|
unknown
|
||
https://edge.skype.com/rps
|
unknown
|
||
https://messaging.engagement.office.com/
|
unknown
|
||
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
|
unknown
|
||
https://www.odwebp.svc.ms
|
unknown
|
||
https://api.powerbi.com/v1.0/myorg/groups
|
unknown
|
||
https://web.microsoftstream.com/video/
|
unknown
|
||
https://api.addins.store.officeppe.com/addinstemplate
|
unknown
|
||
https://graph.windows.net
|
unknown
|
||
https://consent.config.office.com/consentcheckin/v1.0/consents
|
unknown
|
||
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
|
unknown
|
||
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
|
unknown
|
||
https://d.docs.live.net
|
unknown
|
||
https://safelinks.protection.outlook.com/api/GetPolicy
|
unknown
|
||
https://ncus.contentsync.
|
unknown
|
||
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
|
unknown
|
||
http://weather.service.msn.com/data.aspx
|
unknown
|
||
https://gdpr-info.eu/
|
unknown
|
||
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
|
unknown
|
||
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
|
unknown
|
||
https://pushchannel.1drv.ms
|
unknown
|
||
https://wus2.contentsync.
|
unknown
|
||
https://clients.config.office.net/user/v1.0/ios
|
unknown
|
||
https://api.addins.omex.office.net/api/addins/search
|
unknown
|
||
https://outlook.office365.com/api/v1.0/me/Activities
|
unknown
|
||
https://clients.config.office.net/user/v1.0/android/policies
|
unknown
|
||
https://entitlement.diagnostics.office.com
|
unknown
|
||
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
|
unknown
|
||
https://outlook.office.com/
|
unknown
|
||
https://storage.live.com/clientlogs/uploadlocation
|
unknown
|
||
https://login.microsoftonline.com
|
unknown
|
||
https://substrate.office.com/search/api/v1/SearchHistory
|
unknown
|
||
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
|
unknown
|
||
https://graph.windows.net/
|
unknown
|
||
https://devnull.onenote.com
|
unknown
|
||
https://messaging.office.com/
|
unknown
|
||
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
|
unknown
|
||
https://skyapi.live.net/Activity/
|
unknown
|
||
https://api.cortana.ai
|
unknown
|
||
https://messaging.action.office.com/setcampaignaction
|
unknown
|
||
https://visio.uservoice.com/forums/368202-visio-on-devices
|
unknown
|
||
https://staging.cortana.ai
|
unknown
|
||
https://onedrive.live.com/embed?
|
unknown
|
||
https://augloop.office.com
|
unknown
|
||
https://api.diagnosticssdf.office.com/v2/file
|
unknown
|
||
https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
|
unknown
|
||
https://officepyservice.office.net/
|
unknown
|
||
https://api.diagnostics.office.com
|
unknown
|
||
https://store.office.de/addinstemplate
|
unknown
|
||
https://wus2.pagecontentsync.
|
unknown
|
||
https://api.powerbi.com/v1.0/myorg/datasets
|
unknown
|
||
https://cortana.ai/api
|
unknown
|
||
https://api.diagnosticssdf.office.com
|
unknown
|
||
https://login.microsoftonline.com/
|
unknown
|
||
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
|
unknown
|
There are 90 hidden URLs, click here to show them.
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\Control Panel\Desktop
|
WallPaper
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.HLJkNskOq
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HLJkNskOq\DefaultIcon
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer
|
GlobalAssocChangedCounter
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\AirSpaceChannel
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\AMSI/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\DirectShowFilterGraph
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\EndpointMapper
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\General Logging
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Intel-iaLPSS-GPIO/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Intel-iaLPSS2-I2C/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\MedaFoundationVideoProc
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\MedaFoundationVideoProcD3D
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\MediaFoundationPerformanceCore
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-AppV-Client/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-AppV-Client/Virtual Applications
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Client-Licensing-Platform/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-User Experience Virtualization-Admin/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-User Experience Virtualization-Agent
Driver/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-User Experience Virtualization-Agent
Driver/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-User Experience Virtualization-Agent
Driver/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-User Experience Virtualization-App
Agent/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-User Experience Virtualization-IPC/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-User Experience Virtualization-IPC/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AAD/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ADSI/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-All-User-Install-Agent/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application Server-Applications/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application Server-Applications/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Inventory
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Telemetry
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Telemetry
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppLocker/EXE and DLL
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppLocker/EXE and DLL
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppLocker/MSI and Script
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppLocker/Packaged app-Deployment
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppLocker/Packaged app-Deployment
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppLocker/Packaged app-Execution
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppModel-Runtime/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppModel-Runtime/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeploymentServer/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeploymentServer/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeploymentServer/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppXDeploymentServer/Restricted
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppxPackaging/Performance
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ASN1/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AssignedAccess/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AssignedAccess/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Audit/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Authentication User Interface/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Authentication User Interface/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Authentication/ProtectedUser-Client
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Biometrics/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Biometrics/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Bluetooth-Policy/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BranchCache/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BranchCache/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BranchCacheEventProvider/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BranchCacheSMB/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BTH-BTHPORT/HCI
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-BTH-BTHUSB/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Catalog Database Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CDROM/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CertPoleEng/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Cleanmgr/Diagnostic
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Cleanmgr/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Crypto-BCRYPT/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Crypto-DSSEnh/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Crypto-RNG/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Deduplication/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Deduplication/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Deduplication/Performance
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DeviceSetupManager/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DeviceSetupManager/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DeviceSync/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-DPS/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-DPS/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-MSDE/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-PCW/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-PCW/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-PCW/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Perfhost/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-PLA/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scripted/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scripted/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Direct3D10_1/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DirectComposition/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DirectManipulation/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Dwm-Redir/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DXGI/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DxgKrnl-Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventLog-WMIProvider/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventLog/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-FileHistory-Engine/BackupLog
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-GroupPolicy/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Help/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-Hypervisor-Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-Hypervisor-Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Input-HIDCLASS-Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-Boot/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-Boot/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-Boot/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-Disk/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-EventTracing/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-EventTracing/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-IoTrace/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-LiveDump/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-WDI/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-WDI/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-XDV/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-KeyboardFilter/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-KeyboardFilter/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-KeyboardFilter/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-KeyboardFilter/Performance
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LanguagePackSetup/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LanguagePackSetup/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LanguagePackSetup/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LanguagePackSetup/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LDAP-Client/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LimitsManagement/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LiveId/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LiveId/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LiveId/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LSA/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-LSA/Performance
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-mobsync/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkBridge/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Networking-Correlation/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkLocationWizard/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkLocationWizard/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkProvider/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-PersistentMemory-ScmBus/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-PersistentMemory-ScmBus/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-PhotoAcq/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Policy/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Power-Meter-Polling/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-QoS-qWAVE/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-RadioManager/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Remotefs-Rdbss/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime-Graphics/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime-Networking/Tracing
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime-Web-Http/Tracing
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Schannel-Events/Perf
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sdstor/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SearchUI/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Security-Netlogon/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Security-Netlogon/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SecurityMitigationsBroker/Perf
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sens/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SENSE/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SenseIR/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SenseIR/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sensors/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sensors/Performance
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Serial-ClassExtension-V2/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Serial-ClassExtension/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ServiceReportingApi/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Services-Svchost/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Services/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync-Azure/Debug
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync-Azure/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync-Azure/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync-OneDrive/Debug
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync-OneDrive/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync-OneDrive/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync-OneDrive/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync/Debug
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SettingSync/VerboseDebug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SetupQueue/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SetupUGC/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBClient/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SmbClient/Audit
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SmbClient/Audit
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBClient/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SmbClient/Security
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SmbClient/Security
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBDirect/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBServer/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBServer/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBServer/Performance
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Speech-UserExperience/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-StateRepository/Restricted
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-StateRepository/Restricted
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-ATAPort/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-ATAPort/Diagnose
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-ClassPnP/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-ClassPnP/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-ClassPnP/Diagnose
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-ClassPnP/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-ClassPnP/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-Disk/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-Disk/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storage-Disk/Diagnose
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-StorageSettings/Diagnostic
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-StorageSettings/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-StorageSpaces-Driver/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-StorageSpaces-Driver/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-StorDiag/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Store/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Store/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-StorPort/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Storsvc/Diagnostic
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Subsys-SMSS/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Superfetch/Main
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TCPIP/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TCPIP/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TCPIP/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TenantRestrictions/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TenantRestrictions/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Troubleshooting-Recommended/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Troubleshooting-Recommended/Admin
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TSF-msutb/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TWinAPI/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TWinUI/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TWinUI/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TWinUI/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-UAC-FileVirtualization/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-USBHUB/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-User Control Panel Performance/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-User Control Panel/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-User Control Panel/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-User Profile Service/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-User-Loader/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-User-Loader/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-User-Loader/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-UserPnp/DeviceInstall
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-UserPnp/DeviceInstall
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-VDRVROOT/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-VDRVROOT/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-VerifyHardwareSecurity/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-VHDMP-Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-VHDMP-Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-VIRTDISK-Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Volume/Diagnostic
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Volume/Diagnostic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-VPN/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-VPN/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Firewall With Advanced
Security/ConnectionSecurity
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WorkFolders/Analytic
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WorkFolders/WHC
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WorkFolders/WHC
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WWAN-SVC-Events/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WWAN-SVC-Events/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\muxencode
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Navigator
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Network Isolation Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OpenSSH/Admin
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OpenSSH/Debug
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OpenSSH/Operational
|
Enabled
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\OpenSSH/Operational
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\SystemEventsBroker
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\TimeBroker
|
ChannelAccess
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Windows Networking Vpn Plugin Platform/Operational
|
ChannelAccess
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
|
12
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\ONENOTE\7852
|
0
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\Resiliency\StartupItems
|
~6!
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\onenote
|
Language
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\onenote
|
EcsRequestPending
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\onenote
|
SubscriptionCustomerLicenseInfo
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{C9590FA7-2132-47FB-9A78-AF0BF19AF4E6}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{C9590FA7-2132-47FB-9A78-AF0BF19AF4E6}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{C9590FA7-2132-47FB-9A78-AF0BF19AF4E6}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{C9590FA7-2132-47FB-9A78-AF0BF19AF4E6}\TypeLib
|
Version
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{2DA16203-3F58-404F-839D-E4CDE7DD0DED}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{2DA16203-3F58-404F-839D-E4CDE7DD0DED}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{2DA16203-3F58-404F-839D-E4CDE7DD0DED}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{2DA16203-3F58-404F-839D-E4CDE7DD0DED}\TypeLib
|
Version
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{1D12BD3F-89B6-4077-AA2C-C9DC2BCA42F9}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{1D12BD3F-89B6-4077-AA2C-C9DC2BCA42F9}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{1D12BD3F-89B6-4077-AA2C-C9DC2BCA42F9}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{1D12BD3F-89B6-4077-AA2C-C9DC2BCA42F9}\TypeLib
|
Version
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{627EA7B4-95B5-4980-84C1-9D20DA4460B1}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{627EA7B4-95B5-4980-84C1-9D20DA4460B1}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{627EA7B4-95B5-4980-84C1-9D20DA4460B1}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{627EA7B4-95B5-4980-84C1-9D20DA4460B1}\TypeLib
|
Version
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{452AC71A-B655-4967-A208-A4CC39DD7949}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{452AC71A-B655-4967-A208-A4CC39DD7949}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{452AC71A-B655-4967-A208-A4CC39DD7949}\TypeLib
|
Version
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{6D4B9C3E-CC05-493F-85E2-43D1006DF96A}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{6D4B9C3E-CC05-493F-85E2-43D1006DF96A}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{6D4B9C3E-CC05-493F-85E2-43D1006DF96A}\TypeLib
|
Version
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{8E8304B8-CBD1-44F8-B0E8-89C625B2002E}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{8E8304B8-CBD1-44F8-B0E8-89C625B2002E}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\TypeLib
|
Version
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\general
|
ConsecutiveBootCrashes
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\general
|
ConsecutiveEarlyCrashes
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\general
|
EDPLastRevokeCheckTime
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\Options\Save
|
BackupFilenamePostfixStartSP1
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\Options\Save
|
BackupFilenamePostfixEndSP1
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\Options\Save
|
BackupFilenamePostfixEndRerepairSP1
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\general
|
DateLastAttemptedOpeningLocalNotebooksOnBoot
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\Options\Other
|
EnableMemoryTrayMenuItem
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\Page Sync Status
|
PageSyncStatusPersistentData
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\Page Sync Status
|
PageSyncStatusPersistentDataLastUpdateDate
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\general
|
LastCacheFclRepairSuccessTime
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\onenote
|
BuildNumber
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote
|
Expires
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.1
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.2
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.3
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.4
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.5
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.6
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.7
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.8
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.9
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.10
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.11
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.12
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.13
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.14
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.15
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.16
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.17
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.18
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.19
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.20
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
1.21
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
VersionId
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote
|
ETag
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote
|
DeferredConfigs
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote
|
ConfigIds
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
|
RoamingLastSyncTimeOneNote
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
|
RoamingLastWriteTimeOneNote
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
|
0018800E82DB8EA2
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Volatile
|
MsaDevice
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\000061091A0090400000000000F01FEC\Usage
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\000061091A0090400000000000F01FEC\Usage
|
OneNoteNonBootFilesIntl_1033
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\general
|
LastMyDocumentsPathUsed
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\general
|
LastAppliedNotebookColor
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\onenote\general
|
LastNotebookSyncTypeLogTime
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-CH
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-GB
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-CH
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
|
en-GB
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet
|
msoridShouldUseReauthRequestProxy
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
|
SessionId
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\ONENOTE\7852
|
0
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\ONENOTE\7852
|
0
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\TypeLib\{F2A7EE29-8BF6-4a6d-83F1-098E366C709C}\1.0
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{C9590FA7-2132-47FB-9A78-AF0BF19AF4E6}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{C9590FA7-2132-47FB-9A78-AF0BF19AF4E6}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{C9590FA7-2132-47FB-9A78-AF0BF19AF4E6}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{2DA16203-3F58-404F-839D-E4CDE7DD0DED}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{2DA16203-3F58-404F-839D-E4CDE7DD0DED}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{2DA16203-3F58-404F-839D-E4CDE7DD0DED}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\TypeLib\{0EA692EE-BB50-4E3C-AEF0-356D91732725}\1.1
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{1D12BD3F-89B6-4077-AA2C-C9DC2BCA42F9}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{1D12BD3F-89B6-4077-AA2C-C9DC2BCA42F9}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{1D12BD3F-89B6-4077-AA2C-C9DC2BCA42F9}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{627EA7B4-95B5-4980-84C1-9D20DA4460B1}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{627EA7B4-95B5-4980-84C1-9D20DA4460B1}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{627EA7B4-95B5-4980-84C1-9D20DA4460B1}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{452AC71A-B655-4967-A208-A4CC39DD7949}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{452AC71A-B655-4967-A208-A4CC39DD7949}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{6D4B9C3E-CC05-493F-85E2-43D1006DF96A}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{6D4B9C3E-CC05-493F-85E2-43D1006DF96A}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{6D4B9C3E-CC05-493F-85E2-43D1006DF96A}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{8E8304B8-CBD1-44F8-B0E8-89C625B2002E}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{8E8304B8-CBD1-44F8-B0E8-89C625B2002E}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\TypeLib
|
NULL
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
|
FilePath
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
|
StartDate
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
|
EndDate
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs
|
LicenseCategoryInfo
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs
|
LicenseSKUInfo
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
|
RoamingConfigurableSettings
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote\ConfigContextData
|
ChunkCount
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\onenote
|
Expires
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\ONENOTE\7852
|
0
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
|
RoamingConfigurableSettings
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache
|
LastClean
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}
|
DeviceTicket
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}
|
DeviceId
|
There are 411 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
756000
|
heap
|
page read and write
|
||
41B000
|
unkown
|
page execute read
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
6E5000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
705000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
41B000
|
unkown
|
page execute read
|
||
756000
|
heap
|
page read and write
|
||
6DD000
|
heap
|
page read and write
|
||
6AE000
|
heap
|
page read and write
|
||
707000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
6E5000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
35BE000
|
stack
|
page read and write
|
||
2390000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2670000
|
direct allocation
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
707000
|
heap
|
page read and write
|
||
ADE000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
428000
|
unkown
|
page write copy
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2D8F000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
29CE000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
709000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
7FE10000
|
direct allocation
|
page read and write
|
||
9B000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
711000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2391000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6CC000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
74B000
|
heap
|
page read and write
|
||
709000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2B4E000
|
stack
|
page read and write
|
||
36BF000
|
stack
|
page read and write
|
||
DCF000
|
stack
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2F0F000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6D6000
|
heap
|
page read and write
|
||
445C000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
714000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
585C000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
305C000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2E0E000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
25DE000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2370000
|
direct allocation
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
705000
|
heap
|
page read and write
|
||
440000
|
heap
|
page execute and read and write
|
||
23D0000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
714000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
7FDC0000
|
direct allocation
|
page execute and read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
19B000
|
stack
|
page read and write
|
||
764000
|
heap
|
page read and write
|
||
3BDF000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
1F0000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
736000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
711000
|
heap
|
page read and write
|
||
73A000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2393000
|
heap
|
page execute and read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
465000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
23D0000
|
heap
|
page read and write
|
||
711000
|
heap
|
page read and write
|
||
4F4000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2DCE000
|
stack
|
page read and write
|
||
2391000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute and read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
406000
|
unkown
|
page readonly
|
||
705000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
A8F000
|
stack
|
page read and write
|
||
714C000
|
stack
|
page read and write
|
||
410000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
703000
|
heap
|
page read and write
|
||
41C000
|
unkown
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
24C0000
|
heap
|
page read and write
|
||
7FE40000
|
direct allocation
|
page execute and read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
73A000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
28CE000
|
stack
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2490000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
705000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
705000
|
heap
|
page read and write
|
||
7FE20000
|
direct allocation
|
page execute and read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2B0F000
|
stack
|
page read and write
|
||
73A000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
6CB000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
23A0000
|
heap
|
page read and write
|
||
736000
|
heap
|
page read and write
|
||
703000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
19C000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
4AE000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6DD000
|
heap
|
page read and write
|
||
6DD000
|
heap
|
page read and write
|
||
746000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
500000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
406000
|
unkown
|
page readonly
|
||
746000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
73E000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
714000
|
heap
|
page read and write
|
||
705000
|
heap
|
page read and write
|
||
714000
|
heap
|
page read and write
|
||
70A000
|
heap
|
page read and write
|
||
3ADE000
|
stack
|
page read and write
|
||
2562000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
77D000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2550000
|
heap
|
page execute and read and write
|
||
2670000
|
direct allocation
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
4CE000
|
heap
|
page read and write
|
||
736000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
703000
|
heap
|
page read and write
|
||
6DD000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
73F000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
420000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
304C000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
6A0000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
426000
|
unkown
|
page read and write
|
||
2553000
|
heap
|
page execute and read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
460000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6D6000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
711000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
405000
|
unkown
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2370000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6AA000
|
heap
|
page read and write
|
||
6D8000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
BDE000
|
stack
|
page read and write
|
||
6DE000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
404000
|
unkown
|
page readonly
|
||
780000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
54E000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6CB000
|
heap
|
page read and write
|
||
6E4000
|
heap
|
page read and write
|
||
4F0000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
4E5C000
|
heap
|
page read and write
|
||
24C5000
|
heap
|
page read and write
|
||
405000
|
unkown
|
page write copy
|
||
574000
|
heap
|
page read and write
|
||
2400000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6DD000
|
heap
|
page read and write
|
||
73A000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2391000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
41C000
|
unkown
|
page write copy
|
||
714000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2A0E000
|
stack
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute and write copy
|
||
6DD000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
2391000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
714000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
3A5C000
|
heap
|
page read and write
|
||
714000
|
heap
|
page read and write
|
||
781000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
28BF000
|
stack
|
page read and write
|
||
570000
|
heap
|
page read and write
|
||
6D6000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
73E000
|
heap
|
page read and write
|
||
560000
|
heap
|
page execute and read and write
|
||
2670000
|
direct allocation
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
70A000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
7FE30000
|
direct allocation
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
574000
|
heap
|
page read and write
|
||
6E4000
|
heap
|
page read and write
|
||
73E000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2C4F000
|
stack
|
page read and write
|
||
23D0000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6F4000
|
heap
|
page read and write
|
||
2391000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
73E000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
2C8E000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
714000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
4CA000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
736000
|
heap
|
page read and write
|
||
3D1F000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
73F000
|
heap
|
page read and write
|
||
736000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
9B000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
23D0000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
404000
|
unkown
|
page readonly
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
428000
|
unkown
|
page write copy
|
||
574000
|
heap
|
page read and write
|
||
2390000
|
heap
|
page execute and read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6C5C000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
41D000
|
unkown
|
page write copy
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6E7000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
711000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
705000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
73E000
|
heap
|
page read and write
|
||
6CB000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
736000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
71C000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
CCE000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
23B0000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
73A000
|
heap
|
page read and write
|
||
749000
|
heap
|
page read and write
|
||
748000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
625C000
|
heap
|
page read and write
|
||
705000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
742000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute and write copy
|
||
758000
|
heap
|
page read and write
|
||
756000
|
heap
|
page read and write
|
||
26B0000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6DD000
|
heap
|
page read and write
|
||
3C1E000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
724000
|
heap
|
page read and write
|
||
300F000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
758000
|
heap
|
page read and write
|
||
6D3000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6F4000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
4C0000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
6D6000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
752000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
705000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
77D000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
67E000
|
stack
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
||
574000
|
heap
|
page read and write
|
There are 541 hidden memdumps, click here to show them.