MalScore

100/100

doc.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 21/69 Related 2098

File details Download PDF Report
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size:	479.50 KB (491008 bytes)
Compile time:	2018-08-13 12:59:03
MD5:	c28cd37019c977a5a411bf72607e0a3e
SHA1:	19e5f78ea897b2665057a8f69b6f049db5e400e0
SHA256:	9c8d938fa26b1e84b232b42fa28ec29a4ae1346096da76bba7e426acb8b14ba6
Import hash:	f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3	.text .rsrc .reloc
Directories 4	import resource debug relocation
First submission:	2018-09-27 04:09:10
Last submission:	2018-09-27 04:09:10
Filename detected:	- doc.exe (1)

URL file hosting
hXXp://ilovepdf.us/doc.exe

Antivirus Report
Report Date	Detection Ratio	Permalink	Update
2018-08-21 04:02:23	[21/69]

PE Sections 1 suspicious
Name	VAddress	VSize	Size	MD5	SHA1
.text	0x2000	0x5534	22016	4ffbd41a83fd9528777d3a8724c054a7	611b481c7719724363e762dbaf2829816925fe77
.rsrc	0x8000	0x592f0	365568	cc0a756d99627e290ba6617e9e4589e4	36391912f984a48a095292d1774ce9e67774dc3d
.reloc	0x62000	0xc	512	e2805542f078cfd66f7be1498396a527	d531142c4674dde236d44aa819cf73ebbc235f34

PE Resources
Name	Offset	Size	Language	Sublanguage	Data
RT_ICON	0x42904	1128	LANG_NEUTRAL	SUBLANG_NEUTRAL
RT_GROUP_ICON	0x42d6c	258	LANG_NEUTRAL	SUBLANG_NEUTRAL
RT_VERSION	0x42e70	596	LANG_ENGLISH	SUBLANG_ENGLISH_US
RT_HTML	0x430c4	122943	LANG_GERMAN	SUBLANG_GERMAN
RT_MANIFEST	0x61104	490	LANG_NEUTRAL	SUBLANG_NEUTRAL

API Alert
Anti Debug

PE Imports: mscoree.dll
- 0x402000
  
  _CorExeMain

Meta Info
LegalCopyright:	\xc2\xa9 Microsoft Corporation. All rights reserved.
Translation:	0x0409 0x04b0
FileDescription:	Application Verifier User Interface Utility
ProductName:	Microsoft\xc2\xae Windows\xc2\xae Operating System

XOR
No XOR informations found in this file.

Signature
This file isn't digitally signed

Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET

File found
FIle type: Library
System.Management.dll
System.dll
System.Drawing.dll
System.Core.dll
mscoree.dll

IP Found
No IP detected

URL(s)
No URL found

String too long
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

Microsoft Corporation. All rights reserved.
DivideByZeroException
System.Management.dll
SizedReference
ArithmeticException
EventArgs
/optimize+ /platform:X86 /debug+ /target:winexe
%made%
BCLDebug
Tuple
FXAssembly
EeCKLGPmUXTj
StringFileInfo
Translation
VarFileInfo
EventHandler
System.dll
Operating System
VS_VERSION_INFO
CriticalHandleMinusOneIsInvalid
040904b0
LazyHelpers
System.Drawing.dll
FileDescription
%coco%
ppG
Microsoft
LegalCopyright
YrbLzIVxaZQN
Windows
ProductName
Char
AttributeUsageAttribute
System.Core.dll
Application Verifier User Interface Utility
>fVB
;/lM
[ITT
t+|J
N>@1C
RegistryAttributeTargets
.1pK
p~b2
Fld`x
CausalitySynchronousWorkAppDomainInitializer
/=&~I
PNG
AppDomainSetupFunc2
cMB'
!g5r
$'O~
Fwxw
v<O^o
U7[5
S2LV(lM
MR`X
T>fS
}{vc
3lRm
]OJ~@yy"z
PG)9
kM[%
risp
rV!7)
>?<~
!@H@
bPg,
J0G')
ZQW
Substring
U4qL
,me#
Pcyz
OG^\s
>2r9
0!f@
>K@S
kP
)
ArgIteratorCurrency
pHPGv
T3vD8C%
)YI=
&/4&
#}I~
H~;T),
1-Je
,p!-c
nI3-
"gG'
+
!?oE-
Nw@_
m/TI
vMh(h
X-@0
G
pw]]
OXwv
b(iO
-A=Az
cn"i
i# 7
O6=M
6u#C[
JFU+PR)
A0P
J|>U
RZAj
hP:nX
A@oP
.
X2
PFIo
@/bg
!Tm.
peDf
+N@5
pk/i
Y 0\`cdd`]0
"?\{
GuidAction7
VbSb
Zl64
Fr>m
.ma9
`!0j}>
$tAH
AppDomainHandle__HResults
6p]g
GNbhp
FQ:Z+
PY>a
sS3(
U@p@C
l}MN
/{kA2
ArgIteratorInternal
\K,,
MjQX
yrme
-&toD-
lnqj/#
Lazy1ContextStaticAttribute
hXs^?
@`YYvt
NxusaKQ52ftRS7DC.exe
'^~	y?
8q~
]+rCn
]k~B
9\uj
@ZbDTSj
KeLL^@
:cGkC
n%=z
H
<<
Zf@v*
Re>Tq
@#WIe
X5A'
3?K,
6|9&
0
3P=
<9>Fs
ExceptionArgumentContextMarshalException
MOkns.T7
OM`Y
IAssemblyEnumIProgress1
8e#)
:QCZ
Format
--YE?
InvalidCastExceptionSafeLsaLogonProcessHandle
At;
IA:uP
;x
J@
N7U1
0
yn\
"g&zB
R/oki
3^F
Enumerable
Ma^a
~7:xY8
Nhqe
~y|WX
aq~0u
\IQ_
CharDivideByZeroException
o%JD
ut[@7
nI??
DLP!xLvD
xO?{
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
Ifff
i3JZ
XN{S
'6B r
L'R
VXc:j)J
7_w5
#V4$
|Xi
^cP7
^;K9
^VDi
tvp*
fhj5
%)61g7
P_S}
ConsoleSpecialKeyStringComparer
<8@.,
iHlk
NotifyCollectionChangedToManagedAdapter
?2;A~W
^h"a
LocalDataStoreHolderOutOfMemoryException
I	]t>6D
TlfG
L^b'
dY2cTG4+
InvalidTimeZoneExceptionConsoleKeyInfo
gfq
[%,.
\.O:
#Blob
mON%
=MR-)
>nM:
wK7:j
i9M];
FX1.f`
oC[IVSj]C
z/u
SfB
Dfp8
A0/6n
u+/A
u}GA
AppDomainManagerMarshalByRefObject
QXv
2LT]c``
>Nh7
w@gW
l|Xl
_y3:o
0IWm
,s75-j
_0p`
ZH"V
k_O0C
$p)}
oj*5o
^yK7
p&gwwgwvwwgwvwwvf
$^ig\
{#0L
%:3;
<X\fm
q$*t
[8
P+b
B1Cnv
cSpv
0Da~
Eee:
.jUi
%|&XF
H8(d>"
E("~
RX.j
wdq[
Lte`U
*io4
A|O?n
p*"s
2}i+
rPM:U~
r1F@
T-kwKC
TR<C$;
H%c^H
MI]jqA
E,k{G
<#(u
1?!S
Y:l{
Q"R
D`Goq
SP:q6u
j76H
<1v
AppDomainCausalitySynchronousWork
tfddw
iB7t
z~m~'4
9eT3U
/f^AY9Tpm
RC	4J
'M'G
0"*B
EmptyArray1AppDomainInitializerInfo
)%	E
dXHC
x}>z
w#O-
VRVFf
U

fIg*
PE!v
Y2`-
tUc|+
IProgress1AsyncCallback
N_k
JeHu
`
Na7
/R=y
.text
List`1
BCLDebugSafeWaitHandle
-<'e
VVICw
,C%=
[?+U
ZH4l*
Y*Zkm4g
ConsoleKeyInt32
Meaq
2)#>
]F!7
D*G]
IntPtrCannotUnloadAppDomainException
5Tqx
9=1
y{xz B
$TX
c0Vhb
BadImageFormatExceptionLocalDataStoreHolder
Tni=
bMxcnI
5t{)#
ui 6
lbZ;5%UqUK`
Int64
R]B7
@;F^
5`
f5)r
CannotUnloadAppDomainExceptionExceptionArgument
N{Nn
;>t*l
\lhS
e^{r
uU+
^;7)
ConfigTreeParser
W Q%
yt}%PG
K2oY
hI2k5(h
Action3DataMisalignedException
"OKr
Sl:l
ja&Pj?NMsfa
ldaw
)dCo
w.
=
VE~sg
"I!r}`
d@KFhKk
F]G;
DooooojOb^.
D:yP
(U0
@i
8vMv
z8Ln5M%
_^c-
GD/
uQ U
^d+j
Fgwvp
Y8vQ8c
T&_(p
NIuz
`.rsrc
rj
PXLj
/o>l]
g+\Jr
wt.pX,x
:|`C
r[6?
Q=L<
IAssemblyNameOrdinalComparer
IAppDomainSetupStringComparison
YwSf
s4/A6
=2_n
x9h4u
]O~
pHYs
U-/,
_Q+M
fyWO
qTM?
289
N
Func3IDisposable
Y'
}V[n
A"Yu0
MyF
lUjSG
C:aw
E(Nj
Um<8
itu\*-
'~v6
K{FqF
\}uW
K>_$#
}%yI+
FFlfDFx
VyfHf
SafeRegistryHandleEmptyArray1
n_V@=(C|
Y~?,
<>c__DisplayClass1
?
7?
^W^*
owfdg
/k:;{
Zu	4
- &&
7|5"
StringCollection
W/A
|WM
_\SE
W9<
/,yQ2
)hTF2
*=Cc
ZK-X
_'^ad
DTjW
P0-
(f`M*f{+
HN9r
OT83
\)Se
_;<|
9`0~
dk}Y
R5^
-	#w
>KBP
Yf~vb
]Qh]4
&{Yq
)!8R
!\Yj
aCxkr.C
!uHH
Gb08
X#T
{a@
3S/{c
wo~{
sT6T
>SSbTk
LVe4nh/o
G]Qhl
B:5F@1b
=50T
4J]\:
7v&n
E{6em
MRn)
J]HGH
b^W=
+W?u
%	k"p
U*55W
^:v|
hE+2
kqL4
H#ZeeZ"
Tuple7Converter2
WrapNonExceptionThrows
/=>znSM
;RR@
g/nHK
2s
SafeHandleMinusOneIsInvalid
K"k
9L/!Hu||||9
QLLNP
_4w
:X
'|
QrH>y#
"bHD
hu}7a
_- E
P(H,R
'IJW$8
4wKOO&2.w
ot++e
jaU;
`B$1S
+<71
@S$k
b~n
!zj
sUv#!Z
[1eB
vy<
IHDR
/^dqa
SafeLsaLogonProcessHandleAction4
14>z
$GD j
=s/E
4QA3/
.S
2&(@
^je5
CX}jv
CLSCompliantAttributeAggregateException
by;Ga
IB2S
<
QU
7/N$=
CW-f
<GKz
System
EventArgs
%:}Ocy{
2B+
InvalidTimeZoneExceptionEnum
T'6fA;
Microsoft.CSharp
Aa/XU
y{:@
V@^W
#GM46$
InternalGCCollectionModeAttributeTargets
wS})2%
dldB
Bz5l
>6J
n,5~
USDaW
*RSr
D8C
O@wl
c^L*O
# -<2,
OW91
$Y(y mln1h
MethodBase
vQ~di
-U-u
Xd=4:V
fGu]
/Foq	r
#R]+
|J
e
AppDomainInitializer
}!2
`qs1
n.\#
EgTch
G 
A
J
JX
$z~3
K0rA
Nkkw
|3k
rR8
IIv_f^.b
8pHE\
\d
I
/Lq&RiQ
e%;
*S
i;P*
~9;7
$9 (
;D@5U
fXOK
waD0
>
Sv
Vqf2
get_EntryPoint
ArrayChar
1}.Vi
0dO
iLR3M
ENLINK64ISO2022Decoder
\ iH
E4")T~
AssemblyLoadEventArgs
2;mi\
Fuzuul
HF>v
@.?
^ig09
|Jum
System.Diagnostics
^p;w
C@sV
?(K?
Zr#G/~!8_|
c
4r
zR=(
JPQ7m
Qt
e
BL/s
BJ5t
t${w
^:x

]tM'
Pu%y
b_3x{
28QB
Fl{r
LG@c
_ITH`
IPersistStorage
Jyo.
q]>
6dYO
JmCjD
GXE
JeN1
Pe@8C,l
LNm!SGr
OAVariantLibMarshalByRefObject
L200@X
\_5r
.'i@
mZ.
3.5`
8Wx^
CompilerResults
h\_R
fe+QH
CrossAppDomainDelegateAttribute
m^g`
9<wv
1'%
M3P(
*Bz1&
<h?
|jw
LjyD
:V~l
?
'W
W~&xp
wJ7$
bw
tSe
>tgn
?Iw
?zShx
b,dpF
b>Fbr
s;"9d+
pE9H
4Bb2A	H
KA.3>*?
lQv<F,lpZ
cb*
_%l'
p 
dB2L]
B{#F
(Sdz
`ung
(fHQ
gP
@.reloc
Func`2
0
 qc
cnnR
RegistryDayOfWeek
n
/H
P5*O
GdXB
{S1k
Y1[-?
{
OX
k
IQjb~
yqkb
c$s
FormatExceptionAppDomainManager
sKX.
>,
+B>;w
TpA@
U:
n
Pxs(
U)g
AZ.]$
System.Core
V5wR6
xB
foq
5S++
p6N4
H
	e?8H0
'*\@
S6]C
"m~n
/,.s
/	#q
YY0=#oW3
fF#&@
K;^
Y,zBn
ne:U
-=4hj
*hk_
1pG(
SafeRegistryHandleConsoleSpecialKey
Jq~A"II
%-4}
09(
Comparison1LocalDataStoreMgr
K_
wC
*sO
$"8dZ7i
j";v
OR&F
8$
m(LC
j3Z
4~e
.
E/o
rA?I|
L}VC
TRh7
{m@o
R92
&D}u
55y
0&,pI
8?$~
R7x
#Strings
(CF\
/i\k!UW
9fff89s
uUe4
*uA!
ld8K
hhhQ
-DA
g
TP\ (
qkh[
GJp-
WXy>
QMmp
`_;M.
*}f
?%d`op
InvalidProgramExceptionEnum
;AGi~
}h.M<F
tv8W
#a!,
mZUy<
/!aI!
6D>
f1YbmJ|^
Y;7Iq
B
|-@n
zS7I
>f>t
pVwq
K^ge
@lrx
f%<8#
CompileAssemblyFromSource
snT3T8
Rmago
]$"\
2x{
System.CodeDom.Compiler
BX~X
~;69D
~y3
sJ$%
~Cr3
L U]f`X %E
L@hN
*OP
NvVH&
=r} v(
K0QF
@,$y
6sY[
vr\"
lyMI
0?[_w
=?~x<
,SF#
^Aom
.$]4?v
bQ}]O
A X`f`+4?M
DBNullAppDomainManager
ATu
fFFH
loooooooooooon.
AppDomainPauseManagerAppDomainSetup
sC9K0#r
A$0]addc`/%
PwAa
?~b]
FFlfFBw
eYvd
;W
Xw
B\JU
Gb9
Ev*_
c[}.
:c b
xr{n
<D<F5
@K_
*]addc`/%,V
f	W)
J4uz
EventHandler1Char
Q.z][&
=
C#
oR
db
Action5EventArgs
$u-1
`r;j
AppDomainManagerInitializationOptionsArrayTypeMismatchException
Nf,M
oB.
LAK}
Func5IDisposable
}Gh	|
&<49p
^5Xh:
R
$|
iCv_
nR7	)*{
|syoa
731;
vc>X
IkRnR
Z)WR
MwcB9-
IAppDomainSetupBoolean
FormattableStringEnum
etSA
*-seo,
s>^6i
e[[]`\W
K4p+
>{
ArgumentExceptionStringSplitOptions
2A$t
fE:
w8EkYq
]Q=swqvK
IStringDecrypterLicFileLicense
JIGJmiy
,2is}
WwZK
Q0,Bn
77O
wc|>
<Wt[
bP S
(AaZ6e^
t#iB
Int64LogLevel
yoo!#
(5oc
!g\'D
/iS>
KCg{'
args
}$t~fU
M9zM
F9$e
ToolStripLabelLayout
C1C
r
5h\;
TyK
ENRkS
o1MH
x3M8
4kd
StackOverflowExceptionFunc1
P^as
UfPi
8	.`
w?}Y
rR[4z+
4yC
#mdY
0
Z>;J
DdL
?IHk~n
!p6u
([)%
A'n%
`Z
B
IDATx^
+k$
$\Oj
BCLDebugEnvironment
xV06
@qVq
BRC
3hij
tFlfFFx
GC4G
'$U8
imy:
Xr
rN
ccHT
ArgumentExceptionResolveEventHandler
EGcyJ
B,eTt
Gm$e
R+[C
m?+&
lddx
.ctor
Cl7H'Hup
G%=<
96ub
xvuvv
^P^Nh
BkS1
"aMs6
{t682
rTHfb
WCsbwCO
5PMSuyyyyy7
1(W.
Main
6)u'
Invoke
M:
c
ed.C0C
yM*b
-=Ej
AppDomainUnloadedExceptionOutOfMemoryException
UP#=
d2A"
S8sT
o0sUe+e
v4.0.30319
Aiun
cnr|
,u&
InternalAction8
u=7a
S$u[k
mA5-
6X+l
S$X
8sg;b
gNsl
}#;!
pp
x
[JWU,
ConsoleCancelEventArgsIEquatable1
Ipp
d4bI]
G9Ou
W|Av
4NJ5H
u=ST
P7:Y
>,<o
cTV4
d`#
lBVT
!1(.\
A~;Jb%\H
Int32Action6
8y]i
PC	}>
ffdg
get_Chars
_%;m
rb[Yk
j:K.
OC4?
GH,w
OutOfMemoryExceptionAppDomainHandle
%xB0
\ql4{
%7|<
*"s
eMF*
+k%WF
OYU
,q~.w
ReflectionExtensionsConsoleCancelEventArgs
)n=
`(#,
,LM$
1:}vcI
P7:-
2Rjrc
nX$9y
>#y`O
WI\
My~[
QM+A
j`\-
mdRv
n]r%
f8:~
dv	wMA
@KQyn
f	q@
y^R.
<nO?/
6tG5
O_vX`g
`zn
=Pn-_
P_rI
S|lY
^62G8u
7n9
wK7
<r9dV
Dlxv~
(n$/P
}4-[d
yZ/7{U
?.;D
O'po
\:gK
k![>
qOn#n
_EC(
[5@l
`Ot`J1px
RSDS"
rl:k
WM'
T
t^
l1d1d
:
k=P7I{8
RegistryValueKindEnvironmentVariableTarget
AsyncCallbackFunc4
^pXY
FGG]
j~zLl.
get_CompiledAssembly
89MC
get_Item
OdbcDataReader
y,|=
$-ZL
1DT[9
1&pk2
nR#g>
HTV\
FddF
RuntimeCompatibilityAttribute
f1~r
)))))))))))))))))(
o%f\R_
{[Z-aea
MpvC
?/{7j
IComparableFunc6
Assembly
'#d
viIU
r$hF[
]i<S+R
L3M+
DateTimeCausalitySource
BL?Cf
lb.@=
>$ a
e\(Hw>
BNT"4
aCr2_
O-28V
>Z7ze
&4c
>CBN>
w Q;
<CkFn
\<221
z>.({
t=]K
1_vin
O'U(&
C: ;
fC!h
lY+hk*.
/*Z6
BoXn~
``%Gy
W/_1?wMT
sIjC
3y2y
;DX^
-C{
3sx
g*U
{jll
A2YH1
b5n{3
!L f
95B$
lfFx
Func2Action8
Ybk
.nl_k,L
k\y6
3>EU
DateTimeOffsetFunc3
@CD<!
c+
g
jO$G
!M=k
0K/1
PorY
2#V'$
t LQ
,Pk9R
Int16Func7
V(,oQ
2_|V%L
>u.
Cy|w4(#
&!f(
R	b!
1IB]
!+p(Z
!
u`<G
)#3>Ob
7dZ
yK@
lddex
$L8po
?5]2hK
3HLL'{&
@|l
'%
</^9'
>
Kv
_'aM
A_&>Sv
Zmls
5;vB>
B)u(
}c^3}
%jep
V}y7`
W;JA
Hy4V
xo+'
get_ReferencedAssemblies
H'7G
M^?g
SBMf}E
d^gWj
C`NDJPt
wizUy
ZZ3#G
b$<^>
N+]Z)
_"!?
m=4\A
Xg2
 %
[mZ:
x-@;2
eT|q
}0xE
x?4U)
q8&^o
eIJe
tImpG
ParenthesizePropertyNameAttribute
Func2Func4
AssemblyLoadEventHandlerCausalitySource
@c@g
(|*k
fDtX
yot7
U= Jc1
oz'Qt
6#>f|
{'h:
3P |
a
4R1
O2n>~>W
CodeDomProvider
+t:czN
yX 8
ICloneableDefaultBinder
`zo;
IW,
c/8e
b.lPA
>u#E]&
<$0=
GZM
d=IRG
X]74
Y4|<
"[;9d)
L}uF~q
85DG
FR[(
k[
fH?5
3u||?
Fzais
O(,4:1?
84J@
S"
O
LEKLgQ
ContextStaticAttributeArgIterator
)zT&F
'X'I
}ZXw
kxMC~
Cookie
f(\z
V)j
AS6l
tZj3
mWR~q
SpQe
yIv7
gHFq
GkerYrYhRjT
FI@~
@|$~
w7Al
_wq;
-P%44
&s_`|r
#IDAT
,i=O1
'Z
?@%
H(
0
Tuple6Func3
z?I:*|ta
8Gg^
WebProxyWrapper
Action3ITuple
;Z
J
Mp\0,9
t*RL=
{<NG
.pC8
:s./
&^=GM
s]NF^DymoD
+14
/
BK
FormattableStringConfigNode
_pS7
7dP~@
uCY`
yv1;K
|	=M*
$o=]Q
h-}}-
GxJZWd;7
AlD
'aY6
N0di`
i.]n~
>22_
ContextStaticAttributeOutOfMemoryException
<eGQ~
A	jWN
RlQo
DefaultBinderResolveEventArgs
%-=
`INo
?E;o~VV
9tC#
yVL@
2$fuu
c$`U
<R#Y5
M2CWsRm7
ArgumentExceptionRegistryOptions
;!w
hQSDk
]n_z
XZ2+
:XD
&'qbt
*}Ki
DelegateDllNotFoundException
Gp!L3t
&PK1
o077
/xQ[
gAMA
}  Q-j
ContextMarshalExceptionAction5
81>!
=
"M.t
IS o
@8YP
Ku~
MOn
F^~;J
*2|]
F;.8
,f'_
BooleanLazy1
*i,!
:S./
`
O
.cctor
=qH"
vczF
L}YY
|
x-
mscorlib
PM~@"
L {
nQ7J
hr`4
8kMNC
KX^Z
qUdd
AppDomainSetupIntPtr
;SuK
]Z<4
&|>s
Jk7T`lbb
PFyj8P
$y);
Fg8!
L-a>
]>
j[
hL/y
set_IncludeDebugInformation
rd&kK
EiIT
list
k!V`)\<`[7,
LazyHelpersStringSplitOptions
%/VK
,!)')
e4Uu
$K/nd
{Pghh
\OJeU
bmj4
;hsf=
OL'_
y	?W
AppDomainUnloadedExceptionSafeLsaLogonProcessHandle
[&S}
T|pp
System.Reflection
Bylv@M
rYUMC
5b]bq8)
5\`adda]/$8[
Dx{E
W*w\
vuvuv
1G?w
t(Cst
SafeLsaReturnBufferHandleAttributeTargets
K7-C
{=4
;{Fy
7,pG
^4vBd
DHAg
Tuple2FXAssembly
Action2IServiceProvider
)W0yb
+=8!
=nR2Y
X1$B*
set_GenerateExecutable
=X#(2nttt;
Iz|@
y-2+
QIR
c
%-fz
rW4,>
L&`SB
ISO2022DecoderIStringDecrypter
'[Kof
uvuvy
?KUM
]El8.p
Jqu]
%"
C
*.<>t
ConsoleCancelEventHandlerConfigNodeType
9X`f]U
z_AM
W}c!
tDc=y
ICL
yQ>x
y~Gc
UM~h
bQF{
V?M2
A-,Mb
2;mg
"UZm
Qaul
H#aV
,C
Mk^
GN6X
XJu
%J4R}
LoaderOptimizationObject
u*
C_}P:
l.5K?
F.TX
_sS7L
ORsMs
SafeWaitHandle
_AppDomainSafeRegistryHandle
CultureAwareRandomizedComparerSafeLibraryHandle
P*Cn
7	3
PaK{
Q=(f
Mu~F@
J
EkEj
ConsoleSpecialKeyLogLevel
=*(H
@qad
Action2Action4
TB~1
iXfR
_W;73
20dt
o{^:~~
ITupleCurrency
Y(ks
K|0|
q9ym)f&S
z[nC
F7u#KOO}7T
N
Cz
G2~?
,IzM
AAM
&+ -
,|~
Tr^wK7
=n57Q
+eB:
[X65
V&xx
:tVI
0!!r?
TracingStatusChangedEventArgsConsole
Rs!
=/~#(#
,ol]m
mscoree.dll
!This program cannot be run in DOS mode.

$
twyA
|B$y
<j+
<
K0Cg
2PWfJ
FFhwxttf
#|MS
Pf70
f.dX:8
ftgdvFtGa
vGkd
IAsyncCausalityTracerStaticsTuple6
y'[5
AppDomainThrowHelper
/X,,
2?!Y
SSHp
*@fTA
}}~~
uj|7
b7Hrmu
`O6j0
P7I6
i?Ev
7GkN
~Bp<
WxJB
BiJ$#
System.Collections.Specialized
Z&^)
set_GenerateInMemory
osSk5
y^r0"
1did
r4~TW
E$p6
_oai
<[|^
IntPtrConfigTreeParser
)r^wK7v@
B*d1
5\	3D
udlldd'w
M[Z~?0
(t6Ho
dlf@w
pS;4
`HmR
m,52
H5k,
:DmS
g($r
mR%rE
HkaZ
_9
9_
t	.
apE2
t@y@
6|O?
;BZ"[F
BSJB
]qpG
Sqh\@
f]~?
462[u=
C g6
:IQC
jeg;
}[Y#
g-c5-
OO14
Gr?cdd`\0-
@1e/
Bej5
\5zE0
w0g w
4	Pv
Win32NativeDataMisalignedException
X2f
@f&;
.lnT
I>&)
H1_
%yF4IN
TupleAction7
XqjJ
G0]adda`/$:
NxusaKQ52ftRS7DC
IComparableConsoleCancelEventHandler
bmEm
|~~~
1$B*
ML000
)2yz17
x^-
`<Ve
CausalitySource
HfV-
K~/,
InvalidOperationExceptionUnsafeNativeMethods
,ME
pxX`
0\addc`/%
nj P<$
Vj M
InvalidOperationExceptionConsoleModifiers
];nj
IAssemblyName
@#0]addc]q
S#gH
p%`
aI@#
CriticalHandleMinusOneIsInvalidConsole
RA0;)
(f8
e
O_`l4
`,5I
C+<\Z
System.Linq
WxdV
AppContextSwitches
&i57e
kwzAm
w)?u?xr
3 HfQ
S9(F
I+JQz|
CB>RQ
ca]08
"-h^
h
$_
SgNcjf
CausalitySynchronousWorkSafeHandleZeroOrMinusOneIsInvalid
fO&<
;n%b
o?tr
e?VX/
./:B$
<WR2xO
Ru*G
JL6@nR
}/
n
[!]
fsnoCIS
Enum__ComObject
|a#{
#/$K
#aTR
/~G<$
:eCQV
Fd2M
[Es<
.`E6
ti`S
TQ
.
PF
WH~V#L
LicFileLicense
AssemblyLoadEventArgsCultureAwareComparer
F!Ww
YXoE
iR%
b)o?
N3yk
jrP8
><NT
StringRegistryHive
;S1z0
93.=
N!ZiB
BJIFZ
k(
5
={@$=KC
b`H#i
l,Mh
038X0
O&i;[
G	'Y<
"lLh2KD
8sQ
K?!uO
e9T*
~p5O
n[Yv
IXg`
MethodInfo
Bz3N
#tPj]	b
IDAT'
k)LC
~-tE`
CompilationRelaxationsAttribute
FK6A
?a[]
8	po
IFormattableEnvironmentVariableTarget
,FyMU
{)}sA
NfaA
V?hR
s<?y
/AxD%
+yw`
vPUU
{bhvS?&
j[^`?
ResolveEventHandlerTuple3
_v]8
gS!T
AEpyo
dQph
A"zKy
IDATx
9/PW
-jNW
XQ"(1
BA>XY
vs!n
]Db7V
AssemblyLoadEventHandlerIAssemblyEnum
{8@8
W3N[/?tU
y/O?
Ah@J
pR.2c
sp\
VHaB
IEND
,sYM
,$*d
~629
,gQk5p
8Xw
'R6I
IServiceProviderAccessViolationException
fPE~L
cj~,
3&\)
nvN/g{
~Avu
?WR]
x*%DMx
&%OJ
.$/`add
'WH*
C]~ke
?|-$'
+uCcV
thZ
aUMf
r}MS
z>
E
ConvertAggregateException
^7K_
^DO;
0)A
PX{D
|?wy8
;Y!,a
s~do
-MlN
qB:B
SafeLocalAllocHandleFlagsAttribute
\(\gy
3ccXZX
7pf"
i=
(kLt
+\?L
>Qr/
|peL
k|/z
8535v
>pA6
CSharpCodeProvider
!/CQ.7T
{-}~
S}:Y7
TxZfl
ConsoleKeyInfoOrdinalComparer
+JI:xt
IEquatable1IConvertible
}6k6
xS7i#
~;!8
*S'QH
~HYw
.]ddddddc*
)iF%=
ConfigNodeSubTypeBaseConfigHandler
FK*L
sP[*
)

9
5&EVs]Kc
jwu9+g
tY6-n
G[#c
CompilerGeneratedAttribute
\w;s
0\`cdda\0
OKj^W
Z/]sT
6iEMm
bDq:/
[urA
ZP`L
;y
u}}
n|GC
[W_
DivideByZeroExceptionChar
MM$y
"lauxx
Wa3o
r&U?
tt;7
Tuple2IAppDomainSetup
:@Zs
5r?%
m*p+
MP$!
>0OP
>X'/
ku
K
cs
*
7%\]cdda]0
={
b1o<
&-bw
MX

Do&M
eJ42
dmQZ
?6R7
v(8A_vD
3xr3
??pTS
SizedReferenceLocalDataStoreMgr
aT:`
$:.@
\N(4
=!Mj
cV%J
B$M"
m[%]b
pqL$R3
fgY[s
=LHNz
P`B1
zF"^
Dyfx&
_r\)
V]vVc
PV42M
WindowsFormsComponentEditorENLINK64
j4tde
?3*+
ArgIteratorTuple
ifBJ
T<r`
Cc$6
65La
TMghb?
{MR`
Ex;);
r%!
8X-
/iZ-
A$/]cdda]/$!J
"CYz
*}-+N
BaseConfigHandler__Filters
9Av8
String
bnZ(
_CorExeMain
&&8x
Mds!eb
p(X!
&MLuV]
hEk.
4`UR
z;R
8,U
EnvironmentVariableTargetSafeLsaReturnBufferHandle
)#7rWI
5]GO
&
`P
p	Tn
3~^I
LUl!1c
DelegateSerializationHolderCurrentSystemTimeZone
Xk}h
bi/<x
DebuggingModes
n f(
on]C
}Q
5O
H-8zI
UM'u
wJ7j
AccessViolationExceptionTuple2
ko#a$
=Scu
,_Hv
W._d
(?;NO0
-Z_\
ToArray
SZArrayHelperDateTime
6$/`add`]/
h=00
DateTimeKind
>}UF
P*bW
]j	x!
f
C|u|s+#(,
Ro.
F^m;
`rz
H;/y
CompilerParameters
,ZeeZ+
sMD6l
:NEQ
5Bi>
+cjb
MethodAccessExceptionCrossAppDomainDelegate
I7g
0?

V %/`cdda]/
28@IU
,
J|H
8?5K
>M5y~
Gl}c
ContextBoundObjectAppContextSwitches
0Q@1
cO&|8
0mdb.J
-Gjb
Gm*uc
<fVT$,
~RN"
oq`2
8JfI
-"ZeeX"
D%h>
TypeUnloadedException
h091
fD'O
Gv;i
StrongNameHelpersArray
Vn\DWU&
Q0K$
DebuggableAttribute
ym#$}
'	`H
2#JI
/1k$
%X*m:
((u_s
bC`g:
MdaFieldAccessException
  P
/H8p
BooleanIAsyncResult
I9p]M
3!Zee
~qK
AppDomainInitializerInternal
]]"J
mA|
R1Pl
__ComObjectActivationContext
:Tbt0*
(z7bR+
InternalGCCollectionModeInternal
lVD
;;^v
urjP
1o"/t
8`*%
6sCcSO3r
~P	"
ey&/u8
-3',
BVvK
:K$BN
rUvZ
wa3?
ZU,*4
Object
`e<q
AsyncCallbackFormattableString
wS,\
[w)c$
4z61
ACbf
r>,@H;/j0
FFFFFFFFF
2QX [
5
f4@
?-K>
Z0x7X
^x6I
bg]D
`0Q;
C6d@{
7;fpi
p"J9c
SystemExceptionConfigNodeType
,0
E.Hq
nC_&
AppDomainPauseManager
isX?
Select
M)\`cdda]0
&Pq
5uM\H
\S\s>
bZV59
Z_Kj
CriticalHandleZeroOrMinusOneIsInvalidITuple
H=
5
v~/]
7?
B
wP@H
iFdn
z.6s
NP<%
BCLDebugReflectionExtensions
|Qmf~
,Wpb2
Qy-?
RegistryKeyFunc3
Fk9]
CultureAwareRandomizedComparerAction2
RM}<
){Y^{d
GxEr
YK
O|5
TupleContextStaticAttribute
Oo4.z,RYY
[inn
WS(^
]H"D
)>Uu
6L|e
0;av[lMg
!~y3^2L
ip/p_:
Q`_g
IAsyncCausalityTracerStatics
p}c&
u*es
!%@)
3!KO
j1zz
u-{f
ckr>
W"7	{
0'<1L
1sF87
PXKBQ$
4JAbm2
sRGB
[+	My6=
lt~f
'x"7
|Ap~b
xIXK
3pc
>wKH
ME1
:`a
DelegateCharEnumerator
h0w
-2++v
R##G
1D3?
Q%yi
WlfFFx
g	&Q
s
"{T:wA
>SAH4om(
N@t5
||qM
MuzM
;tiB
dm4[
imPmo
CriticalHandleMinusOneIsInvalidCurrency
s^wK7
kz_
\:/
Li*:V
5/\addc`/%
3}Dq
b'9zh
;d4v
e0`
.nI7
d2I
Ap]-
b(t
Lt>G
[&T*tt
^-cn
6WxVY/
KS$/
__ComObjectSafeHandleMinusOneIsInvalid
[x/:^
*I($
8vUE
13333333333333333333333333331
Xi:j)
?i1p
EventArgsRegistryValueOptions
=a
JN`
FormatException
,I2$
==9n
tI[h5O
,u>g
ConsoleModifiersByte
*qCI
`]W
.SL`
>/m)
&aM#
|#y-1
t\K5{
cMc.
$%6(A
,]HK+
4#jN
d{188H
FKKVSAC
YXvgMj
N[l
PPK$
Action1ICloneable
8AIk]R
>D#>
+Tg?
c<o]
nR_y
2.mr
%CWJ
a27w
.}j<v
46D)
Xl(
J}N
3!a*$4
H7<[
lK!n
i@]I2
@sAOB
.7FD
4mYSOj
>a@Y
System.Net
$Sh
+LEC
FA]m
L:@c
Bc9y
VkT
:s
b
zqG]
%@r`
G
I|#
56`H
yw:o
R)t]
"`G_
aF8p
W^@M
+]ecX"
rqfC
ConvertSafeHandleMinusOneIsInvalid
<ToolStripLabelLayout>b__0
koEl
/>"}
4nL@
?p3
;i3:
yk(G(
t0YJ@
IObservable1InvalidProgramException
CLSCompliantAttributeLazyHelpers
AWMO
M?1
c:\xampp\htdocs\crypting\pbc3tbxwa6jMW1JD\NxusaKQ52ftRS7DC.pdb
^sJ
ConsoleCancelEventArgsAttributeUsageAttribute
BqGE
G 3g
x\1>
5xKL
a?1K7
>y3GI
QqA.
=\gi]
RegistryValueKindIClrStrongNameUsingIntPtr
?A&;2
W%T5
g\3h"|.
G!Xbf]U
q	[!
YvnR
{<ky7
^GCS
`Tno
Nfrv
rQai
DPL;
[_Z)
l~3bx
mVD
CurrencyGCCollectionMode
^I1C
?kfz
Program
G(O:
j	tQ17L
k|=
;
\!
F0\`cdd`\0
Zb]gr
H??l
@|yT
'$
YZme
BadImageFormatExceptionAction4
0~BL*}}B
LocalDataStoreElementMulticastDelegate
S\cE*
}RG1
5
zFQ
8ClS
:VwH
T$4#};
2Y}:~?
p!Pmv
CausalityTraceLevelFunc4
mj
nH?h/
*075
L	(.
UxM':
CLSCompliantAttributeSafeProcessHandle
]u}m
Q2wa
4 9O"Q
|B]`/
zQ"jd:
;77G|
p
9k
u2{X
]
mDhTt
`cKac{GQ
tXL`
vR2D
*5E
Hp%J
`jj2
#!Zn
w0nY
e]9y
eV~3
_L&a2K
_<
v
^>^+
u3&[N
p.~7
_w3b
0U!/
`#$`Z
ZYKrC
2yt
g,Yh
&]2:
TIX+
k8x"
71YN
=+~]
iRew
GCzO]
OI+>
G$o|/
u68S=
Z]Ws:
*h
)
IDAT
H~+q}
QJRY
*}J
B	j:F
gU7l
,e|BJ
=\2*yx
Y5Bn5M
4D}
9K
mr[m
,cE-U
$yJFS$
=~(6
n228
@OnAnR
SAp{
6R(
(h8!
M@ _,b
Zemu]
__x:
?<NA~
\zA$F
System.Runtime.CompilerServices
a_f+
U%f,
pl=
p>Cs}
hk@ov`L/
maQ5
7MP^.
cCYzw
%/`e
f:#SPM
n[p&
vS`
OoNZQ
rc I
vFlfF
6Ohebz
rcC#
yLl^@
>AND
Y&,P
,SY[[
set_CompilerOptions
FNl+
ryf L@
K1dt
C&D2
1_<T
df@K
Nw3v
oItD^
iLmD
,^Yk
1=$=
EventArgsLocalDataStore
umR:
gTj'
E,-4
>'(
IK]}
cXmz
84p.
Vet2
>8}rGICI3[/-
ffffffffffffffd
h.<En)
Be4D
E{Ln
d|||
~;j;@
XP!W
c)_k
_!<(
a)
iPX,
Ln
q4U%
$dM	!
Ur}_}~
1+|
Fw]K
AyM7
1Lr	g
Q4-D
<LY~
-6]w8
z\jwb
BCgys
-aPT
#7"ga
<Module>
)<\:[:[:\0Nf
ConsoleCancelEventArgsIAsyncCausalityTracerStatics
ConfigNodeBitConverter
..LR
O~;D
tB-C~
Fr:h
mYwS
Func6ThisAssembly
3t<&R
.H?!
T<<(
8F2
V\"OR
:{}#
61kV
VHTr
H<e9
O)Id
p}.=e
8,ZQzfq
v^D(
FfxdJ%
A/gi
8^A
AF
YC|!
"e'D
R!>9
2+\e`X!&
Ss6w;
<n'
'\
MemberAccessExceptionUnsafeNativeMethods
yZmcsy
x+-!:
_B|$
,d,L
7^"x
X.z7
JUa(
zuUF)
#GUID
aFlM
7[:Q7I
D<
A+g3
59^
AXL_
bB8w
2/im
Ll.r
3 wie
1QU3W+X
L 1H
f%`
cY{/c
Z
d3
YWXS
mN	s~
v;}FP
%N5|
Hf44|0#u<
NN@}
]]AvE
3DgP
}df_
;~<?
$d3=x
x.yO
^`P-
U S
r\{}
>	vk
h}<x
"f0<
Qiv
=Z
hi2i
s=qN
K
=]
;IDATP8J
-A?v
]di,
Go,v
Mfmu
{A
4
t
.P
q#9~
zCc/
(7?z
<u/I
QI~~
\X04
97/;
GCCollectionModeSafeFileHandle
etf/M
VA^3Q
8&avZz
eGn$
;x*t
/"
7
[?~p
?_v{aHs
&G+4P
6#hn=
6k-Q
huv
^
MH
9_L
2,+
g&0^
IEnumerable`1
S&/]ccdc]\%
dY#'
"]qpG
<R6)T$
&}Kc
I4ju
S[Oc
C$lX
zJt
GhemYrTmYTjI
nhX"
UK\$C
,\sAd
#Fa1,	E
Kg2N
8hxgs(
ST'hT
1F"\^
R(B0
b=I1
NoBA
pdlfFd
}-
z
M"`jd
0\`cdc`\%*HJ
Go\M>o}
[T9k
)TM'
ULM]@
i5w#p
pdlfFF
+Fb
Replace
gKls
D4"kQ
92*o
}/H(t
uaHY<y
*7uC
>`id";
]-<z3
,phQ
[8)e
"5%'
^i4$h
`id"
gjM
rSNb\
fFw{!L
1)a@
`2h5
SafeLsaLogonProcessHandleTuple6
!dkM
89$u
y+
Y
SafeWaitHandleBuffer
SwitchStructureStrongNameHelpers
b'$m
vS7
Y`-
5"Xee\+
LY5
&uU{
System.Collections.Generic
d6AP
YF1\
4:HM
k|7l
V42ns
1N`XmY/
CompatibilitySwitchesObject
Y\gR
t[ku)x
|.
9
dFlfGwe
4V^iWy
mBs4v
2sssN
>8=|
<I't
lq'o
a%lNO
Obaf
j}n{
DPD!x
$U`f`W /
J@qU
+)f(P
w(2,
/.*)
_=v
W3-jJ:n
pfvgfvgf`
`Ena
Y(s^
LoaderOptimizationAttributeCrossAppDomainDelegate
t;m
,="W(
Mz V
SwBrW
Yx{L6
BmZ%W
&_12
Xs~~
7f`g
3gEd
R!vZ}|C
4*YS
l,2|X][
vKwG
3/Nl
CcMd

Behavior analysis details
Machine name	Machine label	Machine manager	Started	Ended	Duration
Seven05b_64	Seven05b_64	VirtualBox	2018-09-27 04:02:19	2018-09-27 04:05:38	199

24 Behaviors detected by system signatures

Created network traffic indicative of malicious activity Severity: High Confidence: High

signature: Traffico Anomalo: Traffico verso host malevolo, GET HTTP Content "db" (Soc-Rule)

Attempts to remove evidence of file being downloaded from the Internet Severity: High Confidence: Very High

file: C:\ProgramData\null:Zone.Identifier

Executed a process and injected code into it, probably while unpacking Severity: High Confidence: Very High

Injection: doc.exe(2632) -> vbc.exe(2760)

Sniffs keystrokes Severity: High Confidence: Very High

SetWindowsHookExA: Process: vbc.exe(2760)

Attempts to repeatedly call a single API many times in order to delay analysis time Severity: High Confidence: Very High

Spam: WmiPrvSE.exe (2856) called API GetSystemTimeAsFileTime 26872 times
Spam: services.exe (476) called API GetSystemTimeAsFileTime 2213380 times

Installs itself for autorun at Windows startup Severity: High Confidence: Very High

file: C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egjbJb.url
file: C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egjbJb.url
file: C:\Windows\Tasks\Adobe Flash Player Updater.job
task: "schtasks.exe" /create /sc MINUTE /tn egjbJb /MO 1 /tr "C:\ProgramData\null\

Creates a hidden or system file Severity: High Confidence: Medium

file: C:\Users\Seven01\AppData\Roaming\tyu.dat

Checks the system manufacturer, likely for anti-virtualization Severity: High Confidence: Very High

Creates a copy of itself Severity: High Confidence: Very High

copy: C:\ProgramData\null

Attempts to create or modify system certificates Severity: High Confidence: Very High

Anomalous binary characteristics Severity: High Confidence: High

anomaly: Actual checksum does not match that reported in PE header

Uses Windows utilities for basic functionality Severity: Medium Confidence: High

command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.cmdline"
command: "schtasks.exe" /query
command: "schtasks.exe" /create /sc MINUTE /tn egjbJb /MO 1 /tr "C:\ProgramData\null\
command: "schtasks.exe" /create /sc MINUTE /tn egjbJb /MO 1 /tr "C:\ProgramData\null\

Anomalous .NET characteristics Severity: Medium Confidence: Very High

anomalous_version: Assembly version is set to 0

Creates RWX memory Severity: Medium Confidence: Medium

Possible date expiration check, exits too soon after checking local time Severity: Medium Confidence: Medium

process: schtasks.exe, PID 2368

Anomalous file deletion behavior detected (10+) Severity: Medium Confidence: Very High

DeletedFile: C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.out
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.tmp
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.pdb
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.dll
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.err
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.cmdline
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.0.cs
DeletedFile: C:\ProgramData\null:Zone.Identifier
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\RES1756.tmp
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\CSC815331D32F834CE6877A45412C204ED2.TMP
DeletedFile: C:\Windows\Temp\Cab82C2.tmp
DeletedFile: C:\Windows\Temp\Tar82C3.tmp
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp.WERInternalMetadata.xml
DeletedFile: C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp.WERInternalMetadata.xml

Guard pages use detected - possible anti-debugging. Severity: Medium Confidence: Very High

A process attempted to delay the analysis task. Severity: Medium Confidence: Very High

Process: taskeng.exe tried to sleep 480 seconds, actually delayed analysis time by 0 seconds
Process: vbc.exe tried to sleep 436 seconds, actually delayed analysis time by 0 seconds

Dynamic (imported) function loading detected Severity: Medium Confidence: Very High

DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentProcessW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: nlssorting.dll/SortGetHandle
DynamicLoader: nlssorting.dll/SortCloseHandle
DynamicLoader: KERNEL32.dll/GetTempPath
DynamicLoader: KERNEL32.dll/GetTempPathW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: CRYPTSP.dll/CryptGetDefaultProviderW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: KERNEL32.dll/SetThreadErrorMode
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/WriteFile
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: KERNEL32.dll/GetCurrentDirectory
DynamicLoader: KERNEL32.dll/GetCurrentDirectoryW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetStdHandle
DynamicLoader: KERNEL32.dll/GetStdHandleW
DynamicLoader: KERNEL32.dll/GetEnvironmentStrings
DynamicLoader: KERNEL32.dll/GetEnvironmentStringsW
DynamicLoader: KERNEL32.dll/FreeEnvironmentStrings
DynamicLoader: KERNEL32.dll/FreeEnvironmentStringsW
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetACP
DynamicLoader: KERNEL32.dll/UnmapViewOfFile
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetExitCodeProcess
DynamicLoader: KERNEL32.dll/GetExitCodeProcessW
DynamicLoader: KERNEL32.dll/GetFileSize
DynamicLoader: KERNEL32.dll/ReadFile
DynamicLoader: KERNEL32.dll/DeleteFile
DynamicLoader: KERNEL32.dll/DeleteFileW
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: KERNEL32.dll/FindResource
DynamicLoader: KERNEL32.dll/FindResourceA
DynamicLoader: KERNEL32.dll/SizeofResource
DynamicLoader: KERNEL32.dll/LoadResource
DynamicLoader: KERNEL32.dll/LockResource
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipCreateBitmapFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: KERNEL32.dll/WerRegisterMemoryBlock
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: KERNEL32.dll/ReleaseMutex
DynamicLoader: KERNEL32.dll/CreateMutex
DynamicLoader: KERNEL32.dll/CreateMutexW
DynamicLoader: shell32.dll/SHGetFolderPath
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/GetStdHandle
DynamicLoader: KERNEL32.dll/LocalFree
DynamicLoader: KERNEL32.dll/CreatePipe
DynamicLoader: KERNEL32.dll/CreatePipeW
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetConsoleOutputCP
DynamicLoader: KERNEL32.dll/CopyFile
DynamicLoader: KERNEL32.dll/CopyFileW
DynamicLoader: KERNEL32.dll/DeleteFile
DynamicLoader: KERNEL32.dll/DeleteFileA
DynamicLoader: KERNEL32.dll/WideCharToMultiByte
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: KERNEL32.dll/CompareStringOrdinal
DynamicLoader: clr.dll/CreateAssemblyNameObject
DynamicLoader: clr.dll/CreateAssemblyNameObjectW
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: ole32.dll/CoGetObjectContext
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: clr.dll/CreateAssemblyEnum
DynamicLoader: clr.dll/CreateAssemblyEnumW
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/ResolveLocaleName
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/LoadLibraryA
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: KERNEL32.dll/GetModuleHandleA
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: KERNEL32.dll/CreateProcessA
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/Wow64GetThreadContext
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/Wow64SetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: ntdll.dll/NtUnmapViewOfSection
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: gdiplus.dll/GdipDisposeImage
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: kernel32.dll/GetProcessPreferredUILanguages
DynamicLoader: kernel32.dll/GetUserDefaultUILanguage
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeA
DynamicLoader: VERSION.dll/GetFileVersionInfoA
DynamicLoader: VERSION.dll/VerQueryValueA
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: alink.dll/CreateALink
DynamicLoader: mscoree.dll/CLRCreateInstance
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/SetThreadStackGuarantee
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/GetLogicalProcessorInformation
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: kernel32.dll/EnumSystemLocalesEx
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetDateFormatEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/GetTimeFormatEx
DynamicLoader: kernel32.dll/GetUserDefaultLocaleName
DynamicLoader: kernel32.dll/IsValidLocaleName
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleExW
DynamicLoader: kernel32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CLRCreateInstance
DynamicLoader: mscoree.dll/CLRCreateInstance
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: clr.dll/DllGetClassObjectInternal
DynamicLoader: mscoree.dll/CLRCreateInstance
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: mscoree.dll/CLRCreateInstance
DynamicLoader: clr.dll/StrongNameTokenFromPublicKey
DynamicLoader: clr.dll/StrongNameFreeBuffer
DynamicLoader: clr.dll/CompareAssemblyIdentityWithConfig
DynamicLoader: clr.dll/CreateAssemblyConfigCookie
DynamicLoader: clr.dll/DestroyAssemblyConfigCookie
DynamicLoader: clr.dll/CreateAssemblyNameObject
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptExportKey
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: mscorpehost.dll/InitializeSxS
DynamicLoader: mscorpehost.dll/CreateICeeFileGen
DynamicLoader: mscorpehost.dll/DestroyICeeFileGen
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: diasymreader.dll/DllGetClassObject
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: ole32.dll/CreateStreamOnHGlobal
DynamicLoader: OLEAUT32.dll/
DynamicLoader: mscoree.dll/CorExitProcess
DynamicLoader: mscoreei.dll/CorExitProcess_RetAddr
DynamicLoader: mscoreei.dll/CorExitProcess
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: uxtheme.dll/ThemeInitApiHook
DynamicLoader: USER32.dll/IsProcessDPIAware
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: SHLWAPI.dll/PathFindFileNameW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: uxtheme.dll/ThemeInitApiHook
DynamicLoader: USER32.dll/IsProcessDPIAware
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: ADVAPI32.dll/GetUserNameW
DynamicLoader: XmlLite.dll/CreateXmlWriter
DynamicLoader: XmlLite.dll/CreateXmlWriterOutputWithEncodingName
DynamicLoader: USER32.dll/GetCursorInfo
DynamicLoader: USER32.dll/GetLastInputInfo
DynamicLoader: kernel32.dll/GetConsoleWindow
DynamicLoader: Psapi.dll/GetModuleFileNameExA
DynamicLoader: Psapi.dll/GetModuleFileNameExW
DynamicLoader: kernel32.dll/GlobalMemoryStatusEx
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: kernel32.dll/GetComputerNameExW
DynamicLoader: SHELL32.dll/IsUserAnAdmin
DynamicLoader: kernel32.dll/SetProcessDEPPolicy
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextW
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: SHLWAPI.dll/PathIsDirectoryW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegNotifyChangeKeyValue
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/CLSIDFromOle1Class
DynamicLoader: CLBCatQ.DLL/GetCatalogObject
DynamicLoader: CLBCatQ.DLL/GetCatalogObject2
DynamicLoader: tschannel.dll/DllGetClassObject
DynamicLoader: tschannel.dll/DllCanUnloadNow
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: SHLWAPI.dll/PathIsPrefixW
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: XmlLite.dll/CreateXmlReader
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: WS2_32.dll/GetAddrInfoW
DynamicLoader: WS2_32.dll/WSASocketW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSAIoctl
DynamicLoader: WS2_32.dll/FreeAddrInfoW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: schannel.dll/SpUserModeInitialize
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: WS2_32.dll/WSASend
DynamicLoader: WS2_32.dll/WSARecv
DynamicLoader: secur32.dll/FreeContextBuffer
DynamicLoader: ncrypt.dll/SslOpenProvider
DynamicLoader: ncrypt.dll/GetSChannelInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: ncrypt.dll/SslIncrementProviderReferenceCount
DynamicLoader: ncrypt.dll/SslImportKey
DynamicLoader: bcryptprimitives.dll/GetCipherInterface
DynamicLoader: ncrypt.dll/SslLookupCipherSuiteInfo
DynamicLoader: USER32.dll/LoadStringW
DynamicLoader: ncrypt.dll/BCryptOpenAlgorithmProvider
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: ncrypt.dll/BCryptGetProperty
DynamicLoader: ncrypt.dll/BCryptCreateHash
DynamicLoader: ncrypt.dll/BCryptHashData
DynamicLoader: ncrypt.dll/BCryptFinishHash
DynamicLoader: ncrypt.dll/BCryptDestroyHash
DynamicLoader: CRYPT32.dll/CertGetCertificateChain
DynamicLoader: USERENV.dll/GetUserProfileDirectoryW
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: sechost.dll/ConvertStringSidToSidW
DynamicLoader: USERENV.dll/RegisterGPNotification
DynamicLoader: GPAPI.dll/RegisterGPNotificationInternal
DynamicLoader: sechost.dll/OpenSCManagerW
DynamicLoader: sechost.dll/OpenServiceW
DynamicLoader: sechost.dll/CloseServiceHandle
DynamicLoader: sechost.dll/QueryServiceConfigW
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptVerifySignatureA
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: cryptnet.dll/I_CryptNetGetConnectivity
DynamicLoader: SensApi.dll/IsNetworkAlive
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: cryptnet.dll/CryptRetrieveObjectByUrlW
DynamicLoader: SHLWAPI.dll/UrlGetPartW
DynamicLoader: WINHTTP.dll/WinHttpOpen
DynamicLoader: WINHTTP.dll/WinHttpSetTimeouts
DynamicLoader: WINHTTP.dll/WinHttpSetOption
DynamicLoader: WINHTTP.dll/WinHttpCrackUrl
DynamicLoader: WINHTTP.dll/WinHttpConnect
DynamicLoader: WINHTTP.dll/WinHttpOpenRequest
DynamicLoader: WINHTTP.dll/WinHttpGetDefaultProxyConfiguration
DynamicLoader: WINHTTP.dll/WinHttpGetIEProxyConfigForCurrentUser
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: NSI.dll/NsiAllocateAndGetTable
DynamicLoader: CFGMGR32.dll/CM_Open_Class_Key_ExW
DynamicLoader: IPHLPAPI.DLL/ConvertInterfaceGuidToLuid
DynamicLoader: IPHLPAPI.DLL/GetIfEntry2
DynamicLoader: IPHLPAPI.DLL/GetIpForwardTable2
DynamicLoader: IPHLPAPI.DLL/GetIpNetEntry2
DynamicLoader: IPHLPAPI.DLL/FreeMibTable
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: NSI.dll/NsiFreeTable
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: WINHTTP.dll/WinHttpGetProxyForUrl
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: WINHTTP.dll/WinHttpSendRequest
DynamicLoader: WINHTTP.dll/WinHttpReceiveResponse
DynamicLoader: WINHTTP.dll/WinHttpQueryHeaders
DynamicLoader: WINHTTP.dll/WinHttpQueryDataAvailable
DynamicLoader: WS2_32.dll/
DynamicLoader: WINHTTP.dll/WinHttpReadData
DynamicLoader: WS2_32.dll/
DynamicLoader: WINHTTP.dll/WinHttpCloseHandle
DynamicLoader: setupapi.dll/SetupIterateCabinetW
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: Cabinet.dll/
DynamicLoader: Cabinet.dll/
DynamicLoader: Cabinet.dll/
DynamicLoader: sechost.dll/OpenSCManagerW
DynamicLoader: sechost.dll/OpenServiceW
DynamicLoader: sechost.dll/QueryServiceConfigA
DynamicLoader: sechost.dll/QueryServiceStatus
DynamicLoader: sechost.dll/CloseServiceHandle
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeA
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingA
DynamicLoader: RPCRT4.dll/RpcEpResolveBinding
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: RPCRT4.dll/RpcStringFreeA
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: CRYPTSP.dll/CryptGetKeyParam
DynamicLoader: CRYPT32.dll/CertVerifyCertificateChainPolicy
DynamicLoader: CRYPT32.dll/CertFreeCertificateChain
DynamicLoader: CRYPT32.dll/CertDuplicateCertificateContext
DynamicLoader: CRYPT32.dll/CertFreeCertificateContext
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: wersvc.dll/ServiceMain
DynamicLoader: wersvc.dll/SvchostPushServiceGlobals
DynamicLoader: ADVAPI32.dll/RegGetValueW
DynamicLoader: sechost.dll/ConvertStringSecurityDescriptorToSecurityDescriptorW
DynamicLoader: faultrep.dll/WerpInitiateCrashReporting
DynamicLoader: wer.dll/WerpCreateMachineStore
DynamicLoader: SHELL32.dll/SHGetFolderPathEx
DynamicLoader: ole32.dll/StringFromGUID2
DynamicLoader: profapi.dll/
DynamicLoader: USERENV.dll/CreateEnvironmentBlock
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: USERENV.dll/DestroyEnvironmentBlock
DynamicLoader: faultrep.dll/WerpInitiateCrashReporting
DynamicLoader: wer.dll/WerpCreateMachineStore
DynamicLoader: USERENV.dll/CreateEnvironmentBlock
DynamicLoader: USERENV.dll/DestroyEnvironmentBlock
DynamicLoader: IMM32.dll/ImmDisableIME
DynamicLoader: psapi.dll/GetModuleFileNameExW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: wer.dll/WerpCreateIntegratorReportId
DynamicLoader: wer.dll/WerReportCreate
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: wer.dll/WerpSetIntegratorReportId
DynamicLoader: wer.dll/WerReportSetParameter
DynamicLoader: dbgeng.dll/DebugCreate
DynamicLoader: ntdll.dll/CsrGetProcessId
DynamicLoader: ntdll.dll/DbgBreakPoint
DynamicLoader: ntdll.dll/DbgPrint
DynamicLoader: ntdll.dll/DbgPrompt
DynamicLoader: ntdll.dll/DbgUiConvertStateChangeStructure
DynamicLoader: ntdll.dll/DbgUiGetThreadDebugObject
DynamicLoader: ntdll.dll/DbgUiIssueRemoteBreakin
DynamicLoader: ntdll.dll/DbgUiSetThreadDebugObject
DynamicLoader: ntdll.dll/NtAllocateVirtualMemory
DynamicLoader: ntdll.dll/NtClose
DynamicLoader: ntdll.dll/NtCreateDebugObject
DynamicLoader: ntdll.dll/NtCreateFile
DynamicLoader: ntdll.dll/NtDebugActiveProcess
DynamicLoader: ntdll.dll/NtDebugContinue
DynamicLoader: ntdll.dll/NtFreeVirtualMemory
DynamicLoader: ntdll.dll/NtOpenProcess
DynamicLoader: ntdll.dll/NtOpenThread
DynamicLoader: ntdll.dll/NtQueryInformationProcess
DynamicLoader: ntdll.dll/NtQueryInformationThread
DynamicLoader: ntdll.dll/NtQueryMutant
DynamicLoader: ntdll.dll/NtQueryObject
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtRemoveProcessDebug
DynamicLoader: ntdll.dll/NtResumeThread
DynamicLoader: ntdll.dll/NtSetInformationDebugObject
DynamicLoader: ntdll.dll/NtSetInformationProcess
DynamicLoader: ntdll.dll/NtSystemDebugControl
DynamicLoader: ntdll.dll/NtWaitForDebugEvent
DynamicLoader: ntdll.dll/RtlAnsiStringToUnicodeString
DynamicLoader: ntdll.dll/RtlCreateProcessParameters
DynamicLoader: ntdll.dll/RtlCreateUserProcess
DynamicLoader: ntdll.dll/RtlDestroyProcessParameters
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U
DynamicLoader: ntdll.dll/RtlFindMessage
DynamicLoader: ntdll.dll/RtlFreeHeap
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlGetFunctionTableListHead
DynamicLoader: ntdll.dll/RtlGetUnloadEventTrace
DynamicLoader: ntdll.dll/RtlGetUnloadEventTraceEx
DynamicLoader: ntdll.dll/RtlInitAnsiString
DynamicLoader: ntdll.dll/RtlInitUnicodeString
DynamicLoader: ntdll.dll/RtlTryEnterCriticalSection
DynamicLoader: ntdll.dll/RtlUnicodeStringToAnsiString
DynamicLoader: ntdll.dll/NtOpenProcessToken
DynamicLoader: ntdll.dll/NtOpenThreadToken
DynamicLoader: ntdll.dll/NtQueryInformationToken
DynamicLoader: kernel32.dll/CloseProfileUserMapping
DynamicLoader: kernel32.dll/CreateToolhelp32Snapshot
DynamicLoader: kernel32.dll/DebugActiveProcessStop
DynamicLoader: kernel32.dll/DebugBreak
DynamicLoader: kernel32.dll/DebugBreakProcess
DynamicLoader: kernel32.dll/DebugSetProcessKillOnExit
DynamicLoader: kernel32.dll/Module32First
DynamicLoader: kernel32.dll/Module32FirstW
DynamicLoader: kernel32.dll/Module32Next
DynamicLoader: kernel32.dll/Module32NextW
DynamicLoader: kernel32.dll/OpenThread
DynamicLoader: kernel32.dll/Process32First
DynamicLoader: kernel32.dll/Process32FirstW
DynamicLoader: kernel32.dll/Process32Next
DynamicLoader: kernel32.dll/Process32NextW
DynamicLoader: kernel32.dll/ProcessIdToSessionId
DynamicLoader: kernel32.dll/SetProcessShutdownParameters
DynamicLoader: kernel32.dll/Thread32First
DynamicLoader: kernel32.dll/Thread32Next
DynamicLoader: kernel32.dll/GetTimeZoneInformation
DynamicLoader: kernel32.dll/DuplicateHandle
DynamicLoader: kernel32.dll/Wow64GetThreadSelectorEntry
DynamicLoader: ADVAPI32.dll/CloseServiceHandle
DynamicLoader: ADVAPI32.dll/ControlService
DynamicLoader: ADVAPI32.dll/CreateServiceA
DynamicLoader: ADVAPI32.dll/CreateServiceW
DynamicLoader: ADVAPI32.dll/DeleteService
DynamicLoader: ADVAPI32.dll/EnumServicesStatusExA
DynamicLoader: ADVAPI32.dll/EnumServicesStatusExW
DynamicLoader: ADVAPI32.dll/GetEventLogInformation
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenSCManagerA
DynamicLoader: ADVAPI32.dll/OpenSCManagerW
DynamicLoader: ADVAPI32.dll/OpenServiceA
DynamicLoader: ADVAPI32.dll/OpenServiceW
DynamicLoader: ADVAPI32.dll/StartServiceA
DynamicLoader: ADVAPI32.dll/StartServiceW
DynamicLoader: ADVAPI32.dll/GetSidSubAuthority
DynamicLoader: ADVAPI32.dll/GetSidSubAuthorityCount
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeExW
DynamicLoader: VERSION.dll/GetFileVersionInfoExW
DynamicLoader: dbghelp.dll/DebugExtensionInitialize
DynamicLoader: dbghelp.dll/WinDbgExtensionDllInit
DynamicLoader: dbghelp.dll/ExtensionApiVersion
DynamicLoader: dbghelp.dll/CheckVersion
DynamicLoader: wer.dll/WerpSetDynamicParameter
DynamicLoader: wer.dll/WerReportAddDump
DynamicLoader: wer.dll/WerpSetCallBack
DynamicLoader: wer.dll/WerReportSetUIOption
DynamicLoader: wer.dll/WerpAddRegisteredDataToReport
DynamicLoader: wer.dll/WerReportSubmit
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegGetValueW
DynamicLoader: USER32.dll/LoadStringW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/CheckTokenMembership
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetThreadDesktop
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: SensApi.dll/IsNetworkAlive
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: RPCRT4.dll/NdrClientCall3
DynamicLoader: USER32.dll/CharUpperW
DynamicLoader: werui.dll/WerUICreate
DynamicLoader: werui.dll/WerUIStart
DynamicLoader: ole32.dll/CoInitialize
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: DUI70.dll/InitProcessPriv
DynamicLoader: COMCTL32.dll/LoadIconWithScaleDown
DynamicLoader: ntdll.dll/RtlRunEncodeUnicodeString
DynamicLoader: ntdll.dll/RtlInitUnicodeString
DynamicLoader: ntdll.dll/RtlRunDecodeUnicodeString
DynamicLoader: DUI70.dll/InitThread
DynamicLoader: DUser.dll/InitGadgets
DynamicLoader: USER32.dll/RegisterMessagePumpHook
DynamicLoader: DUI70.dll/?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ
DynamicLoader: DUI70.dll/?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
DynamicLoader: DUI70.dll/??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
DynamicLoader: DUI70.dll/?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
DynamicLoader: DUI70.dll/??0ClassInfoBase@DirectUI@@QEAA@XZ
DynamicLoader: DUI70.dll/?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
DynamicLoader: DUI70.dll/?Register@ClassInfoBase@DirectUI@@QEAAJXZ
DynamicLoader: DUI70.dll/?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
DynamicLoader: DUI70.dll/?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
DynamicLoader: DUI70.dll/?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
DynamicLoader: DUI70.dll/??1CritSecLock@DirectUI@@QEAA@XZ
DynamicLoader: DUI70.dll/??0CCBase@DirectUI@@QEAA@KPEBG@Z
DynamicLoader: DUI70.dll/?Initialize@CCBase@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
DynamicLoader: DUser.dll/CreateGadget
DynamicLoader: DUser.dll/SetGadgetMessageFilter
DynamicLoader: DUser.dll/SetGadgetStyle
DynamicLoader: DUI70.dll/?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
DynamicLoader: DUI70.dll/?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
DynamicLoader: DUI70.dll/?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
DynamicLoader: DUI70.dll/?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
DynamicLoader: DUI70.dll/?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
DynamicLoader: DUI70.dll/?SetFontSize@Element@DirectUI@@QEAAJH@Z
DynamicLoader: DUI70.dll/?SetWidth@Element@DirectUI@@QEAAJH@Z
DynamicLoader: DUI70.dll/?SetHeight@Element@DirectUI@@QEAAJH@Z
DynamicLoader: DUI70.dll/?EndDefer@Element@DirectUI@@QEAAXK@Z
DynamicLoader: DUI70.dll/?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
DynamicLoader: DUser.dll/InvalidateGadget
DynamicLoader: DUI70.dll/CreateDUIWrapper
DynamicLoader: SHELL32.dll/ExtractIconExW
DynamicLoader: COMCTL32.dll/TaskDialogIndirect
DynamicLoader: COMCTL32.dll/LoadIconWithScaleDown
DynamicLoader: ntdll.dll/RtlRunEncodeUnicodeString
DynamicLoader: ntdll.dll/RtlInitUnicodeString
DynamicLoader: ntdll.dll/RtlRunDecodeUnicodeString
DynamicLoader: DUser.dll/InitGadgets
DynamicLoader: dwmapi.dll/DwmIsCompositionEnabled
DynamicLoader: uxtheme.dll/IsThemeActive
DynamicLoader: DUser.dll/CreateGadget
DynamicLoader: DUser.dll/SetGadgetMessageFilter
DynamicLoader: DUser.dll/SetGadgetStyle
DynamicLoader: DUser.dll/SetGadgetRootInfo
DynamicLoader: dwmapi.dll/DwmIsCompositionEnabled
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/GetThemeAppProperties
DynamicLoader: ole32.dll/CreateStreamOnHGlobal
DynamicLoader: xmllite.dll/CreateXmlReader
DynamicLoader: xmllite.dll/CreateXmlReaderInputWithEncodingName
DynamicLoader: uxtheme.dll/OpenThemeData
DynamicLoader: uxtheme.dll/GetThemeMargins
DynamicLoader: uxtheme.dll/GetThemeFont
DynamicLoader: uxtheme.dll/GetThemeColor
DynamicLoader: uxtheme.dll/GetThemeMetric
DynamicLoader: OLEAUT32.dll/
DynamicLoader: DUser.dll/SetGadgetParent
DynamicLoader: DUser.dll/GetDUserModule
DynamicLoader: xmllite.dll/CreateXmlReader
DynamicLoader: xmllite.dll/CreateXmlReaderInputWithEncodingName
DynamicLoader: DUser.dll/FindStdColor
DynamicLoader: DUser.dll/AttachWndProcW
DynamicLoader: COMCTL32.dll/RegisterClassNameW
DynamicLoader: DUser.dll/GetGadgetRect
DynamicLoader: DUser.dll/GetGadgetRgn
DynamicLoader: DUser.dll/GetGadgetTicket
DynamicLoader: GDI32.dll/GetLayout
DynamicLoader: GDI32.dll/GdiRealizationInfo
DynamicLoader: GDI32.dll/FontIsLinked
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: GDI32.dll/GetTextFaceAliasW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: GDI32.dll/GetFontAssocStatus
DynamicLoader: ADVAPI32.dll/RegQueryValueExA
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: GDI32.dll/GetTextFaceAliasW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: COMCTL32.dll/RegisterClassNameW
DynamicLoader: DUser.dll/SetGadgetRootInfo
DynamicLoader: DUI70.dll/?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
DynamicLoader: DUI70.dll/?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
DynamicLoader: DUser.dll/SetGadgetParent
DynamicLoader: DUI70.dll/?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
DynamicLoader: DUser.dll/AttachWndProcW
DynamicLoader: DUI70.dll/?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z
DynamicLoader: COMCTL32.dll/RegisterClassNameW
DynamicLoader: uxtheme.dll/EnableThemeDialogTexture
DynamicLoader: DUI70.dll/?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
DynamicLoader: DUI70.dll/?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
DynamicLoader: COMCTL32.dll/HIMAGELIST_QueryInterface
DynamicLoader: COMCTL32.dll/DrawShadowText
DynamicLoader: COMCTL32.dll/DrawSizeBox
DynamicLoader: COMCTL32.dll/DrawScrollBar
DynamicLoader: COMCTL32.dll/SizeBoxHwnd
DynamicLoader: COMCTL32.dll/ScrollBar_MouseMove
DynamicLoader: COMCTL32.dll/ScrollBar_Menu
DynamicLoader: COMCTL32.dll/HandleScrollCmd
DynamicLoader: COMCTL32.dll/DetachScrollBars
DynamicLoader: COMCTL32.dll/AttachScrollBars
DynamicLoader: COMCTL32.dll/CCSetScrollInfo
DynamicLoader: COMCTL32.dll/CCGetScrollInfo
DynamicLoader: COMCTL32.dll/CCEnableScrollBar
DynamicLoader: COMCTL32.dll/QuerySystemGestureStatus
DynamicLoader: uxtheme.dll/
DynamicLoader: uxtheme.dll/CloseThemeData
DynamicLoader: DUI70.dll/?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z
DynamicLoader: DUser.dll/GetGadgetRect
DynamicLoader: DUser.dll/GetGadgetRgn
DynamicLoader: DUI70.dll/?IsContentProtected@Element@DirectUI@@UEAA_NXZ
DynamicLoader: COMCTL32.dll/RegisterClassNameW
DynamicLoader: uxtheme.dll/GetThemeBool
DynamicLoader: DUser.dll/InvalidateGadget
DynamicLoader: DUser.dll/GetGadgetFocus
DynamicLoader: uxtheme.dll/GetThemeBackgroundContentRect
DynamicLoader: uxtheme.dll/GetThemeTextMetrics
DynamicLoader: uxtheme.dll/GetThemePartSize
DynamicLoader: uxtheme.dll/GetThemeTextExtent
DynamicLoader: uxtheme.dll/GetThemeBackgroundExtent
DynamicLoader: DUser.dll/SetGadgetFocus
DynamicLoader: DUser.dll/DUserSendEvent
DynamicLoader: DUser.dll/SetGadgetRect
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: COMCTL32.dll/SetWindowSubclass
DynamicLoader: COMCTL32.dll/DefSubclassProc
DynamicLoader: DUI70.dll/?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: uxtheme.dll/
DynamicLoader: uxtheme.dll/BufferedPaintInit
DynamicLoader: uxtheme.dll/BeginBufferedPaint
DynamicLoader: uxtheme.dll/BufferedPaintInit
DynamicLoader: uxtheme.dll/BufferedPaintRenderAnimation
DynamicLoader: uxtheme.dll/BeginBufferedAnimation
DynamicLoader: uxtheme.dll/IsThemeBackgroundPartiallyTransparent
DynamicLoader: uxtheme.dll/DrawThemeParentBackground
DynamicLoader: uxtheme.dll/DrawThemeBackground
DynamicLoader: uxtheme.dll/DrawThemeText
DynamicLoader: uxtheme.dll/EndBufferedAnimation
DynamicLoader: uxtheme.dll/GetThemeTransitionDuration
DynamicLoader: uxtheme.dll/GetBufferedPaintDC
DynamicLoader: uxtheme.dll/GetBufferedPaintTargetDC
DynamicLoader: uxtheme.dll/EndBufferedPaint
DynamicLoader: DUser.dll/ForwardGadgetMessage
DynamicLoader: COMCTL32.dll/RegisterClassNameW
DynamicLoader: xmllite.dll/CreateXmlReader
DynamicLoader: xmllite.dll/CreateXmlReaderInputWithEncodingName
DynamicLoader: xmllite.dll/CreateXmlReader
DynamicLoader: xmllite.dll/CreateXmlReaderInputWithEncodingName
DynamicLoader: COMCTL32.dll/RegisterClassNameW
DynamicLoader: uxtheme.dll/GetThemeInt
DynamicLoader: DUser.dll/DUserPostEvent
DynamicLoader: DUser.dll/DisableContainerHwnd
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: uxtheme.dll/BufferedPaintUnInit
DynamicLoader: werui.dll/WerUIUpdateUIForState
DynamicLoader: DUser.dll/DeleteHandle
DynamicLoader: DUser.dll/DetachWndProc
DynamicLoader: COMCTL32.dll/RemoveWindowSubclass
DynamicLoader: DUI70.dll/?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
DynamicLoader: DUser.dll/DisableContainerHwnd
DynamicLoader: DUI70.dll/?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
DynamicLoader: DUI70.dll/?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
DynamicLoader: DUI70.dll/?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
DynamicLoader: uxtheme.dll/BufferedPaintStopAllAnimations
DynamicLoader: uxtheme.dll/BufferedPaintUnInit
DynamicLoader: DUI70.dll/??1CCBase@DirectUI@@UEAA@XZ
DynamicLoader: uxtheme.dll/DrawThemeParentBackgroundEx
DynamicLoader: uxtheme.dll/GetThemeEnumValue
DynamicLoader: uxtheme.dll/BeginBufferedPaint
DynamicLoader: uxtheme.dll/EndBufferedPaint
DynamicLoader: USER32.dll/MsgWaitForMultipleObjects
DynamicLoader: WINHTTP.dll/WinHttpOpen
DynamicLoader: WINHTTP.dll/WinHttpSetTimeouts
DynamicLoader: WINHTTP.dll/WinHttpSetOption
DynamicLoader: WINHTTP.dll/WinHttpConnect
DynamicLoader: WINHTTP.dll/WinHttpOpenRequest
DynamicLoader: WINHTTP.dll/WinHttpSetStatusCallback
DynamicLoader: WINHTTP.dll/WinHttpGetDefaultProxyConfiguration
DynamicLoader: WINHTTP.dll/WinHttpGetIEProxyConfigForCurrentUser
DynamicLoader: DUser.dll/FindGadgetFromPoint
DynamicLoader: WINHTTP.dll/WinHttpGetProxyForUrl
DynamicLoader: WINHTTP.dll/WinHttpSendRequest
DynamicLoader: WS2_32.dll/GetAddrInfoW
DynamicLoader: WS2_32.dll/WSASocketW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSAIoctl
DynamicLoader: WS2_32.dll/FreeAddrInfoW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSARecv
DynamicLoader: WS2_32.dll/WSASend
DynamicLoader: WINHTTP.dll/WinHttpReceiveResponse
DynamicLoader: WINHTTP.dll/WinHttpQueryHeaders
DynamicLoader: WINHTTP.dll/WinHttpReadData
DynamicLoader: WS2_32.dll/
DynamicLoader: WINHTTP.dll/WinHttpCloseHandle
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: WS2_32.dll/
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/IsValidSid
DynamicLoader: ADVAPI32.dll/GetLengthSid
DynamicLoader: ADVAPI32.dll/CopySid
DynamicLoader: SHELL32.dll/SHGetFolderPathW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/RegisterEventSourceW
DynamicLoader: ADVAPI32.dll/ReportEventW
DynamicLoader: ADVAPI32.dll/DeregisterEventSource
DynamicLoader: werui.dll/WerUITerminate
DynamicLoader: DUser.dll/DUserFlushMessages
DynamicLoader: DUser.dll/DUserFlushDeferredMessages
DynamicLoader: DUI70.dll/UnInitThread
DynamicLoader: DUser.dll/DUserFlushMessages
DynamicLoader: DUser.dll/DUserFlushDeferredMessages
DynamicLoader: DUser.dll/DeleteHandle
DynamicLoader: USER32.dll/UnregisterMessagePumpHook
DynamicLoader: werui.dll/WerUIDelete
DynamicLoader: DUI70.dll/UnInitProcessPriv
DynamicLoader: DUI70.dll/?Release@ClassInfoBase@DirectUI@@UEAAHXZ
DynamicLoader: DUI70.dll/?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
DynamicLoader: DUI70.dll/??1ClassInfoBase@DirectUI@@UEAA@XZ
DynamicLoader: SHLWAPI.dll/PathIsDirectoryW
DynamicLoader: wer.dll/WerReportCloseHandle
DynamicLoader: ADVAPI32.dll/DuplicateToken
DynamicLoader: wer.dll/WerpFreeString
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: wkscli.dll/NetGetJoinInformation
DynamicLoader: netutils.dll/NetApiBufferFree
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: IMM32.dll/ImmDisableIME
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextW
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: SHLWAPI.dll/PathIsDirectoryW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegNotifyChangeKeyValue
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/CLSIDFromOle1Class
DynamicLoader: CLBCatQ.DLL/GetCatalogObject
DynamicLoader: CLBCatQ.DLL/GetCatalogObject2
DynamicLoader: tschannel.dll/DllGetClassObject
DynamicLoader: tschannel.dll/DllCanUnloadNow
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: uxtheme.dll/ThemeInitApiHook
DynamicLoader: SHLWAPI.dll/PathIsPrefixW
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: XmlLite.dll/CreateXmlReader
DynamicLoader: USER32.dll/IsProcessDPIAware
DynamicLoader: dwmapi.dll/DwmIsCompositionEnabled
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: uxtheme.dll/ThemeInitApiHook
DynamicLoader: USER32.dll/IsProcessDPIAware
DynamicLoader: dwmapi.dll/DwmIsCompositionEnabled
DynamicLoader: RPCRT4.dll/UuidFromStringW
DynamicLoader: radarrs.dll/WdiDiagnosticModuleMain
DynamicLoader: radarrs.dll/WdiHandleInstance
DynamicLoader: radarrs.dll/WdiGetDiagnosticModuleInterfaceVersion
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextW
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: SHLWAPI.dll/PathIsDirectoryW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegNotifyChangeKeyValue
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/CLSIDFromOle1Class
DynamicLoader: CLBCatQ.DLL/GetCatalogObject
DynamicLoader: CLBCatQ.DLL/GetCatalogObject2
DynamicLoader: tschannel.dll/DllGetClassObject
DynamicLoader: tschannel.dll/DllCanUnloadNow
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: uxtheme.dll/ThemeInitApiHook
DynamicLoader: SHLWAPI.dll/PathIsPrefixW
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: XmlLite.dll/CreateXmlReader
DynamicLoader: USER32.dll/IsProcessDPIAware
DynamicLoader: dwmapi.dll/DwmIsCompositionEnabled
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/GetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/SetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/LocaleNameToLCID
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCIDToLocaleName
DynamicLoader: kernel32.dll/GetSystemDefaultLocaleName
DynamicLoader: fastprox.dll/DllGetClassObject
DynamicLoader: fastprox.dll/DllCanUnloadNow
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: PSAPI.DLL/EnumProcesses
DynamicLoader: PSAPI.DLL/EnumProcessModules
DynamicLoader: PSAPI.DLL/GetModuleBaseNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/GetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/SetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/LocaleNameToLCID
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCIDToLocaleName
DynamicLoader: kernel32.dll/GetSystemDefaultLocaleName
DynamicLoader: FastProx.dll/DllGetClassObject
DynamicLoader: FastProx.dll/DllCanUnloadNow
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CLSIDFromString
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextW
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: SHLWAPI.dll/PathIsDirectoryW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegNotifyChangeKeyValue
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/CLSIDFromOle1Class
DynamicLoader: CLBCatQ.DLL/GetCatalogObject
DynamicLoader: CLBCatQ.DLL/GetCatalogObject2
DynamicLoader: tschannel.dll/DllGetClassObject
DynamicLoader: tschannel.dll/DllCanUnloadNow
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: uxtheme.dll/ThemeInitApiHook
DynamicLoader: SHLWAPI.dll/PathIsPrefixW
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: XmlLite.dll/CreateXmlReader
DynamicLoader: USER32.dll/IsProcessDPIAware
DynamicLoader: dwmapi.dll/DwmIsCompositionEnabled

At least one IP Address, Domain, or File Name was found in a crypto call Severity: Medium Confidence: Very High

ioc: 1.0.0.0
ioc: pplication.app
ioc: asm.v2
ioc: inetsim.org0

A process created a hidden window Severity: Medium Confidence: Very High

Process: doc.exe -> "schtasks.exe" /query
Process: doc.exe -> "schtasks.exe" /create /sc MINUTE /tn egjbJb /MO 1 /tr "C:\ProgramData\null\

Attempts to connect to a dead IP:Port (3 unique times) Severity: Low Confidence: Very High

IP: 192.168.56.1:443
IP: 192.168.56.1:80
IP: 192.168.56.1:1348

At least one process apparently crashed during execution Severity: Low Confidence: Very High

SetUnhandledExceptionFilter detected (possible anti-debug) Severity: Low Confidence: Very High

Behavior analysis details
Machine name	Machine label	Machine manager	Started	Ended	Duration
Seven05b_64	Seven05b_64	VirtualBox	2018-09-27 04:02:19	2018-09-27 04:05:38	199

12 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\doc.exe.config
C:\Users\Seven01\AppData\Local\Temp\doc.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
\Device\KsecDD
C:\Windows\assembly\NativeImages_v4.0.30319_32\NxusaKQ52ftRS7DC\*
C:\Users\Seven01\AppData\Local\Temp\doc.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol28.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.tmp
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.0.cs
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.dll
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.cmdline
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.out
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.err
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.pdb
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Users\Seven01\AppData\Local\Temp\doc.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll
\Device\NamedPipe\
\Device\NamedPipe
C:\ProgramData
C:\ProgramData\null
C:\ProgramData\null:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egjbJb.url
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\GAC_64
C:\Windows\assembly\GAC_64\mscorlib.resources
C:\Windows\assembly\GAC_32
C:\Windows\assembly\GAC_32\mscorlib.resources
C:\Windows\assembly\GAC_MSIL
C:\Windows\assembly\GAC_MSIL\mscorlib.resources
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\*
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC
C:\Windows\assembly\GAC\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC_64
C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC_32
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC_MSIL
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\mscorlib.resources
C:\Windows\Microsoft.Net\assembly\GAC
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\cscui.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\0\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\0\cscui.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\default.win32manifest
C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll
C:\Windows\System32\mscoree.dll.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\System.Management.dll
C:\Windows
C:\Windows\Microsoft.NET
C:\Windows\Microsoft.NET\Framework
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.dll
C:\Users\Seven01\AppData\Local\Temp\System.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.dll
C:\Users\Seven01\AppData\Local\Temp\System.Drawing.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll
C:\Users\Seven01\AppData\Local\Temp\System.Core.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Core.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
C:\Users\Seven01\AppData\Local\Temp\CSC815331D32F834CE6877A45412C204ED2.TMP
C:\Users\Seven01\AppData\Local\Temp\RES1756.tmp
C:\Windows\System32\tzres.dll
C:\Windows\System32\it-IT\tzres.dll.mui
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\tyu.dat
C:\Windows\Temp
C:\Windows\sysnative\Tasks\Microsoft\Windows\WDI\ResolutionHost
C:\Windows\sysnative\LogFiles\Scm\9435f817-fed2-454e-88cd-7f78fda62c48
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Windows\sysnative\wbem\WmiPrvSE.exe
C:\Windows\sysnative\Tasks
C:\Windows\sysnative\Tasks\Adobe Flash Player Updater
C:\Windows\System32\Macromed\Flash\mms.cfg
C:\Windows\System32\p2pcollab.dll
C:\Windows\System32\qagentrt.dll
C:\Windows\System32\dnsapi.dll
C:\Windows\SysWOW64\it-IT\CRYPT32.dll.mui
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\*
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\*
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\*
C:\Windows\System32\it-IT\WINHTTP.dll.mui
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
C:\Windows\Temp\Cab82C2.tmp
C:\Windows\Temp\Tar82C3.tmp
C:\Windows\System32\Cab82C2.tmp
C:\Windows\Temp\
C:\ProgramData\Microsoft\Windows\WER\ReportQueue
C:\Windows\sysnative\it-IT\faultrep.dll.mui
C:\Windows\sysnative\winxp\triage.ini
C:\Windows\sysnative\WINXP
C:\Windows\sysnative\winext
C:\Windows\sysnative\winext\arcade
C:\Windows\sysnative\pri
C:\Windows\sysnative
C:\Windows\sysnative\
C:\ProgramData\Oracle\Java\javapath
C:\ProgramData\Oracle\Java\javapath\
C:\Windows\
C:\Windows\sysnative\wbem
C:\Windows\sysnative\wbem\
C:\Windows\sysnative\WindowsPowerShell\v1.0
C:\Windows\sysnative\WindowsPowerShell\v1.0\
C:\Windows\sysnative\WINXP\dbghelp.dll
C:\Windows\sysnative\winext\dbghelp.dll
C:\Windows\sysnative\winext\arcade\dbghelp.dll
C:\Windows\sysnative\pri\dbghelp.dll
C:\Windows\sysnative\dbghelp.dll
C:\Windows\sysnative\WINXP\ext.dll
C:\Windows\sysnative\winext\ext.dll
C:\Windows\sysnative\winext\arcade\ext.dll
C:\Windows\sysnative\pri\ext.dll
C:\Windows\sysnative\ext.dll
C:\ProgramData\Oracle\Java\javapath\ext.dll
C:\Windows\ext.dll
C:\Windows\sysnative\wbem\ext.dll
C:\Windows\sysnative\WindowsPowerShell\v1.0\ext.dll
C:\Windows\sysnative\it-IT\KERNELBASE.dll.mui
C:\Windows\sysnative\WINXP\exts.dll
C:\Windows\sysnative\winext\exts.dll
C:\Windows\sysnative\winext\arcade\exts.dll
C:\Windows\sysnative\pri\exts.dll
C:\Windows\sysnative\exts.dll
C:\ProgramData\Oracle\Java\javapath\exts.dll
C:\Windows\exts.dll
C:\Windows\sysnative\wbem\exts.dll
C:\Windows\sysnative\WindowsPowerShell\v1.0\exts.dll
C:\Windows\sysnative\WINXP\uext.dll
C:\Windows\sysnative\winext\uext.dll
C:\Windows\sysnative\winext\arcade\uext.dll
C:\Windows\sysnative\pri\uext.dll
C:\Windows\sysnative\uext.dll
C:\ProgramData\Oracle\Java\javapath\uext.dll
C:\Windows\uext.dll
C:\Windows\sysnative\wbem\uext.dll
C:\Windows\sysnative\WindowsPowerShell\v1.0\uext.dll
C:\Windows\sysnative\WINXP\ntsdexts.dll
C:\Windows\sysnative\winext\ntsdexts.dll
C:\Windows\sysnative\winext\arcade\ntsdexts.dll
C:\Windows\sysnative\pri\ntsdexts.dll
C:\Windows\sysnative\ntsdexts.dll
C:\ProgramData\Oracle\Java\javapath\ntsdexts.dll
C:\Windows\ntsdexts.dll
C:\Windows\sysnative\wbem\ntsdexts.dll
C:\Windows\sysnative\WindowsPowerShell\v1.0\ntsdexts.dll
C:\Windows\sysnative\it-IT\wer.dll.mui
C:\Windows\sysnative\taskeng.exe
C:\Windows\sysnative\it-IT\werui.dll.mui
C:\Windows\sysnative\werui.dll
C:\Windows\sysnative\it-IT\DUser.dll.mui
C:\Windows\sysnative\WerFault.exe.Local\
C:\Windows\winsxs\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_it-it_9d1a65120dd4a268
C:\Windows\winsxs\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_it-it_9d1a65120dd4a268\COMCTL32.dll.mui
C:\Windows\Fonts\staticcache.dat
C:\Windows\win.ini
C:\Windows\sysnative\uxtheme.dll.Config
C:\Windows\sysnative\uxtheme.dll
C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac
C:\Windows\sysnative\it-IT\erofflps.txt
C:\Users\Seven01\AppData\Local\Temp\
C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp
C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp.WERInternalMetadata.xml
C:\Windows\sysnative\drivers\*.mrk
C:\Users\Seven01\AppData\Local\Microsoft\Windows\WER\ReportArchive
C:\Users\Seven01\AppData\Local\Microsoft\Windows\WER\ReportArchive\*_*_*_*
C:\Users\Seven01\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_taskeng.exe_f9d469e66c32c9e4ad655c66671861d461961a7_08f0d93f
C:\Users\Seven01\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_taskeng.exe_f9d469e66c32c9e4ad655c66671861d461961a7_08f0d93f\Report.wer
\??\PIPE\wkssvc
C:\DosDevices\pipe\
C:\Windows\sysnative\WerFault.exe
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Application.evtx
C:\Windows\sysnative\fthsvc.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Fault-Tolerant-Heap%4Operational.evtx
C:\Windows\sysnative\diagperf.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WindowsBackup%4ActionCenter.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4WHC.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx
C:\Windows\sysnative\radarrs.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\System.evtx
C:\Windows\sysnative\RacEngn.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx
C:\Windows\sysnative\shell32.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx
C:\Windows\sysnative\Tasks\egjbJb
C:\ProgramData\null\
C:\ProgramData\null\.COM
C:\ProgramData\null\.EXE
C:\ProgramData\null\.BAT
C:\ProgramData\null\.CMD
C:\ProgramData\null\.VBS
C:\ProgramData\null\.VBE
C:\ProgramData\null\.JS
C:\ProgramData\null\.JSE
C:\ProgramData\null\.WSF
C:\ProgramData\null\.WSH
C:\ProgramData\null\.MSC
C:\Windows\sysnative\it-IT\radarrs.dll.mui
C:\Windows\sysnative\wbem\WMIADAP.exe
C:\Windows\sysnative\it-IT\USER32.dll.mui
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\WMIDataDevice
C:\Windows\sysnative\advapi32.dll
C:\Windows\sysnative\it-IT\advapi32.dll.mui
C:\Windows\sysnative\drivers\acpi.sys
C:\Windows\sysnative\drivers\it-IT\ACPI.sys.mui
C:\Windows\sysnative\drivers\ndis.sys
C:\Windows\sysnative\drivers\it-IT\ndis.sys.mui
C:\Windows\sysnative\drivers\mssmbios.sys
C:\Windows\sysnative\drivers\it-IT\mssmbios.sys.mui
C:\Windows\sysnative\drivers\hdaudbus.sys
C:\Windows\sysnative\drivers\it-IT\HDAudBus.sys.mui
C:\Windows\sysnative\drivers\intelppm.sys
C:\Windows\sysnative\drivers\it-IT\intelppm.sys.mui
C:\Windows\sysnative\drivers\portcls.sys
C:\Windows\sysnative\drivers\it-IT\portcls.SYS.mui
C:\Windows\sysnative\drivers\monitor.sys
C:\Windows\sysnative\drivers\it-IT\monitor.sys
C:\Windows\sysnative\drivers\it\monitor.sys
C:\Windows\sysnative\it-IT\ADVAPI32.dll.mui
C:\Windows\sysnative\wbem\it-IT\mofd.dll.mui

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\doc.exe.config
C:\Users\Seven01\AppData\Local\Temp\doc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol28.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.dll
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.pdb
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
\Device\NamedPipe\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\cscui.dll
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.cmdline
C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.0.cs
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Core.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\default.win32manifest
C:\Users\Seven01\AppData\Local\Temp\CSC815331D32F834CE6877A45412C204ED2.TMP
C:\Users\Seven01\AppData\Local\Temp\RES1756.tmp
C:\Windows\System32\tzres.dll
C:\Windows\System32\it-IT\tzres.dll.mui
C:\Users\Seven01\AppData\Roaming\tyu.dat
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Windows\sysnative\wbem\WmiPrvSE.exe
C:\Windows\sysnative\Tasks\Adobe Flash Player Updater
C:\Windows\System32\Macromed\Flash\mms.cfg
C:\Windows\SysWOW64\it-IT\CRYPT32.dll.mui
C:\Windows\System32\it-IT\WINHTTP.dll.mui
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
C:\Windows\Temp\Cab82C2.tmp
C:\Windows\Temp\Tar82C3.tmp
C:\Windows\sysnative\it-IT\faultrep.dll.mui
C:\Windows\sysnative\winxp\triage.ini
C:\Windows\sysnative\it-IT\KERNELBASE.dll.mui
C:\Windows\sysnative\it-IT\wer.dll.mui
C:\Windows\sysnative\it-IT\werui.dll.mui
C:\Windows\sysnative\werui.dll
C:\Windows\sysnative\taskeng.exe
C:\Windows\sysnative\it-IT\DUser.dll.mui
C:\Windows\winsxs\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_it-it_9d1a65120dd4a268\COMCTL32.dll.mui
C:\Windows\Fonts\staticcache.dat
C:\Windows\win.ini
C:\Windows\sysnative\uxtheme.dll.Config
C:\Windows\sysnative\uxtheme.dll
C:\Windows\sysnative\it-IT\erofflps.txt
C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp
C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp.WERInternalMetadata.xml
\??\PIPE\wkssvc
C:\Windows\sysnative\WerFault.exe
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx
C:\Windows\sysnative\fthsvc.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Fault-Tolerant-Heap%4Operational.evtx
C:\Windows\sysnative\diagperf.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4WHC.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx
C:\Windows\sysnative\radarrs.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx
C:\Windows\sysnative\RacEngn.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx
C:\Windows\sysnative\shell32.dll
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx
C:\Windows\sysnative\Tasks\egjbJb
C:\Windows\sysnative\it-IT\radarrs.dll.mui
C:\Windows\sysnative\it-IT\USER32.dll.mui
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\WMIDataDevice
C:\Windows\sysnative\advapi32.dll
C:\Windows\sysnative\drivers\acpi.sys
C:\Windows\sysnative\drivers\ndis.sys
C:\Windows\sysnative\drivers\mssmbios.sys
C:\Windows\sysnative\drivers\hdaudbus.sys
C:\Windows\sysnative\drivers\intelppm.sys
C:\Windows\sysnative\drivers\portcls.sys
C:\Windows\sysnative\drivers\monitor.sys
C:\Windows\sysnative\it-IT\ADVAPI32.dll.mui
C:\Windows\sysnative\wbem\it-IT\mofd.dll.mui

Write Files

C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.tmp
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.0.cs
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.dll
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.cmdline
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.out
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.err
\Device\NamedPipe
C:\ProgramData\null
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egjbJb.url
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.pdb
C:\Users\Seven01\AppData\Local\Temp\CSC815331D32F834CE6877A45412C204ED2.TMP
C:\Users\Seven01\AppData\Local\Temp\RES1756.tmp
C:\Users\Seven01\AppData\Roaming\tyu.dat
C:\Windows\sysnative\LogFiles\Scm\9435f817-fed2-454e-88cd-7f78fda62c48
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
C:\Windows\Temp\Cab82C2.tmp
C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp.WERInternalMetadata.xml
C:\Users\Seven01\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_taskeng.exe_f9d469e66c32c9e4ad655c66671861d461961a7_08f0d93f\Report.wer
\??\PIPE\wkssvc
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Fault-Tolerant-Heap%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4WHC.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx
C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\WMIDataDevice

Delete Files

C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.out
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.tmp
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.pdb
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.dll
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.err
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.cmdline
C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.0.cs
C:\ProgramData\null:Zone.Identifier
C:\Users\Seven01\AppData\Local\Temp\RES1756.tmp
C:\Users\Seven01\AppData\Local\Temp\CSC815331D32F834CE6877A45412C204ED2.TMP
C:\Windows\Temp\Cab82C2.tmp
C:\Windows\Temp\Tar82C3.tmp
C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp
C:\Users\Seven01\AppData\Local\Temp\WERA84C.tmp.WERInternalMetadata.xml

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\doc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index28
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CMF\Config
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\doc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\CB25D8E0
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FORCE_ASSEMREF_DUPCHECK
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NicPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\RegistryRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath2
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_CURRENT_USER\Software\Classes\AppID\schtasks.exe
HKEY_CURRENT_USER\Software\dfchgghFTYcfthc-GDL63T\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProductName
HKEY_CURRENT_USER\Software\dfchgghFTYcfthc-GDL63T\exepath
HKEY_CURRENT_USER\Software\dfchgghFTYcfthc-GDL63T\lic
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSAT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\PrimaryAdapterString
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\WOW64
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\WOW64
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v4.0.30319_64
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v4.0.30319_64\RequiredPrivileges
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000\ProfileImagePath
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Environment
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Volatile Environment
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v4.0.30319_32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v4.0.30319_32\RequiredPrivileges
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LaunchPermission
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LoadUserSettings
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\PowerRequestOverride\Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32\ServerExecutable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\DllSurrogate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\Elevation
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\taskeng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\DataVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\EnableBackCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\MissedTasksStartupDelay
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksInMemoryQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksPerHighestPrivEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksPerLeastPrivEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TracingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\WindowSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\6BA0E3C1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{F0E60508-5097-477E-820E-81E7A7771BE3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{F0E60508-5097-477E-820E-81E7A7771BE3}\data
HKEY_CURRENT_USER
HKEY_USERS\.DEFAULT\Control Panel\International
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia\FlashPlayerSAU
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerSAU\LastUpdateCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerSAU\CheckFrequency
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextLockCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextListCount
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\4b\7F06864B
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\4B\7F06864B\LanguageList
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\AuthRoot
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\ChainEngine\Config
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MinRsaPubKeyBitLength
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRsaPubKeyTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\My\PhysicalStores
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\My
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\My\
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\My\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\My\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\My\CTLs
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\My\Keys
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\CA\PhysicalStores
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\CA
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs
HKEY_USERS\.DEFAULT\
HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CTLs
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\1916A2AF346D399F50313C393200F14140456616
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\1916A2AF346D399F50313C393200F14140456616\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2A83E9020591A55FC6DDAD3FB102794C52B24E70
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2A83E9020591A55FC6DDAD3FB102794C52B24E70\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\3A850044D8A195CD401A680C012CB0A3B5F8DC08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\3A850044D8A195CD401A680C012CB0A3B5F8DC08\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F38777AF4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F38777AF4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\471C949A8143DB5AD5CDF1C972864A2504FA23C9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\471C949A8143DB5AD5CDF1C972864A2504FA23C9\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29CD4151A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29CD4151A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76BDB77D0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76BDB77D0\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\6431723036FD26DEA502792FA595922493030F97
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\6431723036FD26DEA502792FA595922493030F97\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\80962AE4D6C5B442894E95A13E4A699E07D694CF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\80962AE4D6C5B442894E95A13E4A699E07D694CF\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\86E817C81A5CA672FE000F36F878C19518D6F844
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\86E817C81A5CA672FE000F36F878C19518D6F844\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D197730AB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D197730AB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\9845A431D51959CAF225322B4A4FE9F223CE6D15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\9845A431D51959CAF225322B4A4FE9F223CE6D15\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B533345D06F64516403C00DA03187D3BFEF59156
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B533345D06F64516403C00DA03187D3BFEF59156\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\CEA586B2CE593EC7D939898337C57814708AB2BE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\CEA586B2CE593EC7D939898337C57814708AB2BE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\D018B62DC518907247DF50925BB09ACF4A5CB3AD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\D018B62DC518907247DF50925BB09ACF4A5CB3AD\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\F8A54E03AADC5692B850496A4C4630FFEAA29D83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\F8A54E03AADC5692B850496A4C4630FFEAA29D83\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D74DEE97
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D74DEE97\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\Root\PhysicalStores
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\Root
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\Root\ProtectedRoots
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\SmartCardRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CTLs
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\trust\PhysicalStores
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\trust
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs
HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs
HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\trust
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\System\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates
HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\SystemCertificates
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\SchemeDllRetrieveEncodedObjectW
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\SchemeDllRetrieveEncodedObjectW
HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings\Wpad
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableInetUnknownAuth
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Escalation
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\F8B50CC5
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyCertificateChainPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCertificateChainPolicy
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\WerSvcGroup
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wersvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Parameters\ServiceDll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Parameters\ServiceManifest
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Parameters\ServiceMain
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ServiceTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\NoReflection
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Windows Error Reporting\NoReflection
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\PropertyBag
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskeng.exe
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Error Reporting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TraceFlags
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Debug
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\NoReflection
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\ExceptionRecord
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\WaitonExceptionRecord
HKEY_CURRENT_USER\Software\Microsoft\Windiff
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\WaitOnStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MachineID
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Consent
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Consent\DefaultConsent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DontSendAdditionalData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\DefaultConsent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\DefaultOverrideBehavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\APPCRASH
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LoggingDisabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DontShowUI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableArchive
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ConfigureArchive
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxQueueCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxArchiveCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\QueuePesterInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\SendEFSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\BypassDataThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceUserModeCabCollection
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Error Reporting
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\DontSendAdditionalData
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Disabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Consent\DefaultOverrideBehavior
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Consent\APPCRASH
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\LoggingDisabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\DontShowUI
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\DisableArchive
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\ConfigureArchive
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\DisableQueue
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\MaxQueueCount
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\MaxArchiveCount
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\ForceQueue
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\QueuePesterInterval
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\ExcludedApplications
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\DebugApplications
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\SendEFSFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\BypassDataThrottling
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\ForceUserModeCabCollection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUseSSL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerPortNumber
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUseAuthentication
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Reliability Analysis\RAC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Reliability Analysis\RAC\RacWerSampleTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\OfflineMode
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\DirectUI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles\FirstLevelConsentDialog
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles\FirstLevelConsentDialog
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles\CheckingForSolutionDialog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles\CheckingForSolutionDialog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuildLabEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDBuildNumber
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\BIOSVersion
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Windows\CSDBuildNumber
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\LastWatsonCabUploaded
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\6FD5A890
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\StoreLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\StoreLocation
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-WER-Diag/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Fault-Tolerant-Heap/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Diagnostics-Performance/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Diagnostics-Performance/Diagnostic
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\KeywordsLower
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\KeywordsUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\KeywordsLower
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\KeywordsUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\ChannelAccess
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Application\Windows Error Reporting
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Windows Error Reporting\ProviderGuid
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\System\Application Popup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\Application Popup\ProviderGuid
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-WindowsUpdateClient/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-NetworkAccessProtection/WHC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Windows Defender/WHC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Diagnosis-Scheduled/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-ReliabilityAnalysisComponent/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Known Folders API Service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\ChannelAccess
HKEY_CURRENT_USER\Software\Classes\AppID\taskeng.exe
HKEY_CURRENT_USER\Software\Classes\Interface\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}
HKEY_CURRENT_USER\Software\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}
HKEY_CURRENT_USER\Software\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\TreatAs
HKEY_CURRENT_USER\Software\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\Progid
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\Progid
HKEY_CURRENT_USER\Software\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{779DAEF3-50D5-428F-AC4D-7AC67F0A43C1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{779DAEF3-50D5-428F-AC4D-7AC67F0A43C1}\data
HKEY_CURRENT_USER\Software\Classes\AppID\taskhost.exe
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WDI\DiagnosticModules
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\NameResource
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WDI\Config
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\Config\ServerName
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\CLResolutionInterval
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\DisplayInterval
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\SkipWatson
HKEY_LOCAL_MACHINE\Software\Microsoft\RADAR\HeapLeakDetection\Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\Settings\ReflectionInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{3C96F6D3-8945-4F4E-AE55-C96C6478E1FA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{3C96F6D3-8945-4F4E-AE55-C96C6478E1FA}\data
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\WMIADAP.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ProcessID
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Sink Transmit Buffer Size
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Cimom
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\DefaultRpcStackSize
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\wmiprvse.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_CLASSES_ROOT\CLSID\{D2D588B5-D081-11d0-99E0-00C04FC2F8EC}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{D2D588B5-D081-11d0-99E0-00C04FC2F8EC}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\InprocServer32\Synchronization
HKEY_CLASSES_ROOT\CLSID\{D2D588B5-D081-11d0-99E0-00C04FC2F8EC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\AppId
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\WDM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM\IDE\DiskVBOX_HARDDISK___________________________1.0_____\5&33d1638a&0&0.0.0_0-{05901221-D566-11d1-B2F0-00A0C9062910}
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ACPI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ACPI\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ACPI\ImagePath
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NDIS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDIS\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDIS\ImagePath
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\mssmbios
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mssmbios\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mssmbios\ImagePath
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HDAudBus
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HDAudBus\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HDAudBus\ImagePath
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\intelppm
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelppm\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelppm\ImagePath
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\portcls
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\monitor
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\monitor\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\monitor\ImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM\WMIBinaryMofResource.HighDateTime=30016556,LowDateTime=1652017424,Name="C:\Windows\system32\advapi32.dll[MofResourceName]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{DBFD34CA-547A-4F62-B4EF-315873F7F907}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{DBFD34CA-547A-4F62-B4EF-315873F7F907}\data

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index28
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-us
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\CB25D8E0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FORCE_ASSEMREF_DUPCHECK
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NicPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\RegistryRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProductName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\PrimaryAdapterString
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\WOW64
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v4.0.30319_64\RequiredPrivileges
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000\ProfileImagePath
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v4.0.30319_32\RequiredPrivileges
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32\ServerExecutable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\DllSurrogate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\DataVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\EnableBackCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\MissedTasksStartupDelay
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksInMemoryQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksPerHighestPrivEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksPerLeastPrivEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TracingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\WindowSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\6BA0E3C1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaxSxSHashCount
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerSAU\LastUpdateCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerSAU\CheckFrequency
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextLockCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextListCount
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MinRsaPubKeyBitLength
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRsaPubKeyTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\1916A2AF346D399F50313C393200F14140456616\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2A83E9020591A55FC6DDAD3FB102794C52B24E70\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\3A850044D8A195CD401A680C012CB0A3B5F8DC08\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F38777AF4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\471C949A8143DB5AD5CDF1C972864A2504FA23C9\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29CD4151A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76BDB77D0\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\6431723036FD26DEA502792FA595922493030F97\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\80962AE4D6C5B442894E95A13E4A699E07D694CF\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\86E817C81A5CA672FE000F36F878C19518D6F844\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D197730AB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\9845A431D51959CAF225322B4A4FE9F223CE6D15\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B533345D06F64516403C00DA03187D3BFEF59156\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\CEA586B2CE593EC7D939898337C57814708AB2BE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\D018B62DC518907247DF50925BB09ACF4A5CB3AD\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\F8A54E03AADC5692B850496A4C4630FFEAA29D83\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D74DEE97\Blob
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableInetUnknownAuth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\F8B50CC5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\WerSvcGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Parameters\ServiceDll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Parameters\ServiceManifest
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Parameters\ServiceMain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ServiceTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\NoReflection
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Windows Error Reporting\NoReflection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TraceFlags
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\NoReflection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\WaitonExceptionRecord
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\WaitOnStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MachineID
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Consent\DefaultConsent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DontSendAdditionalData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\DefaultConsent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\DefaultOverrideBehavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\APPCRASH
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LoggingDisabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DontShowUI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableArchive
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ConfigureArchive
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxQueueCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxArchiveCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\QueuePesterInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\SendEFSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\BypassDataThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceUserModeCabCollection
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\DontSendAdditionalData
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Disabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Consent\DefaultOverrideBehavior
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Consent\APPCRASH
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\LoggingDisabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\DontShowUI
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\DisableArchive
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\ConfigureArchive
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\DisableQueue
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\MaxQueueCount
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\MaxArchiveCount
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\ForceQueue
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\QueuePesterInterval
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\SendEFSFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\BypassDataThrottling
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\ForceUserModeCabCollection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUseSSL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerPortNumber
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUseAuthentication
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Reliability Analysis\RAC\RacWerSampleTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\OfflineMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuildLabEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDBuildNumber
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\BIOSVersion
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Windows\CSDBuildNumber
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\LastWatsonCabUploaded
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\6FD5A890
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WER-Diag/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Fault-Tolerant-Heap/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\KeywordsLower
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\KeywordsUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\KeywordsLower
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\KeywordsUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\ChannelAccess
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Windows Error Reporting\ProviderGuid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\Application Popup\ProviderGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ChannelAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\FileMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\FileCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\MinBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\MaxBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Latency
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\ClockType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\SidType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\ControlGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\MaxSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\MaxSizeUpper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Retention
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\AutoBackupLogFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\FilterId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\Isolation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\OwningPublisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Known Folders API Service\ChannelAccess
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\NeverLowerPagePriority
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\NameResource
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\Config\ServerName
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\CLResolutionInterval
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\DisplayInterval
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\SkipWatson
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\Settings\ReflectionInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ProcessID
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Sink Transmit Buffer Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\DefaultRpcStackSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2D588B5-D081-11D0-99E0-00C04FC2F8EC}\AppId
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ACPI\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ACPI\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDIS\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDIS\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mssmbios\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mssmbios\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HDAudBus\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HDAudBus\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelppm\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelppm\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\monitor\MofImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\monitor\ImagePath

Write Keys

HKEY_CURRENT_USER\Software\dfchgghFTYcfthc-GDL63T\
HKEY_CURRENT_USER\Software\dfchgghFTYcfthc-GDL63T\exepath
HKEY_CURRENT_USER\Software\dfchgghFTYcfthc-GDL63T\lic
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\Type
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{F0E60508-5097-477E-820E-81E7A7771BE3}\data
HKEY_USERS\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\4B\7F06864B\LanguageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerSAU\LastUpdateCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerSAU\CheckFrequency
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Debug
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\ExceptionRecord
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles\FirstLevelConsentDialog
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles\FirstLevelConsentDialog
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles\CheckingForSolutionDialog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles\CheckingForSolutionDialog
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\StoreLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\StoreLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{779DAEF3-50D5-428F-AC4D-7AC67F0A43C1}\data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{3C96F6D3-8945-4F4E-AE55-C96C6478E1FA}\data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM\IDE\DiskVBOX_HARDDISK___________________________1.0_____\5&33d1638a&0&0.0.0_0-{05901221-D566-11d1-B2F0-00A0C9062910}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{DBFD34CA-547A-4F62-B4EF-315873F7F907}\data

Delete Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM\WMIBinaryMofResource.HighDateTime=30016556,LowDateTime=1652017424,Name="C:\Windows\system32\advapi32.dll[MofResourceName]"

Mutexes

Remcos_Mutex_Inj
dfchgghFTYcfthc-GDL63T
Local\WERReportingForProcess3044
Global\\xe5\x88\x90\xc7\x8c
Global\ADAP_WMI_ENTRY
Global\RefreshRA_Mutex
Global\RefreshRA_Mutex_Lib
Global\RefreshRA_Mutex_Flag

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.GetNativeSystemInfo
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcess
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
kernel32.dll.GetTempPathW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
kernel32.dll.GetFullPathNameW
cryptsp.dll.CryptGetDefaultProviderW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
kernel32.dll.SetThreadErrorMode
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.GetFileAttributesExW
kernel32.dll.GetCurrentDirectoryW
kernel32.dll.GetStdHandle
kernel32.dll.GetEnvironmentStrings
kernel32.dll.GetEnvironmentStringsW
kernel32.dll.FreeEnvironmentStringsW
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.CreateProcessW
kernel32.dll.DuplicateHandle
kernel32.dll.GetExitCodeProcess
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
kernel32.dll.DeleteFileW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.FindResourceA
kernel32.dll.SizeofResource
kernel32.dll.LoadResource
kernel32.dll.LockResource
gdiplus.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipCreateBitmapFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
shell32.dll.SHGetFolderPathW
kernel32.dll.LocalFree
kernel32.dll.CreatePipe
kernel32.dll.GetConsoleOutputCP
kernel32.dll.CopyFileW
kernel32.dll.DeleteFileA
kernel32.dll.WideCharToMultiByte
kernel32.dll.CompareStringOrdinal
clr.dll.CreateAssemblyNameObject
ole32.dll.CoGetContextToken
ole32.dll.CoGetObjectContext
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
clr.dll.CreateAssemblyEnum
kernel32.dll.ResolveLocaleName
kernel32.dll.LoadLibraryA
kernel32.dll.GetProcAddress
kernel32.dll.GetModuleHandleA
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
ntdll.dll.NtQuerySystemInformation
kernel32.dll.CreateProcessA
kernel32.dll.GetThreadContext
kernel32.dll.Wow64GetThreadContext
kernel32.dll.SetThreadContext
kernel32.dll.Wow64SetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.WriteProcessMemory
ntdll.dll.NtUnmapViewOfSection
kernel32.dll.VirtualAllocEx
kernel32.dll.ResumeThread
ole32.dll.CoUninitialize
oleaut32.dll.#500
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
cryptsp.dll.CryptReleaseContext
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
kernel32.dll.GetProcessPreferredUILanguages
kernel32.dll.GetUserDefaultUILanguage
version.dll.GetFileVersionInfoSizeA
version.dll.GetFileVersionInfoA
version.dll.VerQueryValueA
alink.dll.CreateALink
mscoree.dll.CLRCreateInstance
mscoreei.dll.CLRCreateInstance
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
clr.dll.DllGetClassObjectInternal
clr.dll.StrongNameTokenFromPublicKey
clr.dll.StrongNameFreeBuffer
clr.dll.CompareAssemblyIdentityWithConfig
clr.dll.CreateAssemblyConfigCookie
clr.dll.DestroyAssemblyConfigCookie
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptDestroyKey
mscorpehost.dll.InitializeSxS
mscorpehost.dll.CreateICeeFileGen
mscorpehost.dll.DestroyICeeFileGen
ole32.dll.CoCreateGuid
diasymreader.dll.DllGetClassObject
rpcrt4.dll.UuidCreate
ole32.dll.CreateStreamOnHGlobal
mscoree.dll.CorExitProcess
mscoreei.dll.CorExitProcess
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
sspicli.dll.GetUserNameExW
shlwapi.dll.PathFindFileNameW
advapi32.dll.GetUserNameW
xmllite.dll.CreateXmlWriter
xmllite.dll.CreateXmlWriterOutputWithEncodingName
user32.dll.GetCursorInfo
user32.dll.GetLastInputInfo
kernel32.dll.GetConsoleWindow
psapi.dll.GetModuleFileNameExA
psapi.dll.GetModuleFileNameExW
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.IsWow64Process
kernel32.dll.GetComputerNameExW
shell32.dll.IsUserAnAdmin
kernel32.dll.SetProcessDEPPolicy
advapi32.dll.CryptAcquireContextW
advapi32.dll.RegCreateKeyExW
shlwapi.dll.PathIsDirectoryW
advapi32.dll.RegNotifyChangeKeyValue
ole32.dll.CLSIDFromOle1Class
clbcatq.dll.GetCatalogObject
clbcatq.dll.GetCatalogObject2
tschannel.dll.DllGetClassObject
tschannel.dll.DllCanUnloadNow
advapi32.dll.RegSetValueExW
shlwapi.dll.PathIsPrefixW
advapi32.dll.CryptCreateHash
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptHashData
advapi32.dll.CryptDestroyHash
xmllite.dll.CreateXmlReader
advapi32.dll.CryptReleaseContext
ws2_32.dll.GetAddrInfoW
ws2_32.dll.WSASocketW
ws2_32.dll.#2
ws2_32.dll.#21
ws2_32.dll.#9
ws2_32.dll.WSAIoctl
ws2_32.dll.FreeAddrInfoW
ws2_32.dll.#6
ws2_32.dll.#5
schannel.dll.SpUserModeInitialize
ws2_32.dll.WSASend
ws2_32.dll.WSARecv
secur32.dll.FreeContextBuffer
ncrypt.dll.SslOpenProvider
ncrypt.dll.GetSChannelInterface
bcryptprimitives.dll.GetHashInterface
ncrypt.dll.SslIncrementProviderReferenceCount
ncrypt.dll.SslImportKey
bcryptprimitives.dll.GetCipherInterface
ncrypt.dll.SslLookupCipherSuiteInfo
user32.dll.LoadStringW
ncrypt.dll.BCryptOpenAlgorithmProvider
ncrypt.dll.BCryptGetProperty
ncrypt.dll.BCryptCreateHash
ncrypt.dll.BCryptHashData
ncrypt.dll.BCryptFinishHash
ncrypt.dll.BCryptDestroyHash
crypt32.dll.CertGetCertificateChain
userenv.dll.GetUserProfileDirectoryW
sechost.dll.ConvertSidToStringSidW
sechost.dll.ConvertStringSidToSidW
userenv.dll.RegisterGPNotification
gpapi.dll.RegisterGPNotificationInternal
sechost.dll.OpenSCManagerW
sechost.dll.OpenServiceW
sechost.dll.CloseServiceHandle
sechost.dll.QueryServiceConfigW
cryptsp.dll.CryptVerifySignatureA
cryptnet.dll.I_CryptNetGetConnectivity
sensapi.dll.IsNetworkAlive
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcBindingSetAuthInfoExW
rpcrt4.dll.NdrClientCall2
cryptnet.dll.CryptRetrieveObjectByUrlW
shlwapi.dll.UrlGetPartW
winhttp.dll.WinHttpOpen
winhttp.dll.WinHttpSetTimeouts
winhttp.dll.WinHttpSetOption
winhttp.dll.WinHttpCrackUrl
winhttp.dll.WinHttpConnect
winhttp.dll.WinHttpOpenRequest
winhttp.dll.WinHttpGetDefaultProxyConfiguration
winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser
advapi32.dll.RegDeleteTreeA
advapi32.dll.RegDeleteTreeW
nsi.dll.NsiAllocateAndGetTable
cfgmgr32.dll.CM_Open_Class_Key_ExW
iphlpapi.dll.ConvertInterfaceGuidToLuid
iphlpapi.dll.GetIfEntry2
iphlpapi.dll.GetIpForwardTable2
iphlpapi.dll.GetIpNetEntry2
iphlpapi.dll.FreeMibTable
nsi.dll.NsiFreeTable
winhttp.dll.WinHttpGetProxyForUrl
profapi.dll.#104
winhttp.dll.WinHttpSendRequest
winhttp.dll.WinHttpReceiveResponse
winhttp.dll.WinHttpQueryHeaders
winhttp.dll.WinHttpQueryDataAvailable
ws2_32.dll.#22
winhttp.dll.WinHttpReadData
ws2_32.dll.#3
winhttp.dll.WinHttpCloseHandle
setupapi.dll.SetupIterateCabinetW
kernel32.dll.RegOpenKeyExW
kernel32.dll.RegCloseKey
cabinet.dll.#20
cabinet.dll.#22
cabinet.dll.#23
sechost.dll.QueryServiceConfigA
sechost.dll.QueryServiceStatus
rpcrt4.dll.RpcStringBindingComposeA
rpcrt4.dll.RpcBindingFromStringBindingA
rpcrt4.dll.RpcEpResolveBinding
rpcrt4.dll.RpcStringFreeA
rpcrt4.dll.RpcBindingFree
cryptsp.dll.CryptGetKeyParam
crypt32.dll.CertVerifyCertificateChainPolicy
crypt32.dll.CertFreeCertificateChain
crypt32.dll.CertDuplicateCertificateContext
crypt32.dll.CertFreeCertificateContext
wersvc.dll.ServiceMain
wersvc.dll.SvchostPushServiceGlobals
advapi32.dll.RegGetValueW
sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
faultrep.dll.WerpInitiateCrashReporting
wer.dll.WerpCreateMachineStore
shell32.dll.SHGetFolderPathEx
ole32.dll.StringFromGUID2
userenv.dll.CreateEnvironmentBlock
userenv.dll.DestroyEnvironmentBlock
imm32.dll.ImmDisableIME
wer.dll.WerpCreateIntegratorReportId
wer.dll.WerReportCreate
wer.dll.WerpSetIntegratorReportId
wer.dll.WerReportSetParameter
dbgeng.dll.DebugCreate
ntdll.dll.CsrGetProcessId
ntdll.dll.DbgBreakPoint
ntdll.dll.DbgPrint
ntdll.dll.DbgPrompt
ntdll.dll.DbgUiConvertStateChangeStructure
ntdll.dll.DbgUiGetThreadDebugObject
ntdll.dll.DbgUiIssueRemoteBreakin
ntdll.dll.DbgUiSetThreadDebugObject
ntdll.dll.NtAllocateVirtualMemory
ntdll.dll.NtClose
ntdll.dll.NtCreateDebugObject
ntdll.dll.NtCreateFile
ntdll.dll.NtDebugActiveProcess
ntdll.dll.NtDebugContinue
ntdll.dll.NtFreeVirtualMemory
ntdll.dll.NtOpenProcess
ntdll.dll.NtOpenThread
ntdll.dll.NtQueryInformationProcess
ntdll.dll.NtQueryInformationThread
ntdll.dll.NtQueryMutant
ntdll.dll.NtQueryObject
ntdll.dll.NtRemoveProcessDebug
ntdll.dll.NtResumeThread
ntdll.dll.NtSetInformationDebugObject
ntdll.dll.NtSetInformationProcess
ntdll.dll.NtSystemDebugControl
ntdll.dll.NtWaitForDebugEvent
ntdll.dll.RtlAnsiStringToUnicodeString
ntdll.dll.RtlCreateProcessParameters
ntdll.dll.RtlCreateUserProcess
ntdll.dll.RtlDestroyProcessParameters
ntdll.dll.RtlDosPathNameToNtPathName_U
ntdll.dll.RtlFindMessage
ntdll.dll.RtlFreeHeap
ntdll.dll.RtlFreeUnicodeString
ntdll.dll.RtlGetFunctionTableListHead
ntdll.dll.RtlGetUnloadEventTrace
ntdll.dll.RtlGetUnloadEventTraceEx
ntdll.dll.RtlInitAnsiString
ntdll.dll.RtlInitUnicodeString
ntdll.dll.RtlTryEnterCriticalSection
ntdll.dll.RtlUnicodeStringToAnsiString
ntdll.dll.NtOpenProcessToken
ntdll.dll.NtOpenThreadToken
ntdll.dll.NtQueryInformationToken
kernel32.dll.CloseProfileUserMapping
kernel32.dll.CreateToolhelp32Snapshot
kernel32.dll.DebugActiveProcessStop
kernel32.dll.DebugBreak
kernel32.dll.DebugBreakProcess
kernel32.dll.DebugSetProcessKillOnExit
kernel32.dll.Module32First
kernel32.dll.Module32FirstW
kernel32.dll.Module32Next
kernel32.dll.Module32NextW
kernel32.dll.OpenThread
kernel32.dll.Process32First
kernel32.dll.Process32FirstW
kernel32.dll.Process32Next
kernel32.dll.Process32NextW
kernel32.dll.ProcessIdToSessionId
kernel32.dll.SetProcessShutdownParameters
kernel32.dll.Thread32First
kernel32.dll.Thread32Next
kernel32.dll.GetTimeZoneInformation
kernel32.dll.Wow64GetThreadSelectorEntry
advapi32.dll.CloseServiceHandle
advapi32.dll.ControlService
advapi32.dll.CreateServiceA
advapi32.dll.CreateServiceW
advapi32.dll.DeleteService
advapi32.dll.EnumServicesStatusExA
advapi32.dll.EnumServicesStatusExW
advapi32.dll.GetEventLogInformation
advapi32.dll.OpenSCManagerA
advapi32.dll.OpenSCManagerW
advapi32.dll.OpenServiceA
advapi32.dll.OpenServiceW
advapi32.dll.StartServiceA
advapi32.dll.StartServiceW
advapi32.dll.GetSidSubAuthority
advapi32.dll.GetSidSubAuthorityCount
version.dll.GetFileVersionInfoSizeExW
version.dll.GetFileVersionInfoExW
dbghelp.dll.WinDbgExtensionDllInit
dbghelp.dll.ExtensionApiVersion
wer.dll.WerpSetDynamicParameter
wer.dll.WerReportAddDump
wer.dll.WerpSetCallBack
wer.dll.WerReportSetUIOption
wer.dll.WerpAddRegisteredDataToReport
wer.dll.WerReportSubmit
advapi32.dll.CheckTokenMembership
user32.dll.GetProcessWindowStation
user32.dll.GetThreadDesktop
user32.dll.GetUserObjectInformationW
rpcrt4.dll.NdrClientCall3
user32.dll.CharUpperW
werui.dll.WerUICreate
werui.dll.WerUIStart
ole32.dll.CoInitialize
dui70.dll.InitProcessPriv
comctl32.dll.LoadIconWithScaleDown
ntdll.dll.RtlRunEncodeUnicodeString
ntdll.dll.RtlRunDecodeUnicodeString
dui70.dll.InitThread
duser.dll.InitGadgets
user32.dll.RegisterMessagePumpHook
dui70.dll.?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ
dui70.dll.?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
dui70.dll.??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
dui70.dll.?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
dui70.dll.??0ClassInfoBase@DirectUI@@QEAA@XZ
dui70.dll.?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
dui70.dll.?Register@ClassInfoBase@DirectUI@@QEAAJXZ
dui70.dll.?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
dui70.dll.?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
dui70.dll.?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
dui70.dll.??1CritSecLock@DirectUI@@QEAA@XZ
dui70.dll.??0CCBase@DirectUI@@QEAA@KPEBG@Z
dui70.dll.?Initialize@CCBase@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
duser.dll.CreateGadget
duser.dll.SetGadgetMessageFilter
duser.dll.SetGadgetStyle
dui70.dll.?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
dui70.dll.?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
dui70.dll.?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
dui70.dll.?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
dui70.dll.?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
dui70.dll.?SetFontSize@Element@DirectUI@@QEAAJH@Z
dui70.dll.?SetWidth@Element@DirectUI@@QEAAJH@Z
dui70.dll.?SetHeight@Element@DirectUI@@QEAAJH@Z
dui70.dll.?EndDefer@Element@DirectUI@@QEAAXK@Z
dui70.dll.?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
duser.dll.InvalidateGadget
dui70.dll.CreateDUIWrapper
shell32.dll.ExtractIconExW
comctl32.dll.TaskDialogIndirect
dwmapi.dll.DwmIsCompositionEnabled
uxtheme.dll.IsThemeActive
duser.dll.SetGadgetRootInfo
uxtheme.dll.IsAppThemed
uxtheme.dll.GetThemeAppProperties
xmllite.dll.CreateXmlReaderInputWithEncodingName
uxtheme.dll.OpenThemeData
uxtheme.dll.GetThemeMargins
uxtheme.dll.GetThemeFont
uxtheme.dll.GetThemeColor
uxtheme.dll.GetThemeMetric
oleaut32.dll.#6
duser.dll.SetGadgetParent
duser.dll.GetDUserModule
duser.dll.FindStdColor
duser.dll.AttachWndProcW
comctl32.dll.RegisterClassNameW
duser.dll.GetGadgetRect
duser.dll.GetGadgetRgn
duser.dll.GetGadgetTicket
gdi32.dll.GetLayout
gdi32.dll.GdiRealizationInfo
gdi32.dll.FontIsLinked
gdi32.dll.GetTextFaceAliasW
gdi32.dll.GetFontAssocStatus
advapi32.dll.RegQueryValueExA
dui70.dll.?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
dui70.dll.?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
dui70.dll.?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
dui70.dll.?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z
uxtheme.dll.EnableThemeDialogTexture
dui70.dll.?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
dui70.dll.?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
comctl32.dll.HIMAGELIST_QueryInterface
comctl32.dll.DrawShadowText
comctl32.dll.DrawSizeBox
comctl32.dll.DrawScrollBar
comctl32.dll.SizeBoxHwnd
comctl32.dll.ScrollBar_MouseMove
comctl32.dll.ScrollBar_Menu
comctl32.dll.HandleScrollCmd
comctl32.dll.DetachScrollBars
comctl32.dll.AttachScrollBars
comctl32.dll.CCSetScrollInfo
comctl32.dll.CCGetScrollInfo
comctl32.dll.CCEnableScrollBar
comctl32.dll.QuerySystemGestureStatus
uxtheme.dll.#49
uxtheme.dll.CloseThemeData
dui70.dll.?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z
dui70.dll.?IsContentProtected@Element@DirectUI@@UEAA_NXZ
uxtheme.dll.GetThemeBool
duser.dll.GetGadgetFocus
uxtheme.dll.GetThemeBackgroundContentRect
uxtheme.dll.GetThemeTextMetrics
uxtheme.dll.GetThemePartSize
uxtheme.dll.GetThemeTextExtent
uxtheme.dll.GetThemeBackgroundExtent
duser.dll.SetGadgetFocus
duser.dll.DUserSendEvent
duser.dll.SetGadgetRect
comctl32.dll.SetWindowSubclass
comctl32.dll.DefSubclassProc
dui70.dll.?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
uxtheme.dll.#47
uxtheme.dll.BufferedPaintInit
uxtheme.dll.BeginBufferedPaint
uxtheme.dll.BufferedPaintRenderAnimation
uxtheme.dll.BeginBufferedAnimation
uxtheme.dll.IsThemeBackgroundPartiallyTransparent
uxtheme.dll.DrawThemeParentBackground
uxtheme.dll.DrawThemeBackground
uxtheme.dll.DrawThemeText
uxtheme.dll.EndBufferedAnimation
uxtheme.dll.GetThemeTransitionDuration
uxtheme.dll.GetBufferedPaintDC
uxtheme.dll.GetBufferedPaintTargetDC
uxtheme.dll.EndBufferedPaint
duser.dll.ForwardGadgetMessage
uxtheme.dll.GetThemeInt
duser.dll.DUserPostEvent
duser.dll.DisableContainerHwnd
uxtheme.dll.BufferedPaintUnInit
werui.dll.WerUIUpdateUIForState
duser.dll.DeleteHandle
duser.dll.DetachWndProc
comctl32.dll.RemoveWindowSubclass
dui70.dll.?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
dui70.dll.?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
dui70.dll.?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
dui70.dll.?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
uxtheme.dll.BufferedPaintStopAllAnimations
dui70.dll.??1CCBase@DirectUI@@UEAA@XZ
uxtheme.dll.DrawThemeParentBackgroundEx
uxtheme.dll.GetThemeEnumValue
user32.dll.MsgWaitForMultipleObjects
winhttp.dll.WinHttpSetStatusCallback
duser.dll.FindGadgetFromPoint
advapi32.dll.IsValidSid
advapi32.dll.GetLengthSid
advapi32.dll.CopySid
advapi32.dll.RegisterEventSourceW
advapi32.dll.ReportEventW
advapi32.dll.DeregisterEventSource
werui.dll.WerUITerminate
duser.dll.DUserFlushMessages
duser.dll.DUserFlushDeferredMessages
dui70.dll.UnInitThread
user32.dll.UnregisterMessagePumpHook
werui.dll.WerUIDelete
dui70.dll.UnInitProcessPriv
dui70.dll.?Release@ClassInfoBase@DirectUI@@UEAAHXZ
dui70.dll.?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
dui70.dll.??1ClassInfoBase@DirectUI@@UEAA@XZ
wer.dll.WerReportCloseHandle
advapi32.dll.DuplicateToken
wer.dll.WerpFreeString
wkscli.dll.NetGetJoinInformation
netutils.dll.NetApiBufferFree
rpcrt4.dll.UuidFromStringW
radarrs.dll.WdiDiagnosticModuleMain
radarrs.dll.WdiHandleInstance
radarrs.dll.WdiGetDiagnosticModuleInterfaceVersion
kernel32.dll.GetThreadPreferredUILanguages
kernel32.dll.SetThreadPreferredUILanguages
kernel32.dll.GetSystemDefaultLocaleName
fastprox.dll.DllGetClassObject
fastprox.dll.DllCanUnloadNow
psapi.dll.EnumProcesses
psapi.dll.EnumProcessModules
psapi.dll.GetModuleBaseNameW
ntmarta.dll.GetMartaExtensionInterface
ole32.dll.CLSIDFromString
oleaut32.dll.#8
oleaut32.dll.#2
oleaut32.dll.#9

Execute Commands

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Seven01\AppData\Local\Temp\ngbm0y0y.cmdline"
"schtasks.exe" /query
"schtasks.exe" /create /sc MINUTE /tn egjbJb /MO 1 /tr "C:\ProgramData\null\
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Seven01\AppData\Local\Temp\RES1756.tmp" "c:\Users\Seven01\AppData\Local\Temp\CSC815331D32F834CE6877A45412C204ED2.TMP"
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
C:\Windows\system32\WerFault.exe -u -p 3044 -s 416
C:\Windows\system32\WerFault.exe -u -p 3044 -s 376
C:\ProgramData\null\

Started Services

WerSvc
AdobeFlashPlayerUpdateSvc

Created Services

Nothing to display

Import Hash: f34d5f2d4577ed6d9ceec516c1f5a744
Submission	File name	MD5
2016-01-04 10:21:41	ryvyop.exe	a07dd930d896556d7fbedf26b5d71053
2016-01-04 10:28:50	zerolocker.exe	bd0a3c308a6d3372817a474b7c653097
2016-01-04 10:32:13	PTS.exe	f05d8e8e663b1d3787c78c9342e02601
2016-01-04 10:37:47	updater_x86.exe	cef16aaa56aa47e375bb35e9660230fe
2016-01-04 15:38:39	nova cópia de P.O.exe	7ed4e68ff75ac990fcbc047ee75bbeeb
2016-01-25 15:31:17	CSGO TypicalBOT.exe	19fc48f26d00b2676b29a6c6cb105947
2016-02-02 15:16:07	LLR142.exe	2d47fa30aa45d516ae0bc8b594a595fe
2016-02-29 10:12:05	jeee.exe	2e96fa9304c31daf13dcb37e9136b2f5
2016-04-11 11:35:49	Installazione.exe	02b78d4d8fef05845134048d2697be2e
2016-04-12 09:26:08	571983.8040.exe	882aef05b28d003c661cccca58dc12ed
2016-06-20 14:45:02	pnysat.exe	de3b681b9cf1047bb6db1827c577d7e4
2016-06-20 15:36:04	PROGRAMMING.exe	9a06cf9a99c09f2f191c7d0a3a02e1e5
2016-06-21 19:21:02	s.exe	c9c9716b34e93a8a69bcbe51d9c38367
2016-06-21 19:24:02	t.exe	a932cf3c3265a0a5877d8323f85d0b7f
2016-06-23 13:30:02	Mechanism.exe	f414fe5302216bcf6674cf1dcabaebfe
2016-06-23 20:57:04	spe.exe	c96b4f29f20db9270ef8066775f2e603
2016-06-23 21:00:03	win.exe	70b5a608c792a807c7fdfb7ad786fce6
2016-06-23 21:09:05	kunde.exe	d5ea316da41904c647d59e0eeb167f97
2016-06-24 23:15:02	anonpop.exe	cdd68c998c57e3c8a26f94c3aaacc580
2016-06-27 14:15:05	soldier.exe	2b478db2af56153a2cee33f71213cc2f
2016-06-28 01:36:03	slim.exe	3867c87a582f65156e89adfb39e99838
2016-06-28 10:54:05	uchee.exe	881e968ddf34c38943a56651a3870174
2016-06-28 16:15:04	nigga.exe	c5c0ee62b0ec50c681539f64ddd4d87d
2016-06-28 20:36:05	opera.exe	36b99b35835db1694457dda5d628104b
2016-06-28 20:39:05	shooo.exe	e9d593a394e62fde7fea76fdf3ced4fd
2016-06-30 14:03:04	orderr.exe	cdf4d907bc8a173fea454dc33d4edf76
2016-06-30 14:06:04	order.exe	77381d5ad94b32aeb2f376cb2133331f
2016-06-30 14:09:02	ss.exe	9558fca2b182f491a45249a3cfb547d4
2016-06-30 19:51:04	orderr.exe	985a276b7cdf188f7729f90a628ad938
2016-06-30 19:54:04	order.exe	e41d68bcf112ff63e5e454f802e60b5c
2016-06-30 19:57:03	order.exe	aea4fcd5f12fcb277f7c25741b6b4d9c
2016-06-30 20:00:04	order.exe	fc1e712ae0ca61540e94fcf9d9d581e5
2016-06-30 20:03:04	order.exe	ccf54256a15d898eee17be3546130977
2016-06-30 20:06:04	order.exe	505932cec770e1c21616d9076355fb40
2016-06-30 20:09:04	order.exe	0dcb4916ab15a39b9780aff454d228dc
2016-06-30 20:12:04	order.exe	5bbec95c53e5281b607aea9795b4b3bd
2016-06-30 20:15:04	order.exe	dcd2f94610cb3f3546dd585c17071cf5
2016-06-30 20:18:04	order.exe	cb8a237ab1587b467131fb84025f96f2
2016-06-30 20:21:04	order.exe	882f3fea08adb86c77cb49f5beaa7140
2016-06-30 20:24:04	order.exe	863890910dc1432a1a6dd6114aaecc2c
2016-06-30 20:27:04	order.exe	390a378288b0fdeb1bd043f0b348c4b3
2016-06-30 20:30:04	order.exe	332aece4c61ad76e3d63db2a0803e009
2016-06-30 20:33:04	order.exe	3a286f3768b345dd76a4352f20feb494
2016-06-30 20:36:04	order.exe	de2f48997a947ae652208f249219fe6f
2016-06-30 20:39:05	order.exe	41ef837433847acf45cee2c98b32afb4
2016-06-30 20:42:04	order.exe	629226c111c31d24499fe0cefda84b0d
2016-06-30 20:45:04	order.exe	1c029e828c3b6847cde372e90ac26370
2016-06-30 20:48:05	order.exe	001f34d3948bdf225599a4d5d312c149
2016-06-30 20:51:03	order.exe	f94da27cf6e2a3bd0c33bce2ab1f7324
2016-06-30 20:54:03	order.exe	ceb66744ac8e24b44bfe657795e049b3
2016-06-30 20:57:04	order.exe	05d3649510dc5ee449505a910690d561
2016-06-30 21:00:04	order.exe	15a3c7858edf89cc13ab89c431c1c3a6
2016-07-01 17:48:02	wall.exe	688bbb81093e611562ee28460b7e3641
2016-07-04 09:47:50	papa.exe	b7d315b8b877a775f22ad5255672603f
2016-07-04 10:12:04	onowu.exe	87442fade5338dfab197aa9a0a819c61
2016-07-04 10:15:03	cross.exe	91e8a7c8675b4a58f4eb675654feb896
2016-07-04 10:18:03	bro.exe	a251cd9fb2a543f5a8f3fbf470a958ab
2016-07-04 10:21:03	boy.exe	0db9433ce379a0ec2f3fba2a26394500
2016-07-04 10:24:01	botnet.exe	92eaac8b2266fb2514e66a8e2cf98f13
2016-07-04 11:21:23	ofi.exe	398680cbdd017f7b99e9add1477939a8
2016-07-04 11:21:38	Docx-output003093-pdf.scr	c7c50ca090bde3c6b8860a1e1155bd22
2016-07-04 16:27:03	kqlcwt.exe	03598ac96100cf4cb41e01e3f4f43ef1
2016-07-05 15:09:06	MSASCui.exe	4c85ea07344eaa34e6eb1ab302f308b7
2016-07-05 15:30:06	handler.exe	fa6741b1b991109af5294d8987250582
2016-07-05 15:33:06	handler8.exe	312812b53d45bf543cc12a0c7576a022
2016-07-05 15:48:04	98745.exe	0cc5621e2bc00c6fd3a0a8bbdf929589
2016-07-05 20:21:04	c3654bc71e28b4722b52d77267e16ca1c683e.exe	4d8c3bbe432078a30d62aa760079fbcf
2016-07-05 20:24:03	c36546fb054730d6672c3c434cf5e86133230.exe	e2bb67fce3234902708f3b92af384197
2016-07-05 20:27:03	c36540c84be956a0d76ec2777c9c1f1e09b4c.exe	94de6a10fa855e8652ef778e97f828eb
2016-07-05 20:30:02	c3654c1160f3ba1ee7ae08885036177792dc6.exe	9fc6649def2753fa45c41752e1979de4
2016-07-06 00:39:07	AudioDriver.exe	559a1407f876dda7d97937dbdb73f15a
2016-07-06 00:42:04	freshll.exe	8bec87cc121086a4b1e73b8b1264b989
2016-07-06 00:45:03	tophLL.exe	6a752964fde14cff3a537c9e2e4482eb
2016-07-06 00:48:04	LL.exe	eb366cbc54fd9464c5dd93abdfcbf2d7
2016-07-06 00:51:03	CryptLL.exe	122a1273eee2a119f18363ef6bf03b2a
2016-07-06 00:54:03	29thJUNE.exe	e5ff2c65bc40057dcbb17439875ec2ac
2016-07-06 01:00:04	forUSA.exe	10401a126ea1acbb93b4122605eef96e
2016-07-06 01:03:02	felix.exe	90bcacade40c6464c31f7c039fbee121
2016-07-06 01:06:03	felix.exe	4cae7a04ddf6bd0a8299860bd3df9d85
2016-07-06 19:48:12	t3.exe	f9d3ac5089f9ef9d8bcb464ea70028ea
2016-07-06 19:51:09	t4.exe	4b38a2387e5afd75891d8124fab8dec8
2016-07-07 00:30:02	t.exe	4bcec61a939260dbea704c14e7705cb3
2016-07-07 00:33:02	s.exe	78b29ce29d9c806a34e893ea59a41672
2016-07-07 00:36:02	gogo.exe	5bef93bc8ead8382bbe62bfecf5bcf69
2016-07-07 00:39:02	fuckyou.exe	867b80e5af43d6887edc210501c8fe0a
2016-07-07 19:15:05	updater.exe	6a518b3a04f9da7f05701e7a0d78a678
2016-07-07 19:18:02	ewinoz.exe	56f7e9e9ad6a61089e849cfeca8d5719
2016-07-07 19:21:06	email.exe	199fc3fdc3bd77d7f0c04232b15a3b12
2016-07-07 19:24:17	dmaniServer.exe	c5a04783ee7d2af47538973a99bd1cca
2016-07-08 10:09:10	PapiPPServer.exe	c8dc08f2db6d7a42a6f55df01bdc3a0e
2016-07-08 19:24:02	t.exe	803a9951c75174f67740ce852f8899a5
2016-07-12 19:36:03	w.exe	620fd2666f81e4a161932700756415f8
2016-07-12 19:54:03	s.exe	e0e8df5aea51558053fda6a5f7c3e176
2016-07-12 19:57:03	ss.exe	56399f49c466b9e71ce961a23c6b30eb
2016-07-19 19:06:04	setup1.exe	8506b77e471d562a02b9585481dce876
2016-07-20 14:21:02	sBuild1.exe	c29ce857c329d48f03c50098ed7deb8a
2016-07-21 20:39:04	RATRAW.exe	2bcd129d31f91065df625f28867bebdf
2016-08-01 11:51:52	smcix.exe	b1629b9c58bb3cedcda41967d5af77a5
2016-08-01 15:03:04	mi.exe	509c1a4ca1dfd590eca0b4f163621354
2016-08-01 15:06:04	jizzy.exe	9341dbfc7cd4c279a27748ed5b6f5dd0
2016-08-01 15:09:03	ike.exe	7b93950c2d4af5d7d056eea0738a0450
2016-08-01 15:12:04	elber.exe	6d2ae57a0e8ebb97d1f2f1e3e72f4fb1
2016-08-01 15:15:04	agogo.exe	01207d00b135c7dbc63cf305a129d2de
2016-08-01 15:18:03	realized.exe	10cef82c2cb89ac5156e47b3b4cea1e2
2016-08-01 15:21:04	oga.exe	a953f509f6f4911bde005bea33d86851
2016-08-01 16:56:19	elber.exe	d83ca17e0f9360e835ee05ac03462b79
2016-08-01 16:58:51	final.exe	4e11631e334c3444134e31a4fd74cd09
2016-08-01 16:59:02	gareth.exe	7a2b902ffc731a8bbf85fb5d66433567
2016-08-01 16:59:14	ike.exe	660aff1107d98cd2c8f3db0de11685ea
2016-08-01 16:59:33	jizzy.exe	3c47377e73cb866c7f587bb29265bf1f
2016-08-01 17:01:07	oga.exe	c5e094423ac4e26c5dbc42c57ae9fda1
2016-08-01 17:01:59	yg.exe	ac8ecd5ddf28959dba7de22a3062bac6
2016-08-01 17:06:30	chi.exe	3064bf15f892d77e8689be7baf209e47
2016-08-01 17:06:51	agogo.exe	071818530e23df059dde379fd28bfdab
2016-08-01 17:11:52	yg.exe	5e2cfbe77d46da72fab334deebe931f7
2016-08-03 09:21:03	order.exe	c584117c347dcf4ea86a6d7786671e92
2016-08-03 09:24:02	invoice.exe	f5f5d3b1c26e4df4788ec6b814b2ef95
2016-08-03 09:27:02	order.exe	58fa7de17498e8b68f95358e58fa5e46
2016-08-03 15:03:07	win.exe	e6ea76248337b6f07e53d11efacbdff5
2016-08-03 15:06:06	chrome.exe	48f9fbc5bbfc96fb3431ef39fd8c0d8f
2016-08-08 11:51:03	cafb541e.exe	47a88065c7bcb01c1ffc1c6b9cac7961
2016-08-22 23:24:03	t1.exe	aad1ebef49354d533937a4a776e041d8
2016-08-23 04:03:03	sample.exe	00184ab4e7eeadbc75de7c5eade980d4
2016-08-23 18:24:04	slideshow.exe	69888e41f513cca0f37afcc6880255b3
2016-08-23 18:39:22	3.scr	adcaaf6f9788e7bb3d404db032d67c43
2016-08-23 18:42:04	t.exe	ca3a32aa24d70e9d2e952c842cd0545f
2016-08-24 18:24:02	ss	fb1bbfa8b7a37122b6b237615f7c1ad9
2016-08-24 18:27:01	s	ed780068842fbeb2051d400924d14955
2016-08-24 18:30:02	1	ee6c06a31c6daf83adff3030f3b3cb64
2016-08-24 18:33:02	work.exe	af6c5fd94882cfe0c7abbab43229e9aa
2016-08-25 18:21:02	order.exe	594297e9a312f641aec5609f83fdd973
2016-08-29 13:51:09	stanhawk.exe	25dffd41e6e4ac878318551eb2bc7bfa
2016-08-29 14:00:10	testeme.exe	521f6d8777174d225a1f1b87a51a05a1
2016-08-29 14:03:05	startup%20yes.exe	37fd7205a677a53c500961a6dcf81ae2
2016-08-29 14:06:09	scan0021.exe	173de6d737993b9da11d02ac1ac898e4
2016-08-29 14:09:10	bspye.exe	90d5a62981262bd676ef3d3cb70d2d28
2016-08-29 14:12:09	OfreshLL.exe	3547500dddc5241f67acc01a07104a3a
2016-08-29 14:15:09	Final-LL.exe	6ac314cb671771e35559429590c64215
2016-08-29 14:18:22	1.exe	3a6ae42c86a800c48921c13cec25cb7d
2016-08-29 14:24:06	AMANOK-LL.exe	4b3c531bc19955b5ac4c781b9c893752
2016-08-29 14:27:10	sharpLL1.exe	d6bdce50021bde169bf244aaeaa908cb
2016-08-29 14:33:21	rename.exe	0a4741643053c6840f56420cdd1e936e
2016-08-29 14:36:18	iSystem.scr	846d58d9e58ba37e32a50258dddf5c9b
2016-08-29 14:39:15	fetch.exe	aee616b23ecfd20d1fb800277be0e000
2016-08-29 14:42:16	LL-crypted.exe	29f0898f7d690f60e62241cca4be901d
2016-08-31 13:57:03	7.exe	1f7f8aa88589d57390a1375628758b21
2016-08-31 14:00:02	6.exe	25329a73e5f3f279884271590ff75484
2016-08-31 14:03:07	5.exe	7d1b0776f9504718807085418f686d15
2016-08-31 14:06:08	4.exe	19fe716b7364509e83538ced392726cf
2016-08-31 14:09:08	3.exe	cee8685c442f95818d1d0dafbad6097b
2016-08-31 14:12:03	2.exe	a5ff6906a86c2f34113b4f52a5c8b5b4
2016-08-31 14:15:03	1.exe	61bee727c22b4161d97c8e02169202ae
2016-08-31 14:18:02	tup.exe	a03032a97bdc4b1c002a5d68ac75a12a
2016-09-01 15:15:08	CriticalGen.exe	7e01233645216b6a40d634d0fc73001c
2016-09-02 03:33:03	ORDER%20ITEMS.pif	91714ff5d013a6c2aefc599c14a8d0e2
2016-09-07 02:33:33	5.exe	e8776eb41d79b8d9d1740261a3b8af43
2016-09-07 02:36:05	4.exe	197c9447ba2a5f95d220229ec0266f0d
2016-09-07 02:39:03	s.exe	2e4da953f0721c2c66b5b34dc758cd70
2016-09-07 02:42:05	1.exe	b867c333511ab450bae5dbf2113700fe
2016-09-07 02:45:05	2.exe	edd8ddea50d3307cc4fe0122133f8056
2016-09-07 21:36:02	DOC_DOC.exe	afbf6600343e987ed14a3f7cc48d4dbb
2016-09-08 11:51:03	Invoice%20J-801265.pdf.exe	fd4dc9b2bff8d75a704e8fe33c63da4b
2016-09-08 11:54:02	ss.exe	7a706f323e2800be7ad393577ef3002a
2016-09-08 11:57:03	tup.exe	cdb1d079f03509e7ff25c76b7d98ef43
2016-09-08 17:24:02	ss.exe	651b57f42eb936776ea90e698a53c996
2016-09-08 17:27:02	tt.exe	5b99b211a6d06422ad1b1fd4ea86aa36
2016-09-08 17:30:01	t.exe	c94b85487d3acdb39d96185794728274
2016-09-08 17:33:01	s.exe	aae5aa33973db91cecadca07f0672c26
2016-09-10 16:21:02	07b1af98.exe	230f0213e350415357bd2280ec10dabe
2016-09-10 21:06:03	pgrqu.exe	57e375901dd0cada5095ea6ad01b4a90
2016-09-11 16:18:10	5.exe	04be6198b40f05643450cd3273e13faa
2016-09-12 16:12:04	senario104.jpg	7714fccf2d8f60a76f2f77ba55666437
2016-09-15 17:48:11	solfzz.exe	2eff08c8f70571fad4926f6729819416
2016-09-17 01:21:03	wizzupdater.exe	5f15ac42f2db59632154e374b452f743
2016-09-20 20:45:02	videoplugin_win7_.exe	6b65c98e45e7bc9086ccf02e04379e4a
2016-09-29 19:24:03	bwsmmp.exe	eac5f4b4187126abee33b1239838a2be
2016-09-30 18:03:06	imm.exe	16a1cf9c0ae8f3404f170062500bc91e
2016-09-30 18:36:07	soap.exe	fee217f256d715d0c4fe31405aa65234
2016-10-04 22:39:02	GoogleDNSHelper.exe	7b43d3abf1a6fa6776df85567954574e
2016-10-06 13:22:07	UCRename.exe	b697beeb040f4c720529a6242bac6a8b
2016-10-06 13:24:05	UCCounting.exe	9cdcc960d70796918cb31145f74707fd
2016-10-06 13:26:06	UCContinue.exe	704df86a3637b8886540983118bd304b
2016-10-06 13:28:06	UCCheckSystem.exe	5c1071636b14ce79abf1aea9467f1868
2016-10-13 21:36:06	next-get-alt.exe	eef89ba7663b3ad4cb64a93067c8abaf
2016-10-26 09:03:02	zero-install.exe	2d040f75dfb93fb91fa86dc9acd21c57
2016-11-04 08:18:06	craft1.exe	56bf4f99c49a7878b477ca6686c5e736
2016-11-17 11:52:07	EguasoftBasketballScoreboardCustomPro.exe	092f9d2743b2ec462c06f701df48c6a2
2016-11-17 12:00:12	done.exe	0072834412cc09329a3b498c6edb6449
2016-11-22 20:42:05	raw.exe	0b765e8ac512475c0b8bd85ce1c32c7f
2016-11-24 04:15:05	g1.exe	30d460225fe03dc35593402374efb954
2016-11-24 04:27:04	office.exe	3eba24880db35f26fec4bc2a7e4ac508
2016-11-24 20:03:03	iee.exe	b49e44d33c446c1182dbdbf21957a10b
2016-11-25 12:49:18	15.exe	a78eca051f7a37d7b4d9bc79959cdbef
2016-11-25 13:54:04	get.exe	fc9f0f4b7a2be6e19d799053d23818de
2016-12-02 23:33:04	avidump.exe	eb7c9cd12d9de69bc3fef57b171300b3
2016-12-02 23:42:02	rt.exe	74e78ccde239dc06f2f4214f66549536
2016-12-06 15:12:05	warwick.exe	1ddd824cfb1806d828866888d2ea6f93
2016-12-06 20:21:06	kitkat.jpg	4f62cc412da853a88c56918b55085ff9
2016-12-06 20:24:02	RepeatInstallUrl.exe	670590ae2e50c4162396b14a1590c04b
2016-12-08 21:03:02	bank.exe	6f670d9e5193906331079e0a83233e15
2016-12-09 17:30:03	20a.exe	089f6d5057bc6234c94d81142aadf430
2016-12-09 17:33:02	smit.exe	8922f64eb8e330e25e5fa035747c0b02
2016-12-09 17:36:02	35.exe	0208232d13502e68dec5c07d41911c9b
2016-12-10 16:12:02	driver.exe	0c3600aa4cf1aa00371eefef071b5d52
2016-12-10 21:12:03	3.exe	b74bac4b321000c37ae60594354bf13f
2016-12-14 10:39:07	fdgvfgrfd.exe	741e3ea41323adebb83a973b4b60cb55
2016-12-15 00:42:03	shit.exe	a6174ed191f0bf9e88126e3fb2b0ac01
2016-12-19 22:39:03	appda.exe	e932ab121b335964e032dd360793399e
2016-12-19 23:06:03	s.exe	efa3f27595fdd3219ed1330de38dc775
2016-12-28 15:12:02	t.exe	5fc10a5e31ac1e339c92d397ec4f5e88
2017-01-04 19:42:05	items.exe	e57799b2d0e7ab79609f995ca327124e
2017-01-09 15:00:08	s.exe	96ab18ed3b806245fac847b2844cc752
2017-01-09 15:21:02	vin22073167.exe	0695674e66201ac6de38fab1eba1230c
2017-01-09 15:24:02	service.exe	554a57a7b316d236bc60490b97e339d4
2017-01-09 17:15:04	hotbest.exe	5bb183bf3533c9490cce79fd9738c686
2017-01-10 16:33:09	55.exe	edc94982e4b857a58947c235acb762f6
2017-01-13 10:35:56	sample.exe	b39a673a5d2ceaa1fb5571769097ca77
2017-01-13 10:38:01	jebzmh.exe	b533b082ed1458c482c3663ee12dc3a4
2017-01-13 10:40:44	4be22645fa65d7dbb173a51ce9ed6509c600c61df8ed4a131d66d9745a707510.exe	d8432ddec880800bfa060af1f8c2e405
2017-01-13 10:43:00	file.exe	cc0afec652b9a397532685277d7b79c8
2017-01-13 16:03:02	LL_Kazy_Crypted.exe	7aa9472a8974717cd9248d33f3036ce1
2017-01-13 16:09:02	clean.exe	9ca55b46d50043a7055590d40a379c8e
2017-01-13 16:18:02	whitemoves_LL_Crypted.exe	0d76812a77abe8424c29e7d3d540cead
2017-01-13 16:21:02	phcaen.exe	afb3725ae341fb58c03d9ec3368c5762
2017-01-16 17:24:05	456.exe	7b01f2747310b33963381315d8cc8124
2017-01-17 12:42:02	pdfserviceadob.exe	38d9c8816e244fb733e9c9178e424d1e
2017-01-21 23:12:02	ikcsbn.exe	19927de468f347a363e4870c20550b7a
2017-01-23 14:45:10	PO439.exe	5b7184b825866b331b646b976e52165d
2017-01-23 19:06:02	abda.exe	530bcc7e1782ae1c16391d1d3bd38624
2017-01-23 19:09:03	tydanj.exe	46078a92c76ea26b8282dbfffbfb6f50
2017-01-23 19:12:02	smis.exe	2ca6228d7cb36535c19627154e590526
2017-01-23 19:15:02	dgy.exe	13b38a0a468aa0fed7fa03f726f4725c
2017-01-23 19:18:02	obei.exe	f8b743c79b3c2b3a6d76992a699ceb23
2017-01-23 19:21:02	mabn.exe	37f6f01682e494d465d971fda501956d
2017-01-23 19:25:10	microword.exe	0e955a3c666254419ce8243d41898808
2017-01-24 19:06:04	agent.exe	6c18dbf7112b9a1a41c718612d4a53c1
2017-01-26 18:42:06	gp2n1asmsoneNOte.exe	a589dba63f53cce51b4ff16fca47839b
2017-02-02 17:12:03	wodse.exe	e651dca5c850451cdba7f25cbb4134e7
2017-02-22 15:54:12	testnews.exe	b4eabb212f4324ca6cf9bd3e128ce272
2017-02-22 16:00:03	super.exe	61aea9472ec4729b50ff7ef04cff5ce0
2017-03-10 09:42:13	file.pif	ff249d7312d718f7b270322487ec9b72
2017-03-28 16:47:17	EC779.EXE	9874d11bd6bfe5662d22df63f32c588a
2017-03-29 16:39:34	client.exe	78adc6ac4cf7a51f7da68a06acac09e9
2017-04-11 14:08:16	OfferInstaller_dotnet2.exe	5abf5e44b169139e1da5b8b92378ed0b
2017-05-02 01:48:02	ccd.exe	fbf096d1315004a7aa6b2f53597d1ea6
2017-05-03 22:27:03	pfiles.exe	fa04fcc28ce1047740385b1d36a7f329
2017-05-24 10:22:22	EternalRock21.exe	c52f20a854efb013a0a1248fd84aaa95
2017-05-24 10:33:10	EternalRock1.exe	76e94e525a2d1a350ff989d532239976
2017-05-24 10:37:13	EternalRock2.exe	53f23e72664dc9efd4251ba1b120d932
2017-05-24 10:37:36	EternalRock4.exe	32be774b3464637074299e1f16f4b8ea
2017-05-24 10:38:28	EternalRock7.exe	0e83b186a4d067299df2db817b724eb7
2017-05-24 10:39:07	EternalRock9.exe	5381aa6cc426f13df69a956984614855
2017-05-24 10:39:26	EternalRock11.exe	5f714b563aafef8574f6825ad9b5a0bf
2017-05-24 10:39:54	EternalRock15.exe	198f27f5ab972bfd99e89802e40d6ba7
2017-05-24 10:40:41	EternalRock19.exe	35c29de908e04eca97b39b96b3cadc2d
2017-05-24 10:40:49	EternalRock20.exe	8632e7433fd46a491d4fb8cad11ab8c5
2017-05-24 10:41:10	EternalRock22.exe	b61068f85f030ee23d5b33b5b0c03930
2017-05-24 10:41:34	EternalRock25.exe	7f9596b332134a60f9f6b85ab616b141
2017-05-24 10:41:46	EternalRock26.exe	43451a1691ff539bccff261ecf6e5912
2017-05-24 10:42:08	EternalRock27.exe	5e8e046cb09f73b1e02aa4ac69c5765e
2017-05-30 03:48:04	b7.exe	97980de9fef180b0794feb1cb8c77487
2017-06-05 23:57:10	Dyidrv.exe	c6c6740453d3aea46cd05a31322b1c03
2017-06-07 01:57:05	sutes.exe	90445d4cecd3154ea0d80e59030b18d2
2017-06-09 00:06:05	mikyfile.exe	ea633911f766ce9012d3d077c53bf8b6
2017-06-12 14:44:44	WindowsU2D.exe	433468a49389c396059fe57532701544
2017-06-13 07:15:02	STA.exe	4e9ad3a14823ffb64c21568ae74f02e6
2017-06-14 05:48:10	today.exe	ef234f23724dc00e693bdb1b1218c1e8
2017-06-14 05:51:04	ee.exe	cb78889d61c9c6d91f96162001847393
2017-06-14 12:21:25	harry.exe	1d5391d12095411945ea7223a9393078
2017-06-24 20:48:09	s500.exe	5254ad8a9634da8e4b48ca18727caa7e
2017-06-26 14:45:07	DocLondn458948.exe	14b6aa6da1f3eff8b12a0d02c7324c92
2017-06-27 17:55:46	svchost.exe	d2ec63b63e88ece47fbaab1ca22da1ef
2017-07-02 16:33:03	app.exe	4c57df6841cea547307d5815147fd92e
2017-07-03 16:21:06	7c8701febd.exe	303140d9dccea718d55b4e767e460e2f
2017-07-13 20:54:04	filess.exe	ccd7967a0f67f4e6e357e4132eca01e2
2017-07-13 21:54:06	HSBC-payment-advise.exe	ad9b8f26c74c7be13923f00085b9632a
2017-07-14 13:36:03	TT%20Copy.exe	1b97e84fd02c685f4903831284119443
2017-07-14 13:39:01	payments.exe	91e9e3cc7a1843027ac77377144566ce
2017-07-14 13:42:02	boboprotect.exe	8238276ce326793b492b5bfcf02102c9
2017-07-14 13:45:02	TTcopy.exe	b2dbb79ba3acc9f5f037b1a3a68810ca
2017-07-14 13:48:02	pay.exe	49b89e8c1db5c51300519ea6d5b1143e
2017-07-16 06:00:04	Details_of_payment-copy_Nos__534.xls.exe	3eab5d298c5423ff30cef60036c43472
2017-07-16 06:06:05	bin.exe	1e3f0cda1e1920d5922afe786383ea61
2017-07-16 08:18:02	adwcleaner%20last.exe	2d4e151f6f774efa90b3359a79baff27
2017-07-26 10:54:02	satbin.exe	2067d1cb1a25c6d6d371339fad9123ba
2017-08-02 14:21:08	mnm.exe	2bbbb520e5c7129f24491d4a6c80df1f
2017-08-26 13:00:05	Seal_Encrypts.exe	165622754f824013e5045cc3b252daf5
2017-08-29 00:51:06	network.exe	484014cfcb70a39296ca04415f71a750
2017-08-30 00:51:03	immcld.exe	64584e3e6a53cf2b078f363575826c8b
2017-08-31 00:42:03	quotation.exe	34ee279f6006907db002c144aa621d04
2017-09-01 01:06:02	AdsShow.exe	e0638234fb697f2c4ff961fee8f702f6
2017-09-05 20:12:08	wire%20draft.scr.exe	eca76979b83142f1a9531a0c7ab01779
2017-09-05 20:15:03	wire.exe	30a76f7935aa35cb2a5e6b1bd4d6aa49
2017-09-09 00:48:03	dvnl.exe	f6cc60ca4e8467325f5b7cda0054c19e
2017-09-09 00:51:03	gdwin.exe	e940bc847fe3dee59c95e24509a7aa94
2017-09-20 18:42:08	payment.exe	529039ea1e25c7d74567e9ee935a4778
2017-09-20 18:48:05	payment.exe	656feb55eade6808af9aa5c5d1f00fab
2017-09-20 18:51:02	order.exe	7feccbef4ed3a323ed763d24d022e4df
2017-09-20 18:54:09	payment.exe	e8e1c00a586bf69bb7bd967ebbfb162e
2017-09-24 15:42:05	saa.exe	b7d598174f269019592dfadf98741f54
2017-09-24 15:45:04	out.exe	aea474acdcd38dd1e977d18d71b42a3b
2017-09-24 15:51:05	AT.exe	574b6291056e7b0a466c75e79d00fad1
2017-09-25 22:15:09	builder.exe	0ed2773438d578e9fd7e9c0e92902820
2017-09-28 10:06:07	agent77.exe	9ed5b26e4f30b0b93f3c20dc9601c69b
2017-10-02 14:12:04	black_test.exe	d6c4ca1164323b956f0e3607af4e7997
2017-10-03 12:33:02	aktualizacja.exe	398fcb548f9b342d667f46610807ff82
2017-10-03 12:39:10	kjxmqy.exe	1e51f05e3a6ee009a1a32e2d56c40baf
2017-10-03 19:12:05	loool.exe	380979b9e21db307888adec96ee96f14
2017-10-03 19:15:06	file.exe	f29f5352450cee9efa9e9f24d479cfa1
2017-10-06 15:36:03	pi.exe	990f411560079a463ebb21f03fc8182d
2017-10-08 11:45:03	windowsupdate.exe	deac6c1d261149f4b415e875cc1aaef1
2017-10-09 13:51:03	chuks.exe	ca10e677fcff24dc8883ec49dd2c5a8e
2017-10-11 17:51:05	val.exe	8978c08e23045b8bb172eaed50146f06
2017-10-11 17:54:03	rector.exe	695913d69cefcba07f86c32d4de73ff1
2017-10-11 17:57:02	042.exe	a2ff7286733081bdee0489c9ef2eab7c
2017-10-11 18:00:07	fhgngbc.exe	63be5c3e1f60dce83c8806b062360941
2017-10-13 10:33:04	blah.exe	954eaa749f5f945e14a56f52a188f449
2017-10-16 18:36:02	DocSN15102017.exe	c67453fcaf6e6ff841ea100215ff6827
2017-10-20 14:42:01	satbin.exe	5e6e64fd9c5d7cb2c3ad82eacd6284f9
2017-10-23 13:51:03	trickkk.exe	da92d531fd643d8040b4b89f98ce6b38
2017-10-24 15:33:09	7.exe	4fa16a08af75a4aea6999d1a40fba3b9
2017-10-24 15:36:03	6.exe	d1c811c9c8719b8e894a08acd10f579c
2017-10-24 15:39:06	5.exe	b013489f185b7b421b34bd938a727a10
2017-10-24 15:42:06	4.exe	5c46f753384c60820ea2a433d1b310fe
2017-10-24 15:45:03	3.exe	09fc57b5a9af04817be35008abf100ed
2017-10-24 15:48:02	2.exe	6d2f129e495ab2416b0eb63eb87ede9f
2017-10-24 15:51:06	1.exe	7e583d53cbc2223c42e872879a44f3ae
2017-10-24 15:54:09	up.exe	5104af98775d0beef9f29f0717859497
2017-10-25 01:45:03	e.exe	3f741360050136ff28725a9b070455d9
2017-10-25 01:48:04	rrrrrr.exe	05eee79a864f4a575bf6041bede017f7
2017-10-25 22:15:24	db.exe	22d551f1b252eb88794a816aa1461b26
2017-10-26 13:54:05	pputty.exe	256d4639b4514c420f482cc9e795cac3
2017-10-26 13:57:03	arm.exe	461ed2b0c9849227064de735314d37eb
2017-10-27 21:03:02	done.exe	6e6d200a4e081a4f08b30d2780e0ca9a
2017-10-28 17:09:03	dosemu.exe	c1e8dfad2f325fd08778ca47118e6b40
2017-10-30 21:09:04	BankSlip.exe	776cdb53808fd8430d89d16b6c91c490
2017-10-31 15:18:01	0404a.exe	b8fed2d08ccca13137053bf7c81eab55
2017-10-31 15:21:05	aritess.exe	3b5fbb514cec5d5f9ea08c209dc6379c
2017-10-31 15:24:06	stillmath.exe	e50372f6b7568586ee7ea895f0fb174c
2017-11-01 14:09:02	ddos.exe	f791d6fffd8e286ce5c00b5319b50b3d
2017-11-01 14:21:03	rat.exe	82a602c8f6c804f5f390ee094564bd7b
2017-11-01 14:30:03	20.exe	bf823e46093bdb021a322d8e38b94373
2017-11-01 14:33:03	80.exe	773c8caaeb4fcffb6aff1e8325c8df2c
2017-11-01 14:51:03	klws.exe	1ddf0cc50a2d10f346dfa7099dc2ea1b
2017-11-01 19:54:03	20171101085438	2ab5c24fe0b43a94c17825a54a33abfa
2017-11-02 00:48:03	1.mp3	bcc6c7010e50f8f35dafdcc569ca1961
2017-11-02 18:54:04	neeir.exe	0133258f945c16fb7cefee7b9bf9be66
2017-11-02 18:57:04	probs.exe	a7d3b4fe8b4105421e81e2032fd12324
2017-11-02 19:03:04	appData%20(32%20bit).exe	93c5dce2799a86bd87f58aa21dda63d5
2017-11-02 19:12:03	ene.exe	8a078cb4eb0bda1b30a5b3d56eea65e5
2017-11-03 01:18:06	ransom.exe	447af103027bb7cfa1c09538b38a6007
2017-11-05 02:12:05	host.exe	5c928aa9b14eb7a96ab1a80075a4caab
2017-11-06 19:12:06	eze.exe	71d5851e2e0f82eba144e8a10b05fe61
2017-11-07 00:51:04	sys.exe	c960a1344683267b36866fe8fe7eccef
2017-11-07 15:57:08	newtest.exe	56662356b4a9ed129e71dc8487d10d0d
2017-11-07 21:12:03	ego2much.exe	7618b22273d48f247c2834706ed0e566
2017-11-08 22:24:04	aritess1.exe	ec83fc499aee4f1a7b517b6650c316bd
2017-11-09 19:42:08	uuuu.exe	6ed74c713f74e2c5216e23a0c08b8c40
2017-11-10 17:42:03	PhCh%e2%80%aexcod..exe	9c7dba56e25b6fddf1cba95c66f05e60
2017-11-10 17:45:02	Methode_du_paragraphe_argumente%e2%80%aexcod..exe	c52c015be3a633b1173ce1d3bb6a1b00
2017-11-10 17:48:01	Methode_du_paragraphe_argumente%e2%80%aexcod..exe	5aaadfc64da9389fb9274187bab4d2bf
2017-11-10 17:51:01	Correction%e2%80%aexcod._niS.exe	dc79a1471e9c4b792ecd3194af664701
2017-11-11 17:33:03	holanew.exe	2ae2325033413f257037227f0e05ad63
2017-11-14 11:24:03	2.exe	72dd35b0e0a6dcfed3c61e25caafdf44
2017-11-14 15:53:15	base64.exe	69d8cd278ebf55254fd768ef50d55621
2017-11-14 16:00:08	ike.exe	69d45924cd8998fe5a5ea6a50c3f98fd
2017-11-15 19:27:03	zzzz.exe	877c0e368b45d48370691cb0f3cacac9
2017-11-17 12:54:05	testforexe.exe	d6704e4e0b3b343cff4dfaf9c5767c7d
2017-11-17 19:30:09	EmberComing.exe	19d617f11c04dd60e3a2ec8c7e131b7f
2017-11-19 19:18:02	update2.exe	a0ff986347c1fd57294511803bc2d4d7
2017-11-19 19:21:01	update10.exe	c3112f978fc1d99b928dba970a8fc886
2017-11-19 19:24:01	update1.exe	1742b7045e66b0b33d810330056bd6ac
2017-11-19 19:36:03	tyuvsn.exe	5029198b44fb643abc3cc2eb61694559
2017-11-20 11:21:10	ppt.php	19ef546f93889e2ba6d96b633f92d98f
2017-11-20 11:24:10	7q.exe	b3ef79444a8c2e364e1c3ee61b230527
2017-11-20 11:27:04	@.exe	b83e4a43e157108a79a3f8c219064e7d
2017-11-20 11:30:03	att.exe	c95eebf0848b9b8e6d66d3dd2a1b9afb
2017-11-20 11:33:03	g.exe	119555d3ec3fd34ef73d508fcc6995c5
2017-11-20 11:36:52	sk.exe	76e280921dafc3cf1bcc4bf354cef369
2017-11-20 11:37:14	of.exe	ee4719f27ce8d30339f032973b1f8b16
2017-11-20 11:37:30	jjn.exe	48d3efffd3a644c122ad8571d340246e
2017-11-20 11:38:13	cpt.exe	5abea2f9a0aece3b29fa571b4d15c887
2017-11-20 11:39:02	hty.exe	323dd67275520f14395f119b9196c6db
2017-11-20 11:39:30	cbb.exe	7fd3b0305ec040639520d39851974b89
2017-11-20 11:39:57	D2.exe	60a495bbf6f57ebb58d9a0f0367d837a
2017-11-21 03:42:03	smoke.exe	a98124b7707f80d7874e6028799fd2b2
2017-11-23 17:00:04	IM.exe	44409de558e746916eb6338ff6c280ce
2017-11-25 04:03:03	qpartovuu.exe	cccc2db99701db3ac5852ffa48e6556e
2017-11-25 15:54:18	seagate.exe	fdf777c8c92355ad95c5ab7e4aa0a32a
2017-11-27 12:51:02	fuksifk.exe	d6e801a39fb1c60dde5d7365d0e8d632
2017-11-27 12:57:05	V4.exe	04f1689f91632dcd2132be2ff3aa1e12
2017-11-27 13:00:02	V2.exe	adfefbca3796691521ea74b8421bb9f9
2017-11-27 13:09:04	do.exe	996f31a8014d0d546acf98a4fa9d89c7
2017-11-27 13:12:02	mb.exe	5354a1ab7cb23bc81b7aa663a52c4820
2017-11-27 13:21:02	svc.exe	e508994a3219af7495f85591552651a4
2017-11-27 13:24:09	birese.exe	dd51d65e94fca6db26f10cc306643991
2017-11-30 13:09:17	csrvc.exe	b0838808c1d7eebbe4143bbac3b2e9cd
2017-11-30 13:15:44	Windows Chat Support.exe	f368b490cea45a980c86e212e91730d8
2017-11-30 13:16:10	Troubleshoot.exe	402f03469e52961429c88b6f549d4ff2
2017-11-30 13:16:22	adwizz.exe	8606b485b012595d85cd21edaad99808
2017-11-30 13:21:39	scshtrv.exe	c3030edd3bbc78a94f1a568a8a6bc119
2017-11-30 13:21:50	BSOD.exe	1654eae1a720f617034250a244d2bc30
2017-12-04 17:00:03	fafa.exe	c7e720bc4139039b5d27323d451f5347
2017-12-05 15:09:04	XDFBGJGF.exe	2d5426cd7fed8c0d0e01f6b99b6e5f4a
2017-12-05 15:15:07	c3.exe	5039117f9c2b894127b40815190ea19c
2017-12-07 22:24:07	Fremontod.exe	57dc1364a65766445c1c555f5695b0ee
2017-12-09 19:48:04	gaud.exe	c575e868cfda9c54c652520116399024
2017-12-12 20:24:02	1.exe	2cbc203aa9608408193403adcda7de9c
2017-12-13 14:09:02	droper1.exe	f0d92e555bd9d786980739d4842f9599
2017-12-14 13:09:21	awhy.exe	ab426b32e4e1567db6ecb7d48bdcd64d
2017-12-14 13:12:24	eng.exe	1cd13c94f70a672f8dc30be37ba93232
2017-12-14 13:15:24	mtt.exe	14b7c8036c8487e0e7d3f0c410b9a91e
2017-12-14 13:18:26	wa.exe	024cf2c94c771fffe32ec010d9fb786b
2017-12-14 13:21:27	help.exe	1645f2771891db76683bec08fd77e614
2017-12-14 13:25:07	pay.exe	986512dd402e789e20e706a7597137cd
2017-12-18 13:15:09	HDLO.exe	2a8c99a5d050cf0cb3d988d9d82dfea5
2017-12-19 18:00:04	tttttt.exe	50a652b21941da40d9fca80d12bd35f8
2017-12-22 11:51:05	11.exe	fc544e20d7296973a0e6fb666bd0726c
2017-12-22 11:54:02	112.exe	2123f60ad0934252d66f3e416800d99f
2017-12-22 12:18:02	a.exe	96485e7338ca6441b3cf3b603949b2b3
2017-12-24 03:03:07	susutesla.exe	83b02d936185cece54768ec4b635ec0d
2017-12-28 17:33:05	mine.exe	a5072dc5fb2501dce5e076d82719b200
2017-12-29 20:08:05	from_pastebin_b64encoded.exe	2543867fa8979783e30438ab9c300d2c
2017-12-30 03:33:02	Server.exe	62109846d41e8973d7366980a78857ff
2017-12-31 16:03:05	LXX.exe	4ff11e5ea3b715e21908bb1eacccf27c
2018-01-01 13:21:04	Avg.exe	7eba396e934dce2bffb847e79b047f06
2018-01-01 13:24:01	Server.exe	d1530432ba3d046c5cc4b32bd67cafa2
2018-01-01 13:27:01	inside.exe	aa2223355ce7eaca08272dab131d0a43
2018-01-01 13:33:02	Loki_original.exe	5455364b437d431400267a9092d65442
2018-01-03 16:27:02	rawbot.exx	28f0f62a392c051875038c8f6327388a
2018-01-03 16:30:01	botlocal.exe	56d615f048323c9ee654a9285e00af90
2018-01-03 16:33:02	botint.exe	6a6cd3e08052acea083b871b21337719
2018-01-03 16:36:01	SECRET123.exe	c121c4b6f81b682355e2e524ecb82ecc
2018-01-04 02:45:04	out7364273.exe	7943cb105dd39977df534ced7c625690
2018-01-11 16:45:04	lodurb.exe	58685083b698610e970f5b0766517eb0
2018-01-14 16:24:12	bind.exe	31b9bfaea5d5497f00a7c0ab00d0e47f
2018-01-14 22:51:02	4.exe	12ee889f3a4da0ad4431f67b30b8279e
2018-01-15 15:45:12	naija2.exe	c4b41d73fff2dda6aaf0ff868888da26
2018-01-15 15:51:19	sugarl.exe	8f6f46e53e463bde024775e7279f249d
2018-01-16 15:33:03	yestogocrypt.exe	92e23815b236fa313506d534f2384f04
2018-01-16 21:00:06	fretuguuy.exe	187aa5bb5b1fcbd1c95bf07e8dd41a2d
2018-01-17 14:51:03	LoaderBot.exe	d53504fbe4e02806a1d9c931ce4e9585
2018-01-19 19:20:56	LoaderBot.exe	cb678c68fcbc5f5915e2c4baacbd5a1c
2018-01-21 01:33:10	87844.exe	89abee532ab6532b360b79e2394ebb4c
2018-01-23 22:21:06	maine.exe	09f1305bf6446675becbce188eaa23b7
2018-01-24 11:46:33	rony2.exe	24217bb462138ff00a45e66a500f9280
2018-01-24 14:06:04	chrome.exe	1efca8245d8deec9a133a2a12d7b10cd
2018-01-24 14:09:03	Test.exe	1e5a88fc919f1dde5ce8c69cac45dc94
2018-01-24 19:12:02	svhost.exe	ac569fd164d0b3231a5caa52a7d7e02e
2018-02-07 01:21:08	vnow.exe	bddd8d5f29b42339d86b2316cd60d629
2018-02-07 01:24:02	project.exe	7e0a5b6f8b6425ad20fd2f8d212cd4d0
2018-02-07 01:27:03	prepro.exe	7a29988411eb992e659a1e73c647c7af
2018-02-07 01:30:03	nnewnewcryp.exe	0fa8735f4e8ba0015856f25327668279
2018-02-07 01:33:03	newlog.exe	f6c3700fecafc9a337a2d3610ca472c5
2018-02-07 01:36:03	newkaz.exe	271ee3aa3731219627995d7ce64ef7a1
2018-02-07 01:39:03	newest.exe	57d63a23a440d9eddae61ce0a5d9491a
2018-02-07 01:42:02	godfcryp.exe	22cb34813e874ed5b069bcfa4cadee23
2018-02-07 01:45:03	fot.exe	b128d4aeda16b1c5ff7c68143f61a283
2018-02-07 01:48:02	broscrp.exe	20f2e97128851b76fc643ceab2e5d2b9
2018-02-07 01:51:03	botdcryp.exe	98ab23d0f86c63e69f4c48b066763f4b
2018-02-07 01:54:02	bob.exe	c953507d30d40e41074b862a36f8e7b5
2018-02-08 15:32:02	4A72D2.exe	8f0a43e62d111501357a8b1fee5372f4
2018-02-08 17:21:03	blind.exe	ff16061482a1ce8e15c584aa9aaef55a
2018-02-08 22:30:08	poloport.exe	cefd943367d9ebe51f30c18053812003
2018-02-08 22:33:06	goldx.exe	ec2012f60b778e3045f5c1b1a9cf3c85
2018-02-08 22:36:03	orderoriginal.exe	60d1d55b9b5f7e75dd3941055771ebc2
2018-02-09 13:33:05	jtfscr.scr.exe	9f855ae9d01b630feee03c25d9fc01b6
2018-02-09 13:36:04	jtforce_signed.exe	8796ec107b2edc3a02f94909f4404d99
2018-02-09 13:39:03	PurchaseOrdersigned.exe	816717dd34c1fb56cfe4c9c1f1c8faaa
2018-02-09 13:42:05	design.exe	43dd83f946eccf99cc9b3bd0ea75457f
2018-02-09 13:45:02	purchasee.exe	1427f5ecc249be068b11da0614b1ad6f
2018-02-09 13:51:05	mabtera.exe	65066ae1d8f1aae5f2a0c08483a08fd3
2018-02-09 23:42:03	Order.exe	acfab34d7de53099be1a5e431fe9da38
2018-02-11 20:51:03	AAA.exe	3c6b8d07597e9a43a3a3349bf9ea9928
2018-02-11 20:54:03	Brochure.scr	6dc544f2fe3aecff02138f1880ce5ba7
2018-02-11 21:00:03	orcflame.exe	a76b55b0ec0595797bfdbbe999c3bd7d
2018-02-12 20:03:22	MasterG.exe	a9975d0fa1caea6dee9ccd43ba8c672b
2018-02-12 20:03:58	Mugabe.exe	02c547368076c93a76b115f3f9956f41
2018-02-12 20:05:33	Timeflies.exe	bba3bf70677f130212bef8b54f7f94fc
2018-02-12 20:06:00	angrybird.exe	7ab80740e44a246481f4f48bd319b96d
2018-02-14 14:51:10	polists.exe	d6fb42edf3ecc65aec2431afe6cf2701
2018-02-15 11:21:03	ymc.exe	0be741b4efbd5b0e8e078ca82f53f319
2018-02-15 11:24:03	stev.exe	b137f480f95bf4ea08351107e21a5335
2018-02-15 11:27:03	starboy.exe	5de529649099c0939abddfc06d0c1ceb
2018-02-15 11:30:04	roman.exe	7c1a4c9622e4b76e03aa95e55d9ff895
2018-02-15 11:33:03	khalifer.exe	cbc07da2b936772cb8ea4bc06283e307
2018-02-15 11:36:03	jaga.exe	d89ec8211056a2b12293534c4c44929c
2018-02-15 11:39:04	controler.exe	bf0731cba56e2d3af4ae63b12f2d9751
2018-02-15 11:42:03	coded.exe	5538a6511ba7d4602bee073143f9d4e5
2018-02-15 11:45:03	chisom.exe	92572f8b89b391abb79a7ae51644cee9
2018-02-15 11:48:04	chidi.exe	e1cbec9e98c2a7d81ba5b493f3a49a5d
2018-02-15 11:51:03	alex.exe	b410d6237e70eb719570f04675d32285
2018-02-16 14:48:04	Payment_Option.exe	d2e84596cbfbd138c82023a75e26489e
2018-02-16 18:36:29	ban.exe	a28a7c48412ec7327ed5a881925b7d71
2018-02-16 18:37:11	boy.exe	92376f1add91daf34d723a3869405cc6
2018-02-16 18:37:48	ded.exe	41057f7a3e365110d2745ab516083c21
2018-02-16 18:38:10	evo.exe	0ef7043a24a627c9f011de739fb6b3d0
2018-02-16 18:38:34	fer.exe	a682e99a867287caf7b9d53fb2117ebd
2018-02-16 18:38:58	idi.exe	5ca5658dfc3caab33c85b45024b9a3e8
2018-02-16 18:39:21	lex.exe	5e204979a32a9f7dfcaa8462274a14cc
2018-02-16 18:39:54	man.exe	bcdd86256a47742877cfbc9d377367d8
2018-02-16 18:40:34	oler.exe	32024c6919d4995fa51cfaf4a1d98ac1
2018-02-16 18:40:55	som.exe	312c628d449048cfe6d7779abcc45c86
2018-02-16 18:41:21	win.exe	653d490a3b9b0924a582df196b518bfb
2018-02-16 18:41:43	ymc.exe	950e6c6deddd9cf4b3b6ff51720d5d9c
2018-02-16 20:06:04	WindowsDefender.exe	07121f08945fc8853e60830f694b54bb
2018-02-19 21:24:04	usgg.exe	078524be7d57b9d4f05d74e7f940c49e
2018-02-19 21:48:35	bran444.exe	4534e0f0b52c68d6c85abe23a7e84219
2018-02-20 12:57:02	zoro.exe	da9f1fd295967bda72c3dbc74f3b7d00
2018-02-20 13:00:03	xela.exe	712f92012debe7718f98455662ae99e9
2018-02-20 13:03:07	refi.exe	a225d4cf073757083a309663f02c58f1
2018-02-20 13:06:05	oves.exe	5c1021ae204c48f6a475c65b060ee839
2018-02-20 13:09:05	oleri.exe	d9eea652e097a3f9f950fc6998682ad0
2018-02-20 13:12:05	niw.exe	67dd3dec0f00be436a15f1a455551334
2018-02-20 13:15:05	idihc.exe	b093dda14ab2bcceaf790f760db88d6c
2018-02-20 13:18:05	dedoc.exe	f4a8e9410628abd944b4e5d599823487
2018-02-20 13:21:07	cmy.exe	f78631aca9bd9ab5becfb068ee6825df
2018-02-20 13:24:05	chis.exe	207b78b947340ed9bd5028f2e5e7fe6b
2018-02-20 13:33:06	63.exe	b91ef5418904c2e0ed9f3f0508961520
2018-02-20 18:09:04	Abbb444333.exe	e6cae6e3ec1fc374334787ef7bc7f707
2018-02-21 01:45:16	dwalefm123.exe	92877bb5698cad5fae016beef553a256
2018-02-21 01:48:10	dman222.exe	64d5cc20ad34d04472294166cf5a8fc2
2018-02-21 01:53:22	dewaa111.exe	0e57711c6a5dfc9d896c322abdaad2a2
2018-02-21 13:30:03	Office312.exe	a4d1b27a3573545426fcc79c08a2edd6
2018-02-21 13:33:02	breadme321.exe	edf0fab732dac945eeba5ebc610eacbd
2018-02-21 18:51:10	MRK779245.exe	bb7ae1e15988ed7f218e76442c09edb5
2018-02-22 00:03:04	PSA18.exe	c7f1dbf1184138cd0a6dcf90f4266e01
2018-02-22 00:06:02	file02929s.exe	901d5e84791d20bb7ee866c5bbd24828
2018-02-22 00:09:03	llllll.exe	3275abbde232304fd67faadb62021fa7
2018-02-22 00:12:02	mittie.exe	93ac7cdba50aaa1d26c26034443f3f71
2018-02-22 00:15:02	raqeebnew.exe	680de7fe17a10be52ac4c9c7200ca39a
2018-02-22 15:45:15	n.exe	63b493b15bcb69ede539cca8357a2327
2018-02-23 13:21:07	dhl.exe	7dd6f69c2e8875c075ec228395885fdb
2018-02-23 13:27:05	lenz2222.exe	3f7180fa0cde09ce556a4230d21708d9
2018-02-26 13:54:05	Productlist.exe	55ca18e03909bbe7b8a7d73cb1f64615
2018-02-26 13:57:03	Procducts.exe	85c3bcdf4e0f409a875d4e75a746d61e
2018-02-26 14:00:03	Orders.exe	b3a507e0fdcf0c7771080d3b3415fc2c
2018-02-26 14:03:08	detailed.exe	fbc65494253f30705016057aa905b855
2018-02-26 14:06:03	doc.exe	be646fc978b7ca935fe427369e33c55b
2018-02-26 14:09:04	nawa.exe	557e0c20b36326732daee624153e473b
2018-02-26 20:34:01	agftelsa.exe	385d5b2e8abdfb32f6a00bc3f89a351f
2018-02-27 12:21:17	obii.exe	19e79e25cd39976b2ca9c07e91a2b757
2018-02-27 12:24:02	p2.exe	390b369755d893c5dda36e666364b18e
2018-02-27 23:33:06	teslamyworld.exe	7af7b5de0d1451eee0020a441277c5df
2018-02-28 12:18:06	goblininvestment.exe	59b9367dbadf13b7cb6d15d3998d5892
2018-02-28 17:33:11	svchost.exe	1c8d8a4210e768ebc55c1fd00c2c8fa9
2018-02-28 17:48:03	thurstelsa.exe	08954b35b2ee4f36d4e45a3cc84c4397
2018-02-28 17:51:02	chinatelsa.exe	71e04e3d0fd97aef1c164bb99230b27c
2018-02-28 17:54:03	Janamonth.exe	f0e7c4ae81fe06df952a03e7b7f1f723
2018-03-02 14:45:49	Chris69.exe	8f66a152c43947b1243a59e8a23c06b0
2018-03-07 17:21:04	fsrf.exe	1db01fb97dc5365aef8a7cc4a4e2af0a
2018-03-07 22:36:05	checc.exe	454a3b7bfef81adfa340cc2141c587a5
2018-03-09 16:21:03	drop.exe	4b58c9fd01d61e8973005933c074b6d3
2018-03-12 14:24:03	urgent.exe	ed2a22dd4c316dcd2cfe3bda21e5faeb
2018-03-12 14:30:03	khalifer.exe	c8fb97a8a400781bf8f7e3d2ab66e95a
2018-03-12 14:33:03	jaga.exe	7c0f36e996d94d01723372eda8309d81
2018-03-12 14:39:03	alex.exe	8485f2b20cbeef1301aa4c75baf71aa8
2018-03-12 14:42:03	ahji.exe	46ffb1fb32ed3769c93862b8c94434fe
2018-03-12 14:45:03	Scancopy0312018.exe	76049ea5eed00df7ce910b49fb171c3d
2018-03-14 12:51:05	putty.exe	81b2ec652c4c07d310291cc43fec0a89
2018-03-14 12:54:04	olamide.exe	fb6ce3ba501919c6f5a8ee98f44d634a
2018-03-14 18:03:04	kccInvoice.exe	a111e207f495b18de5f6466e56f19f4a
2018-03-14 18:06:02	Scanba647364DOC.exe	67d5840410afae82743d01ded7df4da8
2018-03-15 15:03:03	bn.exe	f8d716e541b5016f603c7f6bfbec3db6
2018-03-15 15:09:03	Quotation-Oasis-Projects.exe	64eb40cdc28a9f3b3847eef14c5a174c
2018-03-15 15:12:04	fb.exe	843485dbff12620fb58532fab189a3fe
2018-03-15 15:15:02	cnxuoir.exe	ffa3fb48a339894ea095d4daf804011c
2018-03-15 15:18:02	swift.exe	a7cb109485d73f7adaf68652d04e254b
2018-03-16 11:24:02	Flash.exe	de92204ac5537f2cce8db7eede59f216
2018-03-16 16:21:05	mosessssssssssssssssssssssss.exe	81e104d01fb9e6cb37147936a288c999
2018-03-19 15:21:03	HOLLYWOOD.exe	b4a63d13eee189a5920f7a4802f812c7
2018-03-19 15:24:05	chuks.exe	2bd265771d5935f74a547dc08ceec3eb
2018-03-19 16:19:31	Win32.WannaPeace.exe	eefa6f98681d78b63f15d7e58934c6cc
2018-03-19 20:33:35	axeopma.exe	247de42a20090ab931f9fc0abc8ebeb6
2018-03-22 17:42:01	chds.exe	fce344ec7f6879f961bca5c7b6a8d5aa
2018-03-23 15:51:08	bat.exe	34a18d979f33393c24d5a14503031ff5
2018-03-23 16:21:06	Updated1.exe	2e5515e904aee021c0d7d2928c79ab9b
2018-03-23 16:27:05	phtoshop.exe	585a7796703434f21de2188a5e294aa8
2018-03-23 16:30:03	offices.exe	e5e56f9374a5a6dd331a0f57883bcbb5
2018-03-23 16:33:07	Re-Loader.exe	686a5620c3da7834205c14d95d2a2d10
2018-03-23 16:39:02	J4v4s0ck3t50v3r5371n5.exe	34c802b36ace4b14986942da497743f5
2018-03-23 16:48:05	ziraat_limpi.exe	dc4200ac514006f084ead7f83b84c928
2018-03-23 16:51:03	ygg.exe	a66c1ca60c1036a8a2e8082626e254e3
2018-03-23 16:54:03	whee.exe	dacd3c7daebf6004064bccf48bf3c074
2018-03-23 16:57:02	skk.exe	248217f5933aee60a0c53ef9ccfb5837
2018-03-23 17:00:03	okilo.exe	2b9ae643a92a909eed70bfa83fc27f6f
2018-03-23 17:03:03	okey.exe	46d4b50fa34ba117a92d33931d68f565
2018-03-23 17:09:03	mii.exe	b639cd208f8220e766b25eb97457bcde
2018-03-23 17:12:03	jo.exe	dc66d298f12764114c8212e4bbf3ed00
2018-03-23 17:15:03	iked.exe	e1618002c8700b4ae261b1e5aea00e42
2018-03-23 17:18:02	free.exe	b8c2a58e357b3ee544f4f21f200fd8c0
2018-03-23 17:21:03	file.exe	f9408e1696237a0c8fcf6f7aa8c9e8c0
2018-03-23 17:24:02	figg.exe	a7b6cccbc2b756a930fb5d22eaf49a22
2018-03-23 17:27:02	elbb.exe	26ce4683f9d6b2c0fa4ed102dbcaf944
2018-03-23 17:30:03	decx.exe	89c04063f2fbb061d30cd978e7a9d46f
2018-03-23 17:33:03	chii.exe	ae7e66ce008be31c0bd97eeede1474e9
2018-03-23 17:36:03	bobb.exe	bd2cffc1a2c3a19f201aa929822c7bba
2018-03-23 17:39:03	ago.exe	5b7cd8a228f6932ddd8750d2c5fba53d
2018-03-23 17:42:02	sutu.exe	9db060b94694f0552d8a4d429c0710fd
2018-03-23 17:45:02	aritu.exe	217708a4dd156626f7fc13b537d57c7f
2018-03-26 22:00:05	adobe.123	d998799170a3d285bd14905e83bf425c
2018-03-26 22:15:10	vauchi.exe	09d18ef22f72390eee7cf4e10be20f89
2018-03-26 22:18:06	ngumastzxb.exe	a8e66e793c958599bebd2273b2bc2d13
2018-03-26 22:21:05	nwedu.exe	d3e346c36ade079cb99cea42c099f805
2018-03-26 22:24:04	nmobite.exe	9dc9370028305ea21bfa0fdd66afb326
2018-03-26 22:27:04	kclaz.exe	6a25fcd863217bfde0fe435c8a5ab053
2018-03-26 22:30:04	oparaaaboyooo.exe	77c9bff32e8616900fd367582f75575c
2018-03-26 22:33:04	anoziexsebx.exe	1a80e943cf73f4400dd323554ba81ef3
2018-03-26 22:51:04	DOCUMENT.exe	c2740e77bb668a04662745486b2db50f
2018-03-26 23:30:03	test8.exe	1b77111c6f6f4a18ce4815e569e6ea2e
2018-03-26 23:45:04	SCAN-IMG_9087437-PDF.exe	e9cff6251603ff2d4f7ade0288ecf42f
2018-03-27 16:30:08	kemi.exe	abd0a62be28231fa92379f044f1ad7f2
2018-03-27 16:57:03	skkx.exe	a0efbeedd3c7965f8006c097d73dc4d4
2018-03-27 19:18:02	svc64.exe	0b4dff474876dc48f6e23841709ce3cb
2018-03-27 19:21:01	svc32.exe	58e04b209bac2725139342259ac45870
2018-03-27 19:30:02	google%20update.exe	8f7bc3437b64a056a860def231afae55
2018-03-27 19:45:05	virus.exe	9e1f9ced3771270599c7d500ee772e8d
2018-03-27 20:39:03	yg.exe	2c70a406cc46a2c37de4e998987cc642
2018-03-27 20:42:02	whex.exe	8ea08162747fe9cc8d96f312af4c1000
2018-03-27 20:45:02	whee.exe	c59670891b9f5bc63101326e11a45d83
2018-03-27 20:48:02	thee.exe	1ab5afdb8c98594a1b6bc4e3322662b2
2018-03-27 20:57:03	skk2.exe	57b20e3d4d8da951b815f18441e36d23
2018-03-27 21:00:03	sk2.exe	68a6911c58e431f2b6505aff20e7dabe
2018-03-27 21:03:03	okre.exe	d7f1e828987d77f7bd6f283cc80d9f80
2018-03-27 21:06:03	okki.exe	ff07459649bd38e6ece03b097bcc05b8
2018-03-27 21:09:03	okk2.exe	2756c187fbd2f7b1bc1c2b208eddd875
2018-03-27 21:12:02	okill.exe	929792dc7370f58531a9ae0482949bcf
2018-03-27 21:15:03	okii.exe	d6294bde892ac0fd75b23614245cb9f4
2018-03-27 21:18:02	okff.exe	3711ae71aa5a5ddf47f88ab08f5e0f9e
2018-03-27 21:21:02	okeke.exe	73762b9243eb0685ac3cc545bb224f1f
2018-03-27 21:24:02	mix.exe	e448f6747277337d370e8ec53c78fbbf
2018-03-27 21:27:02	joo.exe	b724685454d075024f7cb35d5ca23498
2018-03-27 21:30:03	jo.exe	445b32cca5b85d9331028d2806dffe03
2018-03-27 21:33:03	jizz.exe	d3f5147bd456e7ed3bab303ab01e52be
2018-03-27 21:36:03	jep.exe	1dd6186fc46b383e4da156908f1b2847
2018-03-27 21:39:02	ikx.exe	e56f57da052407dfa21672b5177ae7b5
2018-03-27 21:42:02	fret.exe	02e475cff44acb970f77268d27911f90
2018-03-27 21:45:03	free.exe	efa1af3f1b4d7485c7f228b6dd0631c3
2018-03-27 21:48:02	figg.exe	a5c5372a5bebb1735d38b22ad1ef96e1
2018-03-27 21:51:03	figc.exe	2feec5c1b7347fa88191d74757975095
2018-03-27 21:54:02	emyy.exe	a0e05d09c7e97c345da0c3cd35c041c6
2018-03-27 21:57:02	emy.exe	ec26a06ccc883c6f7b604ef5879677c9
2018-03-27 22:00:03	ellb.exe	16bcb2fa16859bf0ac8944bf875d04f0
2018-03-27 22:03:02	elbx.exe	45e0c1de47d3d6184d06564800176904
2018-03-27 22:06:03	eizzy.exe	834cb9c64fd501452f09d47abdcca383
2018-03-27 22:09:02	decz.exe	2e73b641edd83ef8a25356f60b2135cb
2018-03-27 22:12:03	decc.exe	f0b5894cef25d606e1eac726d5182765
2018-03-27 22:15:03	dec2.exe	4309e4769131dd458a9fcb07a81dfb69
2018-03-27 22:18:02	chix.exe	ba301eea09b01f6712ab306eda0b11ce
2018-03-27 22:21:03	chii.exe	c63c0198a024c0f8143d59a2499caf8b
2018-03-27 22:24:03	chib.exe	c5c0370a15454ca6096de3f269d498b2
2018-03-27 22:27:03	chhi.exe	5caefb76941d2a67a187fd4bd21747ea
2018-03-27 22:30:03	bobb.exe	01f7881f6364ff42c51b3957e8891a8b
2018-03-27 22:33:03	bob.exe	68edb34a3da1e301b0559745dacc5605
2018-03-27 22:36:02	agoo.exe	ed8d92546b0122cdd50e30dd375e6212
2018-03-28 00:00:03	928923	3ed891595a4136d07a93ddda2fddef26
2018-03-28 00:06:10	bypass.zip	273882cb95a94a78590676278ab4768a
2018-03-28 00:09:03	RATNIK.exe	62cf1a3a043f586bf2adb4423cbda42e
2018-03-28 02:36:02	eizz.exe	8ecde46db39afbbb130b6f36013c79d2
2018-03-28 02:39:04	shellz.exe	2f5a2ef699f99374072ddf9f3c7a2bbd
2018-03-29 03:03:04	bauchi1.exe	9d1f2fcba0db07cf36399d5f2795914a
2018-03-29 03:21:01	logggs.exe	ca9853eda6441f5eb880e94dcd83be2c
2018-03-29 10:18:02	50.exe	aca385ebb6000b89152701f6870c1696
2018-03-29 14:45:08	ObaReadme12345.exe	c3253ad0974253b26599a35e6bd2205f
2018-04-03 12:18:03	abbb23455433.exe	0faa783fe3f89f627fc839440790a01b
2018-04-04 04:27:05	MOBIET.exe	e33b37b93ff2f6156ee25289bddb33f6
2018-04-04 12:15:04	job.exe	1b9e40a763de768d475da35966364fcf
2018-04-05 00:18:11	ghghdshch130.exe	96afc9cdef3c623e0c5420e339c57283
2018-04-05 13:39:04	6.exe	bc0d9c5250c435e2b08aad396db5fbea
2018-04-05 13:45:03	4.exe	3c7e5080c12f4e9a63d5a770fa57051c
2018-04-05 17:30:03	OBA948337272272.exe	63788a9c7385a3f66f715b4331be5347
2018-04-05 23:33:05	teslahotel.exe	e0270a486c029cbacd8992d8a3e76887
2018-04-05 23:45:04	Job.exe	c0dca2f5b4ffc602441731b7e399c7e6
2018-04-06 15:54:04	mice1.exe	04abd87e9e3a1bc95333a6740ca71c84
2018-04-06 16:03:03	Rose%20Os.exe	0d5f9bf70637e0b761b2c247e16d95bf
2018-04-06 16:06:03	finebobo.exe	413963fc9d89c589b8ef86bff12e28f2
2018-04-06 16:18:03	sweet.exe	75c847837080536ce9d1676e23c5a16a
2018-04-06 16:21:05	ozunu.exe	a3581f2af8670d3181f4393ed550f3ee
2018-04-07 19:24:15	Tilatii111_signed.exe	f9f74f590dca8b2970d55e694f142ee1
2018-04-09 10:42:03	cash.exe	624fe62b014d70be4beb1821788c4007
2018-04-09 15:33:02	elb.exe	effa008d1d9479c9fe76ec906356bfb3
2018-04-10 12:45:02	35478.exe	000311c67d70867fa85d785206de80f6
2018-04-11 12:27:08	okil.exe	f7155be30ac802edcc8d78f6b402a1ef
2018-04-11 12:30:05	jiz.exe	15c925c43834f8c9117a7ce6b8c10881
2018-04-11 12:42:04	fluxstub.stub	4ffb34c0d829924bd293383b93736c61
2018-04-12 02:09:06	fntwr.exe	fe82cdc93b118de77a387596f4ab28c9
2018-04-12 02:12:03	server.exe	ab34766c5576c24c966b35bea2127089
2018-04-12 02:27:04	okkkkkkkk.exe	50c2221345a927e9b1f20f49f4e32230
2018-04-12 08:45:06	fes.exe	7c57c615432a2262c638238bf1625cbf
2018-04-12 08:51:06	ags.exe	b1cb387243e37a53e8adf44a6e6d9ee1
2018-04-12 12:15:57	scan0336485075941120418.exe	84d6ad7d2ce40336b2d552d9811a18f3
2018-04-13 09:15:04	index.php?id=e0c199b36b383f2b59adb0823f6e2135a668762a1250e0b4a63f68b3ec3f37b4	ddb2fe695edb5ded29389ad905cbe749
2018-04-13 16:21:02	PO355279.exe	04893c9e01b41fa620f9895d696d61e1
2018-04-13 16:24:11	svchost.exe	b2f191927b78564337c098900caf7400
2018-04-13 16:27:02	a-.exe	50418fe197695184ec800ab8b51ee6cb
2018-04-13 16:36:02	19.exe	fe6ecbbb14ebd6368aaa5b4fde592dae
2018-04-13 16:45:02	14.exe	392d7d7f1914dd823d01554471881c42
2018-04-13 18:45:05	min1.exe	c215a9e085e3fb4cc93452136acdc4ae
2018-04-14 09:30:08	CD2.exe	c8442d19094cb6f30ceb6206296d0b71
2018-04-14 09:36:04	ee2.exe	f4bd8c674243dd4629dffdf63626614c
2018-04-14 14:12:04	jT2.exe	41c23f9088a58d2f311d0f4afca22b8f
2018-04-14 14:21:05	nj.exe	826f2bbbf6ec4fb4257a3745c217a64e
2018-04-14 14:24:04	c2.exe	01249483b55efe92ff535dd0ffa25307
2018-04-14 14:27:04	123.exe	f64a6ee560bca663ba0094e37f24967f
2018-04-14 14:30:04	exp.exe	f184f55efcfc55893bac7f4a1dba2c8b
2018-04-14 14:39:04	c44.exe	85cfadbe875824737ca5a10e6855f36d
2018-04-14 14:42:05	u2.exe	0b8d1aedf4c08ca20c40da96d3d740d3
2018-04-14 14:45:03	gt.exe	422320fdf8e1f51c44f298eecc6e76ce
2018-04-14 14:48:04	12d.exe	e87887697ee952ece3847472ac83d62a
2018-04-14 14:54:04	btC.exe	b82c09d13e216769bd333b6cd5f57f82
2018-04-14 14:57:03	99T.exe	66b1bdec5db688c877985aace6e24fcf
2018-04-14 15:00:04	a2.exe	a123b7ffa3deeb0b489ba8ea4726229b
2018-04-14 15:03:03	off.exe	8b5bfe8eecc646bfcb950b3f6909d917
2018-04-14 15:06:03	B6U.exe	13e181d2a320e809e92364f060328bff
2018-04-14 15:09:03	f3.exe	7623ce0f094bbf3a85ee324a7b66edb9
2018-04-14 15:15:05	NEW%20PO.exe	a9c33aeb40fb24e68e583e95b9dc7906
2018-04-14 20:09:02	build1.exe	5b13e1bcc26f7dbf8201169bbc0b4264
2018-04-14 20:12:02	build.exe	0766f3d3a085ff223182010af4678eef
2018-04-16 19:27:03	jo.exe	11fc567794a331b24ac173eec6f941cd
2018-04-16 19:30:03	jiz.exe	78d869f81f0a666018caa3a1f11a715e
2018-04-16 19:33:03	kc.exe	80af921f034ee440872d7beadc8e6781
2018-04-16 19:42:03	sodo.exe	a7fd480472ea3c4138d374fb1be5f7cc
2018-04-16 19:45:03	bob.exe	22f2bbbbc871f5440bdef6e22b6a4ca6
2018-04-16 19:48:03	emyy.exe	9d376b373e47604035b5d8f52fb1bd8b
2018-04-16 19:51:03	figx.exe	1dd59b46c55d33af810deb7379d8a75f
2018-04-16 19:54:03	ikx.exe	2bd3522fe621e9f89c5e241495c5b3ce
2018-04-16 19:57:03	jbt.exe	2736bf941b165729789885bd9a44a627
2018-04-16 20:00:03	joo.exe	c4e19cd8425cdf95d8eddb816f8faa50
2018-04-16 20:03:02	skc.exe	0c8e5176a24e0b71bb221f6779323da0
2018-04-16 20:48:03	adobe.exe	73955155eea1ff12f7edd3159abd2512
2018-04-17 10:27:03	Nj7-nwdns4422.exe	9657ba054390fab9059593cac2d31e0a
2018-04-17 10:30:07	w-.exe	f901b42116f1f8a52cc3abe6d8181135
2018-04-17 10:45:10	344638805252.exe	1c0b8c366932a1b7f403869f02f0c244
2018-04-17 15:45:05	sales.exe	03de12c843cecfb24f3c176ad320774c
2018-04-17 16:15:03	4.exe	304e3ae41237a1076f0a1fc5e78e4ead
2018-04-18 14:51:03	pig.exe	8fd9554784e7c5dc7eaf40fa8c41a1ac
2018-04-18 14:54:03	vbc.exe	62467bb7ad7d2dd61339a95db886a487
2018-04-18 14:57:02	vbs.exe	542b6d5021774086fd0318e78c772525
2018-04-18 15:03:03	watch.exe	8af845e27ea32ceaf0df7201d8f55eef
2018-04-18 15:36:11	max.exe	81614c65192690b345d40e4f7f61c372
2018-04-18 15:39:14	linit.exe	8b70d9183b829c6c958b5ecabe95832f
2018-04-18 15:42:15	andre2.exe	ab545d0d59fa7f38d9590e89a6d48501
2018-04-18 15:45:09	andre1.exe	9a199ad31bf034d4ffc88589f81e9d65
2018-04-18 21:00:03	pgn.exe	b982af50d10892672ce3e34971c92e9f
2018-04-18 21:03:02	jsg.exe	8d45cbd91af90c46df018dbb07fc786f
2018-04-18 21:06:03	jsjg.exe	cce56261d82fed42deaba306ea3147ae
2018-04-18 21:15:03	png.exe	1274b4a82dfc4f5dc8edb823693e0f09
2018-04-18 21:18:03	ppg.exe	769c02924c1973bda865f907618ce435
2018-04-18 21:24:03	pppt.exe	c9328ae9fd1b72b73f0c12215f07701f
2018-04-18 21:30:03	sgv.exe	8674e8fd878a92e92a479b931235bb72
2018-04-18 21:33:03	pt.exe	e7b96664df9f3a09e78e100f8f59ce29
2018-04-19 12:39:06	Billion.exe	1a29823f99b9514f61ae5a2933be8191
2018-04-19 12:48:03	word.exe	b00fa776cad747da404458979b90c331
2018-04-19 12:54:04	yg_kenal.exe	09571672aec8049a954cc3f0b9d3b14b
2018-04-19 12:57:04	boby.exe	d9dd495f577d243c3f493f63d96ae656
2018-04-19 13:00:03	chi.exe	fd23baa9cb72d505209d64c7e8f23a45
2018-04-19 13:03:04	dec.exe	10898243229aa14111bda339595659da
2018-04-19 13:06:03	fig_kenal.exe	d5c2cd3dab2c91c246983c0bda2fe403
2018-04-19 13:09:04	ikec.exe	806a6544447fc352c99b0bcf6a816960
2018-04-19 13:12:03	okilo_kenal.exe	85730fa13a4b63bb5d368ae83fd48106
2018-04-19 16:15:03	order.exe	4f67f664ecb5af6670362ff84f019dea
2018-04-19 16:24:05	new17.exe	733d540ac387af35f3b5bad67b6bffb2
2018-04-19 21:09:05	select.exe	25e41eae46cb78b3db68a9a584f9d911
2018-04-20 11:45:03	decc.exe	a205f280222e218872803657c44a941f
2018-04-20 11:48:04	jn.exe	f3b2a0cbb4d2dfd48ddfee6424a654ed
2018-04-20 11:51:03	mii.exe	4e22777268cb73a0d723224a11128035
2018-04-20 11:54:03	okii.exe	254c8e0c4ea6647ad89424fa27c7fba7
2018-04-20 18:00:43	2018importantupdates.exe	b7f83d777901bf5ef4ef43390451cc96
2018-04-23 12:39:02	2.exe	90c03126881ad731686a06029ac8c439
2018-04-23 12:45:01	4.doc	10f6bf1292118e02826d6711c997fa6a
2018-04-23 12:48:02	4.exe	c6516cfc541d1ca2aaeb3bb9354be19e
2018-04-23 12:51:01	5.doc	9dac713e41ce78a5a84b580f659244bb
2018-04-23 13:33:33	ban.exe	927313d5546862ecf37970cb9bbf9525
2018-04-24 13:54:04	bind.exe	85fcdc1eed1798ca33cac9a3bb6a7718
2018-04-24 17:36:02	STEVE.exe	569406e4dad174e1a93b21e728e719c1
2018-04-24 17:48:06	Loader.exe	3169517b4efaf2964e6079217f43acf0
2018-04-25 11:54:03	obi.exe	589eae5a19c8744686a9f3fe883a3207
2018-04-25 11:57:03	fada.exe	c80fb1eeb3ae1c297f21b1a01527050b
2018-04-25 12:03:03	ff.exe	df923a984777680919d1c67a975aa376
2018-04-25 12:24:02	000.123	29c3122a162e176d96a598260ad1502b
2018-04-25 12:27:02	Cv26Cpy	5be5a1f0dfc4ae6dab6dcd1a50cd2f2f
2018-04-25 17:39:05	24.exe	b78cf1a172ab553e54a45a3446f909c6
2018-04-25 21:48:05	r.exe	aaab9063b467d718f09a440200ed8b45
2018-04-26 12:42:04	tested.exe	7d576b3385523b3e3ab1475c6f7fdb99
2018-04-26 19:21:05	4.exe	548ea0ed1a16fb41620415349b02d781
2018-04-26 23:33:08	obc.exe	cb59ba1506204e720978fd84ec80eab2
2018-04-26 23:54:04	KOIJHUYGFTRD.exe	abbf5511d7dd16a6c3bf1822cfd693db
2018-04-27 00:18:05	0000.exe	bf8f74eb5dee1bb05729a4092481f8c5
2018-04-27 00:21:09	fkg.exe	f3e75bfb3c2db89270475faacc0ab519
2018-04-27 09:06:02	6.doc	da2bccb8c3bab13bb93a150849843b25
2018-04-27 09:12:02	1.exe	ea776af4ded7a6c84aa5a97ed69e9dbe
2018-04-27 09:27:03	vbc7.exe	1e1ae714a78d5672d7c6c1abd1bb75b6
2018-04-27 09:33:03	jgp.exe	c5cc63b565d9844525e9490f972f8d91
2018-04-27 09:39:02	vbc5.exe	e554ef9729f8ce7481875a8e79782cac
2018-04-27 13:48:14	poo.exe	e127ce81272268b90914e16fb9993f7f
2018-04-27 13:51:08	po.exe	bd982b5c96a987735af31b9bcf68f268
2018-04-27 13:54:06	p1.exe	b2aa6bd41f3a8b4a0aef513189ca4fd6
2018-04-27 13:57:07	p.exe	5d36aa1fea2ce38148c245b93da0e4ae
2018-04-27 14:09:07	cv.exe	e8a1026d6d025f281c596870fc1185ad
2018-04-27 14:33:08	firefox-update-guide.exe	c7cdc26095bf16e36457bb1f2509be16
2018-04-27 22:33:10	windows%20defender.exe	a88e445f028a77ca2d78400984554b91
2018-04-27 22:36:03	dllhost.exe	6157b1b75158a6aab48926690638378b
2018-04-28 00:00:05	ruy.exe	30bb8de34570df19499392ecb6e38f76
2018-04-29 14:06:03	7.exe	170068ff957644747f3ba1bda893a306
2018-04-30 15:21:03	NOTE.exe	18eedaa80fcd3df3fe531a55e3538a6f
2018-04-30 15:27:04	aksu.exe	952b3175b5f09b4d5434f43d45d43c57
2018-04-30 19:03:03	fr12aaa.exe	151b93106759d45e49497675f026a76b
2018-04-30 19:15:02	10.exe	e3666ecb82584556a39520ea0e788ccc
2018-04-30 19:27:03	9.exe	b2c6201fbf33abdaacb838ad410ecab8
2018-04-30 20:45:36	ggg.exe	9cac744095b6f061f0d4a1ae1d06de94
2018-05-02 11:21:07	netpp.exe	12457923ecb62e66b302ce66672a9411
2018-05-02 13:36:10	ApntEx.exe	f2c2559d714056adcdc939ddf0577341
2018-05-02 14:18:03	explorer.exe	8c25d4276cab432d5c5ad813be4cf2a0
2018-05-02 16:12:10	Invoice_TR2000076585.exe	f8d7ae8d0bbbe31bc7620f893fb289f6
2018-05-02 16:27:04	Docs.exe	387a91b8838822545a839dda83b9c57d
2018-05-03 16:00:04	wealth.123	2d88fec194225a419b391ebbb2472ba3
2018-05-03 16:09:03	ahm.exe	b5f182fdb6a92a48d151bd2281f92e85
2018-05-03 16:12:03	don.exe	6a2c2b021b25da0f433c1224a6aa7931
2018-05-03 16:15:03	fast.exe	26009fde9a7f47f8e376253f3a2d4282
2018-05-03 16:21:03	ob.exe	e59e34230a606484ca7f5d0d161de367
2018-05-03 16:27:03	tonyeng.exe	5a64b7f6e992902904ece01379cd1127
2018-05-03 16:30:03	world.exe	bb73586cedd8767a216880ba2a7c7750
2018-05-03 16:33:06	ORDER.exe	d9edbfddad6c8e3614651445203bcb48
2018-05-03 16:36:02	carmen.exe	1c623485b37aea0fdfcf1f91ccffbbd2
2018-05-03 18:57:05	plugin.exe	f0c9b65512b6e739c1692eee1a41b8d2
2018-05-03 19:33:08	MATERIALS.exe	2475fda58a0ac4c571deb76001a6d81d
2018-05-03 19:39:06	pl.exe	fdd96d03b772b5bd5a76b7b310b023d9
2018-05-06 15:33:03	filer.exe	be6fa90863f328a042a6973a97500e87
2018-05-06 15:39:03	expleze.exe	c8818f0327ff44e33829ab49b6153c66
2018-05-06 15:54:04	tax.exe	367c5c6dcb2c82eb7bb863086e34f66d
2018-05-06 16:00:04	lambe.exe	1954aa127889dff5ab305f6f8afd14c0
2018-05-06 16:03:04	abu.exe	9fe67112dce594369662336a6e8f7b23
2018-05-06 16:06:03	baker.exe	f7a655ef4f08e54e04f643d0f1927b84
2018-05-06 20:33:04	payment.exe	674de5033c26c516ac745e1568baf9c0
2018-05-07 02:15:03	sun.exe	001933b3101f2b333544a89d206383e4
2018-05-07 02:18:02	log.exe	7689084a60f4481351bbbe4ef36b08a1
2018-05-07 02:30:03	home.exe	24ff61047a8d6a2bd9e282aa78e51964
2018-05-07 02:36:03	sun.exe	807e36099afb31e1d16a3b1ed0517d55
2018-05-07 02:48:02	loh.exe	bdc7ddfc8d98b94a2a0f9311e18ff50e
2018-05-07 03:27:02	home.exe	c6dfc506c1d474edb559c9f700fa6d40
2018-05-07 11:06:08	Order.exe	28ddb3f1013592bb1b4413ee39009a57
2018-05-07 11:27:10	trxns.exe	4733e78c47aca6cbd5b5bb092e562478
2018-05-07 11:30:09	transactions.exe	3372a805c849004ed6adf83bf62bdfaa
2018-05-07 11:33:05	orderCP.exe	7199b0b2c94eb8727ff0a9446d16c718
2018-05-07 11:36:07	order110.exe	c882debc49ff54f4cbd385eb39dbaca5
2018-05-07 11:39:10	order.exe	4a37b128190ebeb46b11976ef6dd702b
2018-05-07 11:42:08	newp.exe	8b683771c162d0f751ec0eed59ab8471
2018-05-07 11:45:08	netnew.exe	75d302f87cedf67103b7a40234dc2f4e
2018-05-07 11:48:08	netly.exe	a9ea5e73237d3e45ef3b2bab04612266
2018-05-07 11:51:08	imnty.exe	0415673ca7394d42f1e71d8eeb713d51
2018-05-07 11:54:10	imcp.exe	8e67e154ad9fa0f273832e99a661cc3c
2018-05-07 11:57:09	imcccp.exe	917a710a90cf864397280cf6dae469d6
2018-05-07 12:00:08	aggt.exe	f0c9ffce124aa0fce22f9838af812bd7
2018-05-07 12:03:06	PurchaseOrder.exe	fc1e2dfd378b36fa73e9fbde8e3ad597
2018-05-07 12:06:08	PO101.exe	53e5daacbf8f1658a0dd8eb1cce10037
2018-05-07 12:09:08	PO.exe	92b31e271142cc31ef0334a9c91a0ca6
2018-05-07 12:12:10	ID.exe	a0e983ac9bc736fc036deb22f66fac7b
2018-05-07 17:30:03	urzoze.exe	5a8bd143e2f0f197608d52f80d69990c
2018-05-07 18:04:10	swift.exe	21c0027924a5a4a70cd1e61220716224
2018-05-07 18:06:03	4.exe	8acb1a113d20530f501fc371622ff0db
2018-05-07 22:21:06	onvinmao.exe	d697363cbc0300e3bd0953f1ccad9e11
2018-05-07 22:24:04	acvoy.exe	ef6b5acc3560ab386423327f4d1b554e
2018-05-07 22:27:04	avbuuux.exe	b22f10d57350ef4a2663e94d989bacca
2018-05-07 22:30:04	mAXN.exe	dd56c276f568bbcd7fda81acc99004a0
2018-05-07 22:33:04	MACOBI.exe	435e37bf5ce7ae6cc774ec329034f7fe
2018-05-07 22:36:05	diergoo.exe	e635e65ef68472e88e78413129f71aa9
2018-05-08 10:51:04	explorer.exe	c69fe97bdb3753c347a8631311698fe0
2018-05-08 11:10:08	Quotation_Sheet_Scan73838,PDF.exe	e2b6f16b2c8ed6fe9a33004cd82a8932
2018-05-08 11:18:05	tt.exe	a25efbdcb8f27d07c04091cb5f6a44b0
2018-05-08 11:21:06	mx.exe	d687d8a4cf297dfb458707fbc160ebd3
2018-05-08 16:00:04	NEWPO.exe	8aec558a53654fd490aaa58cbae1fc0d
2018-05-08 17:00:02	adobe.exe	f6d82415bafc37418d9ea4357ee834d3
2018-05-08 22:03:04	9.exe	f6ceed83aca6ac5ab1c6b3b38e6825d7
2018-05-08 22:48:03	mekacryt.exe	8e495ada8db963825a774a659c48f5a8
2018-05-08 22:54:02	eme%20tesla1.exe	25666e0ba20220c025f56c79023abd91
2018-05-08 23:39:03	0001.exe	4d469669b057723e536f9c11506fdba2
2018-05-09 16:45:03	Protected.exe	55eff4b8cf32e1144bd789691bc8e3e8
2018-05-09 18:30:08	01298435.exe	fc581054b160686d4cf0f4977cd46b4b
2018-05-09 18:33:09	dc.exe	a2857bce03989d51400094303ae2382b
2018-05-10 11:39:08	derver.EXE	86cc407f3a46c32e7d3168d50b6bf195
2018-05-10 11:54:09	ORDUS.exe	4473e4e0aacd251550f9fb5d3498d34a
2018-05-10 12:03:07	w3.exe	0bd6c88fea0ef557fba63e10e6f085cb
2018-05-10 12:21:12	wassus.exe	42ee81705a4c1621d9823de7f197d7bc
2018-05-10 12:30:40	teststub.exe	79bad068bf77f41d900c38b176fcea41
2018-05-10 12:45:08	wedhk.exe	b922994082835998c5c86eb1ae1da06b
2018-05-10 12:51:06	ibb0187234.exe	d1fac7f95097c33e23156d7ab158f008
2018-05-10 12:54:05	ibb.exe	b5556d707de842281f61a21f107ee8d3
2018-05-10 12:57:03	HKTRF01823.exe	48efec59ba4d386f652da433a042db80
2018-05-10 13:00:03	HKTHUR019432.exe	02b61c4bd363169175bb6513b35f29c2
2018-05-11 02:48:04	office.exe	e67f78a1ad2be092bff4b5a77f75a95f
2018-05-11 04:39:08	team.exe	44231706f35ab33b00c196a592a5b822
2018-05-11 07:30:09	pikin.exe	e192b603ab23cc8eab085cad7add91b0
2018-05-11 07:36:03	NEWPO.exe	181e0ed8c8f09db4749f83ca87bf3e2d
2018-05-11 17:27:38	Products_List_Quotation_Sheet,xls.exe	6d2f206025cfe7f878495bfc3e09206b
2018-05-11 19:21:11	SERVER1.exe	0d975d18b48be7a18ac10f29a57cede7
2018-05-11 19:24:06	Servermarch10.exe	8922b3f2e4a32ac5bac9ce82a39ca9f1
2018-05-11 20:09:02	DRAWING%20MATERIALS.exe	e2a988e5b401ffdeb288e248389f81e1
2018-05-11 21:51:03	read.exe	a6572e51c797d2ecfe8f7c007c730462
2018-05-11 22:27:07	ncase.exe	a1247ec5d64c00b2efca1fda7ea29c5e
2018-05-12 02:42:32	platunum1.exe	4a3a7984b850ab7836c9e61743d1332a
2018-05-12 03:03:05	olamide.exe	837f0015453e2fe843a4cd5672c5a4c8
2018-05-12 17:30:07	robots.exe	a381684bf1f5f47a0f68d8c40d8d3b50
2018-05-12 17:39:07	uomn.exe	9d2366040e224f97a96c62dcf2428004
2018-05-12 22:24:04	mail.exe	fe091c3fb818f59ea770f0cd50f346bf
2018-05-12 22:39:03	jmaima.abc	f557dde31fdf94a5e3bde1fc8ed94bdd
2018-05-13 12:45:06	wealth.123	d3f0a5be2dbea267f5048b317c49d441
2018-05-14 08:03:04	teremerejodi.exe	ba1d34fe94fe7b6e979fbe2289420b7f
2018-05-14 08:06:04	maalgudam.exe	a880a44d148ab956972365df412f0a34
2018-05-14 08:09:04	olwieress.exe	537596ef8ab32909ac0cab0b2044bfd6
2018-05-14 08:12:04	tracking.exe	debacd07ef5278ce387d1283b1cf2661
2018-05-14 08:15:04	khatjotery.exe	1aa58befc5531e24e0ecd6964250f32c
2018-05-14 08:18:04	hujayega.exe	790a55bc54058bd672fd169201d2c98c
2018-05-14 08:21:09	sirri.exe	3c9273c1022bbc4c3b5469c8ca65023f
2018-05-14 08:30:04	iih.exe	59460b1ce0dcb2f8300f4534e61a4a10
2018-05-14 13:12:03	iul.exe	a8e187400ccedf1d3134c238455bd792
2018-05-14 14:09:06	5yezcG6	ba81a5edc34a735dc5a88419243167bf
2018-05-14 21:00:03	et.exe	9eb99c67c0b6ab2a85cd7dd44adbbc8e
2018-05-14 21:03:04	gh.exe	ef2c7bf69513cf30d5320579df36d8f3
2018-05-14 21:06:09	TTPaymentProofAndRemittanceCopy.exe	6276d59d3aeafdad32117975d293eb6e
2018-05-15 01:27:02	surecrew.exe	bb53429c934474eb4ae15362b0b0fed9
2018-05-15 01:42:02	imm.exe	acf4810fac7e2973532fe7c2828644a5
2018-05-15 01:51:03	FINAL.exe	cb0e4c77c8fcbb34bc947e0ff75d4dfa
2018-05-15 04:06:02	olamide.exe	819ff07dfe557f55282df56a94f6ec80
2018-05-15 04:09:09	LEJ.exe	6ca0ec1daad95faebfb4ebebb41aafea
2018-05-15 08:57:03	snoop.exe	0c836cda6823cc0b4b77008312e9720c
2018-05-15 09:09:03	14.exe	97a4a5fa687287e4f0bd3c7e6dc504b7
2018-05-15 09:27:05	Install.exe	e4e77928bf3cd940d09563127bb16c6a
2018-05-15 09:39:08	denis.exe	e3031cf128f0704aa5ad9cf7efc4dfa0
2018-05-15 09:45:12	Doc-2018-0206_signed.exe	639d7b9343aa6f578bfdb09607874c9b
2018-05-15 14:18:06	hity.exe	885a6b438fe3c23b4d8d09c43034d173
2018-05-15 15:33:02	server_fud1.exe	650ddc432872d7ff7088e3376a26acd1
2018-05-16 00:00:07	stunt.exe	2b62478ff645653e0c6eda955a154ea9
2018-05-16 00:15:03	li1i.exe	cca13401371eac655ce0e1f8fe80ba58
2018-05-16 00:48:04	Order04.exe	717791192fbd7a01e220fa7fba1d3fa1
2018-05-16 00:51:02	mofe.exe	1fb98bcf4d8f45c121b4ef208ea8c7e2
2018-05-16 04:39:02	Good.exe	15e43421578b69651fd9fbc1ebc5af5e
2018-05-16 05:24:02	tus.exe	681b9f5117425cd425ef9b3731135bf2
2018-05-16 05:27:03	trad.exe	f5b3e2458ce25b837788254706f419d1
2018-05-16 09:24:12	tx.exe	70774c09cd557ec674d9ef20cafae2e8
2018-05-16 18:09:03	ndalai.exe	46170d5634458889f1a5c45f67ff0cb1
2018-05-16 19:33:04	ordering.exe	1e574b676befa0441d0a5755f2389b10
2018-05-16 20:39:03	ugooo.exe	d0033f0de443164272d2ce64c8359858
2018-05-16 20:45:06	scan%20copy84756786545.exe	a2ac43f1303b5d26d2707d210261f391
2018-05-16 23:39:03	pi1l.exe	8f0065ec279ccc6a382c64dc86eeb77a
2018-05-17 00:36:02	May%20PO.exe	766e8c115aa7cbc24e33b387d354bf43
2018-05-17 00:39:03	wq.exe	e6677822a190e4f33c2f30398f4671d6
2018-05-17 00:42:05	file.exe	0841043e885a453e04f5dcdd43a288c9
2018-05-17 02:33:03	The%20Highlighted%20Materials.exe	169b5af4ee194653eb133d5c1fb7c913
2018-05-17 05:06:03	sou.exe	aeb39ae3517b4ff55de87dc1ce3724be
2018-05-17 05:18:01	000000000.exe	1a811761cd9bfb75569fb56766fed530
2018-05-17 10:15:14	ppo.exe	db6f7ee21578a39f3622be9ed4963a48
2018-05-17 17:51:02	JHkYfFu	363f0a29e1e3f5a76d750bdabb53fbd1
2018-05-17 18:00:03	0i1l.exe	2d4e96f779082a59fff07378aef1b800
2018-05-17 18:03:05	loder.exe	14a7fcc57b45ed50764a12e135d8ebcb
2018-05-17 21:18:03	nett.exe	771050f703dfe0072a4f2a6ec7b1f86a
2018-05-17 21:21:04	pp.exe	0ad9a73872803f10601b98c7b3a84a83
2018-05-17 21:24:03	fraudulenttrxns.exe	d275285df07c7ea145db1025983e1b73
2018-05-17 21:30:04	nenet.exe	998be96ef62c5a22e6023bcb6daed8a8
2018-05-17 21:36:03	nwrem.exe	bf442b28ab0cdca16b81e3bbd6425392
2018-05-18 04:06:05	htt.exe	1713aa07b9e97409c1ff2048a3c7805f
2018-05-18 04:12:06	y.exe	ccf8043ab8857a44caa02fda2259e92b
2018-05-18 04:15:08	po.exe	ac5034baaea3df6ec5c5b49678f364cb
2018-05-18 11:03:04	mri.exe	aa74e18045bc64781763e6034f3ddfaf
2018-05-18 11:30:03	Calculator.jpeg	b023eee4bdb33f406c5093384759d08d
2018-05-18 15:39:03	tony.exe	3f84743ff541cf3ed62b11097757632d
2018-05-18 15:42:03	success.exe	de225405f8e348bfbb5ba8abdc092b48
2018-05-18 15:45:03	hono.exe	5f6adfd8adc46a9195b1ee20d37b3984
2018-05-18 15:48:02	bttc.exe	0b4816df743c4bee529bfcefc20dd23f
2018-05-18 15:51:03	btccash.exe	c7ee9d428222f1c920cd8aaae026b4de
2018-05-18 15:54:02	btc.exe	9ed4dfbc061045da55d9a2acf165ed52
2018-05-18 15:57:03	bossemmy.exe	febed648257274d46d864132745b6a05
2018-05-18 16:00:03	Invoice_tr2018.exe	e432274f6128d2647009934f821d0ea0
2018-05-18 16:24:02	jj.exe	a8e5fe02b93a9f32fd7444ab5d8c5e95
2018-05-18 16:27:03	EQNEDT32.exe	4afe8137c62c19c2618365ba937388fc
2018-05-18 17:03:34	tsn.exe	7fa275c4720679c386f65b9fd7355951
2018-05-18 17:09:03	milo1.exe	c5501dcda7b59756449f20efd676cd15
2018-05-18 17:12:02	milo.exe	b0f776c8a5e56354c006036f360fffe7
2018-05-18 17:15:03	me.exe	f107a8d33adeb3249e3b590329b691d9
2018-05-18 17:18:02	ddd2.exe	8d3f91c66372e89770cf34574cdc9c7c
2018-05-18 17:24:02	New-order-pdf.exe	c01ed28282861c64c111d5f7d82d7d59
2018-05-18 20:57:13	ccu.exe	190934e5abcc77147e3eac7bb10f4574
2018-05-18 21:12:06	winsock.exe	556b5f4ce2b3c47bc3a3e052202597d3
2018-05-18 21:24:08	winscr.exe	17c45dd7d20e118d3254e5e7646af5af
2018-05-18 21:42:04	zeal.exe	732ad6e95c86b3be894fe6ffa27eb683
2018-05-18 21:45:03	edu.exe	32b2668174be406d98bde8c055e809d6
2018-05-18 21:48:05	Emeka.exe	059bb09924b0d8cb7a8cffb72fd0bb03
2018-05-20 01:12:04	ariwete1.exe	c99633f5b044ccfa89c1d3972498e3ba
2018-05-20 10:33:03	gg.exe	ed65794e3c61ad547f97f491009fa237
2018-05-20 10:36:04	QZXFGPXX.exe	a3fb4842b5df7ace8a9822ae1976ecff
2018-05-20 20:24:02	Lenzman.exe	bf310cbe055417eeba73d98d105d6075
2018-05-21 12:12:03	ALPHA_PO-16201844580.pdf.exe	a757e6f65cc6226a8dc6d9b0c6da3673
2018-05-21 16:18:02	atulls.exe	85c3e2a8af7434a0c0c91dbe0ae8ef0e
2018-05-21 16:21:03	Order.exe	2d388bcf0ed35792db09f15f5f462133
2018-05-21 16:30:03	svchost.exe	88575fa4ffcf6842ea92f65beb084b1c
2018-05-21 16:51:06	run1.exe	b288b4599cd44b337aaf87da50fe038b
2018-05-21 17:27:03	hope.exe	3440809244788d0278815edf5d4c8294
2018-05-21 17:45:05	1KTAuRG	21565b4eb6fefe4ff4d21c22c9f30391
2018-05-21 22:12:08	winin.exe	352c94d7274f0db55cc2a7de88d1a461
2018-05-21 22:15:05	luke.exe	0428bc92d6500c100e70d5e4c3cd4d36
2018-05-22 09:54:03	justbelieve.exe	c00d1ef5a50611ac453005893fb32cde
2018-05-22 21:06:02	test.exe	d27234372a53a7c6d8a668231e734698
2018-05-22 21:39:03	order.exe	313a1db859472ba4cc8863d78cc30edd
2018-05-22 21:42:03	fis.exe	b4f403caaa7dd77c4c27bf02687e5af2
2018-05-22 22:12:03	elber_topst.exe	fa80f24fc04d7b657d0b968dd63f9750
2018-05-22 22:57:07	fis.exe	c6650e415309c2b196aa486735dad543
2018-05-22 23:00:05	p.exe	c9fa3ce57dcd3c12ec16577150684703
2018-05-22 23:03:03	da.exe	2d90560e91a732d7c44674e3f606f620
2018-05-22 23:18:07	Order.exe	66a1bd9e39a31126b9221782821ce50f
2018-05-23 05:27:11	CR8.exe	a61f077e0275dab781038b9c4b82885c
2018-05-23 06:48:08	winlogonn.exe	2629f3e38170f563b5c8a75ad69d6c90
2018-05-23 06:51:07	dwm.exe	57a2d46109c29a9ce0b3716aee6b3d22
2018-05-23 06:54:06	POS.exe	abcea83cb1a4ae9aa7413a1963283d1d
2018-05-23 07:03:07	INVOICE.exe	e36f34ebc8254248243141369fdf7634
2018-05-23 07:15:04	shit.exe	6fd1f77d26738cf938efa0e5eddc30ba
2018-05-23 07:27:02	albert.exe	84f5a10bb016c49598fbbdd5a5d71e14
2018-05-23 07:30:18	3.exe	4c5dc8f2d1df1a74df4b1730a2a756e8
2018-05-23 12:30:16	13.exe	58574b6dc105478f0807ea148349c59f
2018-05-23 12:36:19	21.exe	d6cabf8ccf6234a76fef52b30f60e798
2018-05-23 12:42:26	19.exe	4c153c44de8ed3cac3954f7e997ea8f7
2018-05-23 12:54:54	17.exe	292be3082c620ed488793547ccee40ea
2018-05-23 13:08:10	11.exe	8cf1c74955a561ce883a703b1faff789
2018-05-23 13:18:25	10.exe	dd7cdadeae9b4ffc62ac460aeb0213b9
2018-05-23 13:19:58	8.exe	462b767e71149ee7d99e089a3666134f
2018-05-23 13:30:38	2.exe	713e8df6bd82d3260543d0d969905d5b
2018-05-23 14:24:09	1s.exe	d8a713e9aed88093668ec0f19d54e513
2018-05-23 17:57:08	svchost.exe	bf7187d256718c5ade93f520671a4ff3
2018-05-23 18:00:04	Adobe.exe	c894032ba97590c35549713817f0b6de
2018-05-23 18:51:06	opll.exe	519f65c9d76cecb8f2ea85ed5dd32a32
2018-05-23 19:30:06	swiftsz.exe	5c48c9984a3b4bdfc177948ad6fa2a86
2018-05-23 19:54:03	4.exe	d58b262d554730be5e29f7aafefebc9f
2018-05-23 19:57:05	paidcopy.exe	4337923547cb41e7154154dde5b24a8b
2018-05-23 20:09:02	bles.exe	235bd8991d75bbecacf4cf4e89236130
2018-05-23 20:36:08	3.exe	3744ffc1f6219702ac75d05265b4c092
2018-05-23 20:48:07	7.exe	741e507930cfd9a81c9d50ac9f3ad4d7
2018-05-23 20:51:03	8.exe	fb36d6140fb192ca27df75b26e05a4a6
2018-05-23 21:00:03	11.exe	904453e88a179fcab967e54eefbf4c85
2018-05-24 03:15:02	Myjex.exe	8cffc8f53e1e0b93dbbc3b1249dedb63
2018-05-24 03:18:07	Mylex.exe	310612f007cad632a9d2c3db9db2a157
2018-05-24 03:21:07	Nazfilx.exe	bd190a8db314768d2afe800176437944
2018-05-24 03:24:04	Server.exe	b9d0e59b693e28208c1ef2a8dbb820ee
2018-05-24 03:27:05	ServerNj.exe	4d8c1c0bee0ab2ac964f3793c2fd2499
2018-05-24 19:42:04	CR3.exe	0a5c8b87ad01fa14f77cb5c74d0cb43e
2018-05-24 21:21:02	00000LenzM.123	81362f74cc518876fb94917b2b9f9fa9
2018-05-24 21:27:03	001.exe	6ffa9f2924c3d21ce1c8149786ef1f71
2018-05-24 23:15:09	z.exe	a9040f642dd122636f61c52778873138
2018-05-24 23:51:03	2.exe	5499cc737dae9949b4df8ba725c95c05
2018-05-25 08:03:01	WindowsApp1.exe	265bf05e0c6105ee0833e7ae501d3db1
2018-05-25 19:03:02	WindowsApp1.exe	a80d5c2447c955865ad6d40b712bd8ee
2018-05-25 19:54:02	po.exe	a25d035c838157e70afadd3b1b140f5f
2018-05-26 07:51:04	Aritu1.exe	de82934b9c552a078544c611a7976963
2018-05-26 13:21:05	iwantapple.exe	35849f1e5f89af715735afbdeaf4d183
2018-05-26 17:36:04	Protected.exe	19871dd79a15a41e7ec9563075f97e7a
2018-05-26 17:42:03	newmarch.exe	2e67e781c0cfb37d5e03cc6860e573f0
2018-05-26 18:06:02	file1.exe	eb0e42323cb2de27e5a6407cc4f71ec3
2018-05-27 03:42:03	uc.exe	efab1253628984641d41b1c1d641eca2
2018-05-27 18:18:06	cjnew.exe	6300f96828d8aae5bcf12e7083610465
2018-05-27 18:39:02	albet.exe	00a82341fcf8fad8529c8daf1fae9dea
2018-05-27 18:42:04	fran.exe	18c51943aac9798b30acd0a9a8f93a62
2018-05-27 18:45:02	sNdttpC	50a412bc7d2506c30347e21e1d85908a
2018-05-27 18:48:05	tui.exe	8d13bc5012aecb410bc3e5b77bf86997
2018-05-27 19:15:03	adobe.123	d3c7842495e4fcf393508918bd002ac4
2018-05-27 19:21:07	windows.exe	41ebe685cf5937c0511c404ff9912175
2018-05-27 19:24:06	done.exe	aa13f27d17df27f5c8097848044d252f
2018-05-27 19:27:09	minerupdate.exe	4fa1915159ca5d200a5d9c946ccf0bb3
2018-05-28 09:03:06	AGENTFILE.exe	2b6439cd7d93f95df0e30b1525f41ac4
2018-05-28 09:18:03	Kings%20Doc.exe	7d3c2c2ede343c6be0efcad1d4305c6f
2018-05-28 09:24:03	today.exe	d16ce2629e9535534b963bb2b536d522
2018-05-28 14:45:05	MUSE14789.exe	bb0088e584ab7cce3bf54d7bc9202a56
2018-05-28 15:06:03	btty.exe	35dc702c5964933b45c4364f27a65898
2018-05-28 15:09:02	slil.exe	39273288addd175bf28165460b30c45e
2018-05-28 16:27:03	gym.exe	11d56c7b9b131120863f66a97ffd1cd7
2018-05-28 16:30:03	k815gBU	864fc17abaa8c01716ae6822648b388c
2018-05-28 23:57:03	Materials%20Needed.exe	3cdb38adb0aeccd1e0be80228fb7887b
2018-05-29 04:24:08	RA.exe	37e9e02c9e17bd27ed78d1196c7ac0b1
2018-05-29 04:27:04	Materials%20Drawing%20Specification.exe	24b1bb09aebaeb96564b9508f0f13891
2018-05-29 04:36:04	uc.exe	010dce8f1727f2ac367098673b556849
2018-05-29 09:12:07	PO8899.exe	a05a65d69dda6039fd59eaded15c79dc
2018-05-29 09:45:04	done.exe	70d6a3004d46a3a65440a8a2681a9507
2018-05-29 09:48:03	windows.exe	e9a5268cb49813cbb6d0388ae6de96e5
2018-05-29 14:48:03	werdftyxcv.exe	23ccdbf6db957beee15afc7cac91b27d
2018-05-29 14:51:07	gloi.exe	39ffa3dd5db6edf0f208d118be8cb64a
2018-05-29 14:54:04	tt.exe	0400a3300ae7454d9638654071352968
2018-05-29 14:57:03	IMG99000.exe	3ed6d12d935919a70c664f18dd230b81
2018-05-29 15:21:04	paplaz.exe	8f465e7689b313ddd8bbf45b452b6752
2018-05-29 15:30:05	abchai.exe	8875ae2d57289e7589027bd085c7c17a
2018-05-29 15:33:04	buoyoplza.exe	434395db09e27d70ad1f0ddfd1a90f36
2018-05-29 15:36:04	dovg.exe	91c9561e605b9d13935aaa772c9ab575
2018-05-29 15:39:05	maxninini.exe	687cad4427cf912d7207865942276fa4
2018-05-29 15:42:06	mbiyoungito.exe	83753b4a5ab781c5fc0a65dd2806dc14
2018-05-29 15:45:05	obaiiqoqui.exe	377660c9592494ac89bf8fe690e356e2
2018-05-29 16:36:03	solu.exe	acbdf3bb6b4eecd621b71eb99192b7f5
2018-05-29 16:39:03	rank.exe	7f7a749bd2c2224a561e2d2be4114185
2018-05-29 17:00:11	minerupdate2.exe	1f9e441e24c6042c7343c10fc6074767
2018-05-29 17:09:03	IMG900099.exe	f2182a2beff6a3d626733243b75cd96d
2018-05-29 20:33:13	imgclone.exe	5430c25a993989a9489ed62a311e2f81
2018-05-29 22:15:07	invoice.exe	409f0649d4b144b5aa14c6a12857ca6c
2018-05-30 12:30:03	iexplorer.exe	49920d3ad9a4ec311c12b00600a8ef50
2018-05-30 12:42:02	015643672432450.exe	47c0afb728117b9d267d67c2f2677d1a
2018-05-30 12:48:02	purchase%20order.exe	e9c87c368fc199a4e2fdb5771ef902e4
2018-05-30 12:57:03	uo.exe	6d8ab5af874bc3bcdf1df536430235fa
2018-05-30 13:09:07	inv.exe	cc5d016bf64951685246199ca9364a07
2018-05-30 13:12:07	cll.exe	a20a0bad66634a870ced59675c98f949
2018-05-30 13:15:02	newimage.exe	0375083a5f17035e28f9f227b3f0101a
2018-05-30 15:42:05	Gervinho.exe	1e66e0aa79a4dc195569ecafa0c4ba76
2018-05-30 19:36:03	jhn.exe	8a002abdee988603ba652e7260bbd973
2018-05-31 01:03:02	hift.exe	28e2e63361821ebdac9d3a777bb31f7e
2018-05-31 01:39:05	55.exe	d83f9599671f8d0da4be17d77617f5eb
2018-05-31 09:51:40	ConnectorAgent-7.1.1.5205.exe	4b1b7aa5e43dbb2d941ebc1ee1494fa6
2018-05-31 09:57:36	purchase%20order.exe	1d39bb0967900185d6f9981e408776ec
2018-05-31 11:15:04	Deck.exe	087c8ee2753e8c95115ab681a44c7552
2018-05-31 11:21:03	ofd.exe	458d9d3a9abcc86f27671d3fd6ce2dd5
2018-05-31 14:12:04	Apps.exe	ec100fe1401b5ab44d20ae247d92ce16
2018-05-31 15:09:07	order.exe	e3490c20bd637a6037f4720913893b71
2018-05-31 15:15:14	NFG1.exe	e1d315b9fad25172db30386f281bd6d2
2018-05-31 15:33:04	4.exe	3abe771de758841de8b767a6b0c3092b
2018-05-31 15:36:04	5.exe	1b2a3a848f87cbbcc42537e99251f3bb
2018-05-31 15:48:02	1.doc	7dc7dacb6f25d53aa2decaffea34756d
2018-06-01 03:03:04	teslaswift.exe	9d9f240c54b5a9a1ba913d7184966e71
2018-06-01 03:21:05	oo.exe	6126b157dc4070e55da4c8fb01570590
2018-06-01 05:45:03	Limpapauya.exe	ef00c99f7f5f725e9631e3cdef44fb22
2018-06-01 05:54:05	tn.exe	e0ad6b9671bb6abdebb2ddf4b28f342a
2018-06-01 06:00:06	withheld.exe	307764e35a478e422c77d87513124a08
2018-06-01 06:06:04	banacheeta.exe	a488a0c02f1b7a065ba61d219ae3efab
2018-06-01 09:09:04	res.exe	1856ba7de4a465c9b1a7959cd3e02551
2018-06-01 09:15:03	nkfile.exe	bc6fb32faf6601757fe2871625b09e1b
2018-06-01 13:36:05	holst.exe	eef586ec6fa928378ffbc667ed43362d
2018-06-01 13:42:09	g.exe	b99cee8603eb58c97143d9575136f761
2018-06-01 13:57:03	bokf.exe	1c0983e3ea8fef075351004b0936d3a1
2018-06-01 14:00:04	EmiratesNBDTransferAdvicePDF.exe	58d8e45e2efdbbdd4e385eef528618c5
2018-06-01 14:21:08	w.jpg	16d748352329dd9038fd1d562be4e56e
2018-06-01 14:48:04	sawi.exe	37b26a7eabeec8376d2f7bcabe1b6085
2018-06-01 23:15:07	CJDUOOUT.exe	39d6e11b2238e788ce7264e496af499d
2018-06-01 23:18:07	SBOUT.exe	94c4e4fe18361f6178884fc662db8acc
2018-06-01 23:21:05	PGNANOOUT.exe	0e86367e6ab3f180df8006c3061d60c9
2018-06-01 23:24:08	PGDOUOUT.exe	00bce26e2a1013c5acf40519f3fa9db4
2018-06-01 23:27:09	NCOUT.exe	094443f2fd890352f712a3fff79d4c5e
2018-06-01 23:30:08	MGOUT.exe	3c6ae6b660c46f28d2aa9c173807cd1b
2018-06-01 23:33:05	KDATC.exe	05802c35fefeefc47992d59c053e57e6
2018-06-01 23:36:08	CJNANOOUT.exe	0d1908cd1c7861e216c70bf6796c8f27
2018-06-02 18:12:02	000000.exe	97c97a9360d53df04d5fc969f799b08a
2018-06-03 05:00:04	ppa.exe	eb46203637016e8f3fa5f5e524de8811
2018-06-03 05:03:03	commj.exe	beff601484de891d67599e7dc52841c9
2018-06-03 05:06:04	JIF1.exe	3b23dc374ff67cce7ea56e7c2d023164
2018-06-03 05:15:03	66.exe	1d6154aa33977229d441cb2e2a2c79f5
2018-06-03 09:48:06	StartupWin.exe	747f1ed0b7c761f6348db4eac0cc84b9
2018-06-03 09:54:03	3.exe	847133f1bb51d39a2bb1b7a5bf0e979e
2018-06-03 10:00:02	nd.exe	91efed7bb6493d373d8fda375bc8338c
2018-06-03 14:33:03	PHYNO.exe	f500a723652ca0ceefd43fa50797c908
2018-06-03 15:36:02	njm.exe	aaef8a8764b2771793b4986840c2a89c
2018-06-03 19:27:04	test.exe	b3625cd7f9348ad659ed056423b7d010
2018-06-03 19:30:03	coast.exe	5534621d1818b6d246e7ce52a311bf9f
2018-06-04 04:54:05	scan008.exe	23c61fed0fd3b2cb9537a0dc610cfcca
2018-06-04 04:57:02	tif.exe	c5474ec51c52d1a42fd7a6e4202e5151
2018-06-04 05:00:03	sky.exe	6c61ba01924ba4afb3e2ae915d744c5a
2018-06-04 05:03:02	ritz.exe	7c049e9f1b7f0cfd03611890cc916aef
2018-06-04 05:06:02	mog.exe	fddd2b645c98319d10fc9816449c6ff2
2018-06-04 05:09:01	nice.exe	798b126c3c91770ea6e044e02aa81a97
2018-06-04 05:12:02	inedit.exe	cf097b9e16509081dfc8f2dbfaf4ef39
2018-06-04 05:15:02	datry.exe	93dcc205965b4b90032879b8818727f7
2018-06-04 10:39:03	nbp.exe	47d64846e17e347e63fc491f63108ea6
2018-06-04 11:00:02	updaters.exe	3eeece733449517d643ad8e35ff9f55a
2018-06-04 14:42:05	slushbtc.exe	000c29ad905dc50673f564c5ebabc0d0
2018-06-04 20:15:04	some.exe	eb584bc9deb825e125cf0732cba4f234
2018-06-04 20:18:04	albe.exe	bc9f20bb1225a0f1d33d7a1275bfcc50
2018-06-04 20:21:03	bill.exe	49e4fb34bc2dd5c346eeecf8c05bc5bd
2018-06-04 20:24:03	fran.exe	6883fbc62fd02833f28d44624bd0e5c2
2018-06-04 20:27:03	olu.exe	f7236436dce057005e5fda9bd0b9456b
2018-06-04 20:51:02	ring.exe	75f7c142b1d77f3f8fb0446390ecebe0
2018-06-05 03:30:03	flag.exe	f9a2cbbaeae0112641305ca357e4df86
2018-06-05 03:33:07	Builder.exe	a2f5f1bb94c16e7068c73ae0f78841f1
2018-06-05 03:51:03	Gen.exe	6681023899190ee38e10978341e7f86d
2018-06-05 06:54:03	PO-04062018.exe	e5be80183a03600941750e05467c07f3
2018-06-05 11:18:03	Ayamgoro.exe	3ab62a4c61eb740918a7ed93e4c10840
2018-06-05 16:57:03	guoa.exe	35320903bf23ea49734f041a42a1d7aa
2018-06-05 17:00:05	caz.exe	a4b793d63825d01fc706b6234c5d2547
2018-06-05 18:39:08	codeofconduct.exe	3d0c60d2be831327a4e92ddd6df6c8c6
2018-06-05 18:54:07	copy.exe	ac1e54220c9317c708c5f96f1c3e227c
2018-06-05 20:30:04	14.exe	46b255cb008d99da1d0fe1eb51006a6a
2018-06-05 21:21:03	pa.exe	77351f871094f35eca8157d91c407ee7
2018-06-05 22:09:02	taskmgr.exe	8fc226cdf6fe2f2e1c5298b7e5924e95
2018-06-05 22:33:04	YP1vi4S	4b8afd134052648b48536901f10ad1a0
2018-06-05 23:54:06	image.exe	64bda68dfff6e2ca7319ccc1b9962c14
2018-06-06 00:33:07	finalbuild.exe	a1f70231ea8abe5cd9860c7217513b23
2018-06-06 00:36:03	uyi.exe	76902ca8bc4ef01a002df0cbf047c0d4
2018-06-06 14:48:03	zBPvy49	3af50ece7f36a54a605e641f8d837415
2018-06-06 16:48:02	2NMwXLY	6239be602468e66dc2ebff530892aa7a
2018-06-06 16:51:02	amXVGJB	7137c690dee326bddded3100cee42297
2018-06-06 17:27:08	Document.pdf	cc122943225cf40ca403e2ee72304b7b
2018-06-06 17:39:02	lSllsBN	571c53ccb51b00efe3b975ebe8219da1
2018-06-06 17:45:03	tLydlRe	e5af3ea83c8169809a958087c02fa61d
2018-06-06 17:51:03	invoice1.exe	1b7f1ee2a722a99d93768bb6a49a9b44
2018-06-06 18:27:06	wet3.exe	0f8572c94b8f080d42963ac4812ec631
2018-06-06 18:30:05	wet2.exe	3ace8c4c36a886f429cdc3a97bb152f0
2018-06-06 18:36:04	comeonit.exe	418f1f65e33788e9cf07c8b8c0486c55
2018-06-06 18:39:04	Hibuddy.exe	d3ac7a8c93530f5b689695e4159fbf75
2018-06-06 19:48:04	YWMUNUJU.exe	dc88bed8a1c52869696b7508d157d38f
2018-06-06 19:54:04	enable.exe	a87b6b7fc61f253a19981be025898798
2018-06-06 19:57:03	quote.exe	19a022e9ee73b56285fa5265b24006ec
2018-06-06 20:00:03	upload.exe	b127951e2cbabafb85f112e89fc7807a
2018-06-06 20:06:04	phlyahai.exe	32e3dbd9974cb626d1659028643a48f1
2018-06-06 20:15:09	vti.exe	6e04230dccdab9c981d1ff1b435571ff
2018-06-06 23:39:03	wrd.exe	b0e1cbf2d575b2ad969eb7c39a47b185
2018-06-06 23:54:08	PO33344.exe	bbfbda085e25a916cd854b912c821147
2018-06-07 00:00:03	015543672432450.exe	95869f254c4cc69d8017c65a09a83e70
2018-06-07 00:03:02	Purchase%20Order.exe	c75f1047c3239756faa34200a4c654d5
2018-06-07 00:06:02	Purchase%20Order.exe	9a991ad6cb62e3d64a6c14a1e46f56d6
2018-06-07 00:18:02	JZi491F	1ba3431189b7c556a469c44f573ed455
2018-06-07 00:21:03	qEu0xCz	d6b5c6bb055486294a1884cd37bf078a
2018-06-07 00:27:02	Uq8gUtC	9460e88871c248436f9fc2d6872ec9d9
2018-06-07 01:45:02	kik.exe	adefe1847a9a55a47588445932e4d48b
2018-06-07 12:00:03	sxAV7n8	f9d37ce6630af320eca1259aeee36e4c
2018-06-07 14:00:12	MTOVZKkk.exe	d02f16ba642be6ced0ad240f1561896b
2018-06-07 14:15:18	explorer.exe	6fcf4e4f1e3af00d9251737f4ba2f42b
2018-06-07 17:36:02	PO.exe	43bf9ca3e0496c7b8a81ab34397903ec
2018-06-08 07:54:08	maxi.exe	f34a6b7e9579668da5d88905c8a04885
2018-06-08 08:39:03	hujy.exe	cae69057d765afab2b71bff962a6a773
2018-06-10 18:06:04	xx.exe	2a45671d01b0b0fa7751206ebd7a389e
2018-06-10 19:03:05	Party.exe	7c0b2ca14fcd7bb30ccec20f9a129931
2018-06-10 19:09:02	laform.exe	db948cc4a2a4d8bebd6d02c7312e065f
2018-06-10 19:24:08	jer.exe	7d1625c266562128511ede3c604a5389
2018-06-10 19:27:08	off3.exe	3e91ec78b3c9a509d2a29f22b22bcd61
2018-06-10 19:33:03	ALVINRIC.exe	470636811361e57b48d72095905cc829
2018-06-11 06:48:04	chr.exe	5f13708819f6e0ab2dee5d638b4d7789
2018-06-11 07:45:08	windows.exe	5c81e05a54c2fb0f041983a1c3d88e5e
2018-06-11 10:30:03	gracee.exe	dee9794d0ce57780b50a037a2a6eac58
2018-06-11 13:45:03	respect.exe	113a478f48dd3ba295ce092cae7eab6e
2018-06-11 14:00:03	bnv.exe	25b5bf2aa613befa0b7eaf916c151b1b
2018-06-11 15:00:20	images0093.exe	0ae6cbb4038cf76d21b1f70cb4c7bd57
2018-06-11 15:03:21	Reorder.exe	b4ef9d1b88b498368f1bd8bb363ab1e0
2018-06-11 15:06:20	orderRFQ.exe	05e04e4899717bb957f10afe36d60de3
2018-06-11 15:09:19	RFQ6.exe	7a1290ede18dfb2d8167f4f6e2375d63
2018-06-11 15:18:20	RFQ06.exe	a62d3693db8085e2fe0ff93e5469881a
2018-06-11 15:21:34	RFQ.exe	484b1732cd33e2ffe35fae446b41bb20
2018-06-11 18:36:05	nazxnan.exe	2746e11bd63f23470250d42fe2a53776
2018-06-11 20:48:03	PO44555.exe	df6493f3ffe8ed4dde66a00f83306e6f
2018-06-11 21:03:02	NCAqBGa	37b7b0ac8109777d7dc2f51bc9d0fbcc
2018-06-11 21:21:02	Bumvum.exe	9e4187cb9af585ee1486a7036ac24309
2018-06-11 21:24:05	dngab.exe	49d00de33e1560bf9c0c07afbd50fb34
2018-06-11 21:27:07	33p.exe	a4c6d16b0d2bea65777200e08870778b
2018-06-11 22:27:04	ULTIX.exe	3bcaae5bd356235b33e8176f743da6e6
2018-06-13 11:33:04	Scan_094002.exe	ac21318d740ad83e21191c1040d04076
2018-06-13 11:36:03	connect.exe	7f1958bb2a7870c338f0369e2723a396
2018-06-13 11:42:04	coala_crypted.exe	7ef7d07bb5cebed1e14cea4e59673d8a
2018-06-13 12:03:02	9AUgzGq	4e97c9fee30f00cc0d9c03053a6f1e4f
2018-06-13 12:27:02	pWbKdxH	b439e292ec822a96c9e180b3327e5992
2018-06-13 12:30:02	gE2ct1X	8c5816b08a826181c5b21aaeca799617
2018-06-13 12:51:07	Purchase%20Order.exe	f8a5ce33d14725da0ab0839366924250
2018-06-13 12:57:02	yBiKxfh	ac7cfc5070d1c40fa65498cb9909f61b
2018-06-13 13:09:04	Signed%20PI.exe	deab6d15bae0a844dbce0e7fc97d64a6
2018-06-13 13:36:04	bomb.exe	fb5a9f8780282b3b61bcfc2fd475d0b9
2018-06-13 13:39:03	COSTEC.exe	21a1161ad07f751a2a7ce23b0851bbf7
2018-06-14 04:36:02	0ujzLjC	8f90a697cc08b15c8766152d6721c3a2
2018-06-14 04:39:03	BcHACzo	1ed95c14be03fa2f34a00e37bf7c7a9a
2018-06-14 04:45:03	yUpPfnH	548ffe7d6dd2380217513e96d0d03e22
2018-06-15 01:18:06	hvnc.exe	d7d2989b4d1af6f8e45af3de5e4f793b
2018-06-15 01:48:08	winsock.exe	9b6cf2c0aaf1a8286305bdb7afea8efd
2018-06-15 01:57:03	0vfsn7d	4025a88ffbd6378b35f83707cbedfeb3
2018-06-15 02:15:02	KyXkAwO	9ac2037a17063eea104f6a0f11238776
2018-06-15 02:18:03	nXCRe1a	16bcf29866dfef6239ee8749a0bdebaa
2018-06-15 02:21:09	bar.exe	66cc10592941fe1bf2aa61496481bfd6
2018-06-15 02:33:05	data.exe	85e9b4cc6f3461065ce1612836251947
2018-06-15 04:39:02	frnk.exe	5823f9bb838da1c546edc672cf84c765
2018-06-15 04:48:02	albert.exe	a0c01d477c7ee9c185a711d4d42781c2
2018-06-15 19:36:02	2.exe	17dfd69fb52d321a2d9a9e171127fac8
2018-06-15 19:45:05	wx.exe	18eafb58f550a3fd222f2eb7073c9618
2018-06-20 11:52:07	testt.exe	f861c62222d82105836eb8c08d8f6690
2018-06-20 18:06:03	phynollllll.exe	98de304c109d58a1209fde216ad5a573
2018-06-21 01:36:07	obivna.exe	055503a2ce2e4d809d6d2250808b9f17
2018-06-21 01:39:06	buyo.exe	47726559ec4187519c1a021fa3516cdd
2018-06-21 01:42:03	avuvi.exe	ce5b11513e17efe114b0a730e32d570a
2018-06-21 01:45:02	dawfg.exe	a8de798a93b2797c0cf8c5050fb31117
2018-06-21 01:48:03	mxannan.exe	6a021233bac6200bc450ca19a0419e3e
2018-06-21 01:51:03	mzoobii.exe	f83465326ac70c4999072b6089783abf
2018-06-21 01:54:02	diecon.exe	2dfb7490cf756d3c2a431b38401dfc74
2018-06-21 02:03:07	kulis.exe	a9261f07af65703721fc90874c208988
2018-06-21 22:51:05	qury.exe	0dbf58d174e22519f799125bfebac6f4
2018-06-22 00:09:04	1.doc	63f0ec471ed34fc0cf0211553a6e7a21
2018-06-22 00:42:05	8.exe	3355a9bcb3457ee4b8f54f8df7bcf456
2018-06-22 00:45:04	10.exe	c4e6be066579822408f3fb1dec8bea94
2018-06-22 00:48:02	11.exe	3073fdd8a27bbbb93e7437b16eee74f0
2018-06-22 00:51:05	12.exe	af00b03d50e7cb126ca64db9ec4286c5
2018-06-22 10:24:04	data.exe	f70e5719404e90e2a5dfe9ebf73c6753
2018-06-22 10:30:02	filyxHU	93ebd1e10a344031f91d821ac836bebf
2018-06-22 10:36:02	efu0lMa	a6deecc0bdb7e226ab94e10203d0d594
2018-06-23 03:48:05	TRIALPLUS3.exe	002fa1d7b3dcf548bc71f03cb9be6396
2018-06-23 04:30:03	Purchase%20Order.exe	fb46a8f834f4b217617ca8beb08fc82f
2018-06-23 04:39:04	scan4.0.exe	a0c1a54b9c7899dcf67fb504ab207a03
2018-06-23 04:42:02	scan2.0.exe	bfa0f9fd7b658283757515e02d0c08dc
2018-06-24 10:12:05	bir.exe	e0cfa8adb65b9e17872b26ccfb5648fe
2018-06-24 12:48:09	cor.exe	6a71e89c041a18a3857bc328c59c881b
2018-06-24 12:51:03	phynonation.exe	5e1eb5de3bf3daba5b4a8530432e235b
2018-06-24 12:54:02	aksu.exe	a2dd8f318a3e3b1cccdd91880e835c4a
2018-06-25 08:48:11	SERVER1.exe	a11eab85e85936ac7fd6dfb004580099
2018-06-25 09:33:02	7.exe	5e0d6f47f34443ee4a08f0458dbb58dc
2018-06-25 10:39:03	osy2.exe	76f4c10fb435bc07071a2fc29aefdc76
2018-06-25 10:45:04	osy1.exe	548ac732820e029e81b3701f53d40db2
2018-06-25 17:06:02	TBYc9iY	fa783913147494c625e7e07717e05ec0
2018-06-25 21:42:09	Our%20Order.exe	e35f3c5db0be3a9a274d5e4dae817dd7
2018-06-26 02:06:07	okmnjb.exe	b92efe55bffed03322d76f90a5bd73c6
2018-06-26 14:57:03	adobe.123	ea5e27842b61286954a532f438844d2a
2018-06-26 17:51:09	admin.exe	f5081dc1115e74ceee116f089cfe8b96
2018-06-26 17:54:03	Quotation.exe	a1fc84f24f715d88c388810f52672783
2018-06-28 01:57:09	ers.exe	753b6e87f955dad98e36ce9a4dd3b6c7
2018-06-28 02:18:02	system.123	beeffcab3e77e7b5f31c820858ead698
2018-06-28 04:27:01	qAzyshN	c709725aada3a8083acb5cf6e6f485b1
2018-06-28 11:06:05	kok.exe	8eb8b220a1648a081e32c6f3dadb55d1
2018-06-29 17:30:04	New%20Order.exe	a0925ed753f258a6ad941dac2362846e
2018-06-29 17:51:06	hg.exe	7ec76f62130e62ace68487f4db27c7f7
2018-06-29 17:54:08	ghh.exe	584a1d7127ad0f2c57a7bea1e527997d
2018-06-29 17:57:07	likethat.exe	e536c865da3936cc300ac7f0eb273e3d
2018-06-29 19:45:07	PL.exe	eb56b0a3cc374cb2c626263c3823ce29
2018-06-29 20:21:01	ytus2.exe	9585f20330f8e98ba595881635d9059a
2018-06-29 20:24:02	config_new.txt	910fe0bfd1167b15e179de08db752745
2018-06-30 17:00:03	Order.exe	95fb4a270199cee40a137e6d35067a84
2018-06-30 19:54:12	msi.exe	7138b5845bcd73a544c9e6cb484f85d8
2018-06-30 20:06:03	DREMCOUT1.exe	b7a4a1c213e71579782149e2ba6cf279
2018-06-30 20:12:04	DDHATX.exe	df41ae6501a2613bb13cad7fd29666e2
2018-06-30 20:15:03	NSE.exe	0984b4d1d591f1c391ebed9fb0a32975
2018-06-30 21:30:03	ziz.exe	11bfa52250b6fc56070fbac8eb0391fc
2018-06-30 22:45:03	SWIFT_COPY.exe	9669c3f38b343b6fccf0ac973f95df28
2018-06-30 23:21:03	fridaygood.exe	21c3be034f353b0984c66e033ed3145d
2018-07-04 07:27:03	mondayteamview.exe	1ed9f4a7ca1b0e8312ed99901a2f122d
2018-07-04 07:57:02	ff.exe	7779ac627913c32b4f650caf3dc9681d
2018-07-04 08:06:08	sundaymove.exe	a02dd67fc4e14de652bd6d039e03f45f
2018-07-04 08:12:03	server%20me.exe	92ff0a0f0c60c0f6a3ef16f3c585b35e
2018-07-04 08:24:02	tTdFXjm	9f4fe5afa475a85dd23f9fae3ee46f2b
2018-07-04 11:51:09	stub.exe	6c73fa61d98f5063f60cc712fc4ebe69
2018-07-05 21:48:07	photo.exe	7ad1a877bb8c48a2016ac7e52b28f64f
2018-07-05 21:51:03	vt3.exe	1822b6e91483badcbf31aa869462fe51
2018-07-05 22:09:08	winapihost.exe	7c0176ede8e8920b559eb7c7a7cd72d5
2018-07-06 00:36:08	1000366164.exe	c91079b0a1e4c1156652213c30cc5526
2018-07-06 07:39:06	mt20200012.exe	096968ff322e774212e2ccf8a131c5c0
2018-07-07 13:06:07	ifxe.exe	bc0b5a982af034d2b6d5992e0af86a71
2018-07-08 06:36:06	dp10.exe	b9c0550a6ad6f4ed7a19170d3ff1ca4f
2018-07-08 17:39:02	STjqja.jpg	3e05bbc0b0f5d2046c5922c4ffad207e
2018-07-08 17:42:02	r8OSpd.jpg	8dac3bd23e46d8a73acc093e17678e2d
2018-07-08 18:15:02	A27edw.jpg	35093a22d7ba4effde002c3d1345eacc
2018-07-08 23:42:05	wed.exe	eeb701069cc2b32aec5f5949bbb67d94
2018-07-09 22:51:06	okllll.exe	03c11d9060022c8e76d8642f5b7bab4b
2018-07-09 22:54:04	KYC-INQUIRY847.exe	25f290634a8092cc13820b1ade6ec33c
2018-07-09 22:57:05	KYC-INQUIRY0718.exe	09e836d94778ef15f0bebabd9814ed79
2018-07-09 23:00:04	99388.exe	ff3e1869d673c28b87e42c776e7a0f04
2018-07-09 23:03:04	432.exe	13213a79eb7a7d4c931bc81c9fa63038
2018-07-09 23:06:03	889.exe	7ed19b911fcbc4dd2015ac995fd2e42c
2018-07-09 23:09:03	i1.exe	8ec65b785938717294c75c2b6a15a0ce
2018-07-09 23:12:07	r789.exe	e8fcccc14df4c8fbde4223b16fdb4e63
2018-07-09 23:15:03	1.exe	07d887ce0ba2736fa8fbc5139ad74c3d
2018-07-09 23:18:05	345661.exe	6d6e6d27380ce69f043be7dc379fbf15
2018-07-09 23:21:05	6.exe	e1719ee53cad171914f93ac0fe8b4fa2
2018-07-10 00:18:02	LqvgHe.jpg	c3fd40e0bf88dc1bf3d836ba41a00f5f
2018-07-10 00:21:02	jyeUi.jpg	e71e0e614e8a5e655412653cc7d03682
2018-07-10 00:24:02	3qDdK8.jpg	58c30ad3552baddf8f9a7f77585cf02b
2018-07-10 01:36:02	Q7ghr.jpg	c45cb642024ff9eabf889790206de3d9
2018-07-10 01:48:02	2azeeb.jpg	07de727152550ad410fa5e8649d53bf8
2018-07-10 02:12:04	10.exe	eb38e581ba2c7d46a2373dc9abc02b3b
2018-07-10 11:36:04	fred.exe	77031e1f87a144b9138dc68d65dac9f7
2018-07-11 10:36:04	Yemen(PO).exe	f98efacc3263adaf66fcc53a185af32c
2018-07-11 10:42:18	nbbes.exe	9cb67f38e71aceb945acecde8a12555e
2018-07-11 12:21:03	f2.exe	f2270110781aacd010fcbd439524948d
2018-07-11 12:24:02	1.exe	c4ef8a360a3bf1f3b4867eb6f3f220d6
2018-07-12 11:51:06	windows.exe	742b756f815fffd67c1d0a12978c6daa
2018-07-12 12:33:03	akp.exe	16c1238a0b0a66ba81ce61eeb5747570
2018-07-12 22:39:05	nj.exe	9c87029c2177a35019d127fd26908c60
2018-07-12 22:54:03	ippg.exe	e59be25c4ea5619befe455f48a48042f
2018-07-13 08:54:06	kio.exe	28b416577001c65686ab14b46fbd28be
2018-07-14 18:30:07	vib.exe	c7cd32fac2d8632a098aadf06c20e94c
2018-07-14 18:33:05	uc009.exe	11dc2852e8798fe2fdbaae2efaa6fd81
2018-07-15 01:15:03	we.exe	6095fe3d4f1acd221bf54a429ca3a94f
2018-07-15 09:30:05	frbelg.exe	8c374a4e0e546f8aeea87cb75d900bc3
2018-07-16 05:18:04	hdaudio.exe	4ada547b549098c32112e932cd3e9197
2018-07-16 13:15:05	PAYMENT.exe	91dafaca05e34adcd25ec3f42d64a0f9
2018-07-16 20:42:02	joe.exe	1edb3b4d1bea11dede192b3972dd94c8
2018-07-16 20:51:02	francis.exe	9ddea84ff363e29818899bca5c963057
2018-07-16 21:03:03	bobb.exe	2065b66c075ded933e69607e7b07e20c
2018-07-17 01:42:03	dp.exe	e8d034a10d9f1328d70e0e6ff86af115
2018-07-17 01:45:08	best.exe	d7078f34bfa30ec5781ffb8f4508365e
2018-07-17 06:36:04	file.exe	4bc606753d24e3474e2ce433b14dc14a
2018-07-17 14:39:04	im6.exe	10349a36cbd8aa3a5f13b3a591432218
2018-07-17 14:42:03	nj.exe	7b777263642cd694415accdb45b19de6
2018-07-17 14:45:03	WM.exe	742fa4d87468c0627133ec45629c692d
2018-07-18 21:33:08	WM.exe	5acab836a897e8d8a626b9fa50f3ffe1
2018-07-19 13:30:04	rrioou.exe	a4c9dfe13bbc1e2f99e1fc4db0066c2d
2018-07-20 21:00:02	work.exe	299c2ece106b74ea9b579a9789b55393
2018-07-20 21:03:02	akp.exe	a6233c4796a7e3e0b84c5032133cadb1
2018-07-20 21:06:05	Receipt.exe	b0a3dba6ceb97918afbaa425944ec9bf
2018-07-21 22:54:04	cofan.exe	4efa303240a37341c17a209eb9ea62b7
2018-07-22 02:30:02	inv.exe	fb9462ffcb63a21dec44addba1766cb3
2018-07-22 08:39:07	Purchaseorder.exe	30ddb91da7ca469fc1fb2be3a1187b6e
2018-07-22 08:42:04	DDR.exe	65ea4df74a0f5d9374603c75dbba6df8
2018-07-22 09:00:04	mondaybenice.exe	6ce1792f0211d28331176bd750ec8100
2018-07-22 17:18:05	hicksaw.exe	4d7088d97fa250bf827c6d11b985a690
2018-07-22 23:21:03	rr.exe	bc1e927911906936207467d6bee56e60
2018-07-24 05:24:05	albert.exe	98aafa8a5db4f6e4a6c4bb0b63b9ed61
2018-07-24 16:24:05	axineeh.exe	90478fa4eb4e4c9a47a35793a02972fc
2018-07-24 16:29:37	Quotation Sheet_#RFQ180724,doc.exe	30837905381a7fd152baed405f2737a7
2018-07-24 19:57:03	1.doc	527b56c74b5106ee36e6e4ec098ffa53
2018-07-24 20:03:04	5.doc	d9f0fabb132ace5a7cc56349afa98ccf
2018-07-25 15:39:03	im.exe	e59304e841f10964072c98d9706e1feb
2018-07-25 19:48:03	grace.exe	8dcb784dbe51732b41e581885372c162
2018-07-25 23:33:02	obi.exe	5f9e7a8b3b1b7d6ed5613a27ed2122e3
2018-07-26 01:06:12	nze.exe	e579a44ef0de41a0a59f6991e7b4f03c
2018-07-26 01:18:02	jiz.exe	ede34aa53d2b6656086dfeaa910e2831
2018-07-26 09:48:03	svchost.exe	770a65c92c3b0d56614c3acb4de26e52
2018-07-26 11:42:07	Server.exe	2fb5d4f274be4e909ccc45b2c26a5be2
2018-07-28 14:00:03	elber.exe	80226fecdddc58b655625a6703b3a221
2018-07-30 12:13:48	Quotation Sheet-Products,xls.exe	dfb8998ef0e49c09947af249600bc3a0
2018-07-30 12:14:01	Quotation Sheet-RFQ180730,doc.exe	a11d66acadcf6a9647921f90a3b22991
2018-08-01 15:54:04	Purchase.exe	fb02f38856dc8ce1b5fc690d1a7a80b8
2018-08-01 19:54:09	yugoq.exe	af63402fcbfd031be518e99ef0ed6a35
2018-08-01 19:57:08	urchq.exe	169c0aaa7e5c288f77e932e93abd60c7
2018-08-01 20:00:07	tozma.exe	039c683cc8325277d4fe42208c1695a8
2018-08-01 20:03:10	johnq.exe	7fc4bf0a055b120273fd8514824aec5f
2018-08-01 20:06:11	flowq.exe	74e437dbc74defb8aade142fb54f7d16
2018-08-01 20:12:09	chuks.exe	afbc621540758fe11333b3cd28b2d2f9
2018-08-01 20:15:03	qt12W9y	6d4b54f36b53fd03595e9213bc45c5b9
2018-08-02 10:15:08	officeqq.exe	951b41a9f6cf1d84e9ffd88c847800aa
2018-08-04 17:48:03	call.exe	3ffeab8e40d7d503a2d4491399d7da2c
2018-08-05 11:36:06	FXSCOVER.exe	0fce96a8f1d3dd15eebded4dd9a2a987
2018-08-05 17:24:03	davidq.exe	454cebd45aca96508df5d0618243cbc6
2018-08-05 17:27:09	johnqq.exe	1554f3b630ce6269efd6ad229a10954c
2018-08-05 17:33:05	tozmaq.exe	2bfa82159ce239bdb414dfadfd45c3f0
2018-08-05 17:48:08	LOL123.exe	67eafe2e34c1923d04f87223161b32f1
2018-08-06 22:21:08	flowqqqqqqq.exe	23c96fd9f736110711cdc71537dc0c61
2018-08-06 22:24:09	ucheqqqqqqq.exe	4f1d7dc1462d0ad70854b0aaef5cb53d
2018-08-06 23:36:03	boss.exe	43a77b02a86b8c16fd88629ef8c5326b
2018-08-07 09:36:03	McAfee.exe	5670c594e1b9f63e5703e7a0ca2541c9
2018-08-07 10:00:03	5b57984c.exe	06f06b4405fe3c647b5b6c34b4cdad63
2018-08-07 15:18:05	q21.exe	7afb8c62540c9e7d113b6612470d3060
2018-08-08 19:09:04	qsr.exe	769c280c5eff2d1598c5de438b567d8a
2018-08-08 19:12:03	vbc.exe	9bcc457ffd5258761ce4e1feb7356581
2018-08-08 23:33:04	buzu.exe	936ca90be44c8394b99c4714bc45b409
2018-08-09 00:15:04	DeviceEject.exe	9b6ca52e22e3063e1fb2608b6c1c9a2c
2018-08-09 21:18:08	ucheqqqqqqq.exe	dfddfaed7d6af22391a63439367609ae
2018-08-12 01:27:23	STUB.exe	83ab320e4a3fd49aa42c0f4838a8cac2
2018-08-13 06:03:03	WindowsApp17.exe	a41f14d03069fe11be0476371142f798
2018-08-13 06:06:06	Apkwins465.exe	f020ac2bb24700cd2774bb191132c633
2018-08-13 11:00:03	Windows_Updater.exe	9123d3fc088c490298d2550c0ce10af5
2018-08-13 11:06:04	csvq.exe	84c466791696e8ea8d4b0196ccfec30f
2018-08-18 04:30:05	fuckedup.exe	f577f68077e1d586be5ad97c5a1ca24c
2018-08-24 18:33:09	uiijjy.exe	fda0881a94ce1f45f6171065ecd28294
2018-08-25 00:45:03	chfrnd.exe	c86dde14c73a61b2a6acfa0df7d4c36e
2018-08-30 05:06:03	5b60a155.exe	08d961d34c2c2e04264bc68bc92ea8ca
2018-08-30 13:09:09	mix.exe	d0cfa2b3ac3b6a82bb4bf1cb1f68aa33
2018-08-31 05:36:04	documents.exe	3df3dbadd76ff60df853b632d164a7b6
2018-09-06 17:42:03	1OneDrive.exe	72a02c386046a85ca142d95d0bc0c9c2
2018-09-09 19:24:04	TRIP2323232.exe	09dc8e282c7ef169d4b97f389df5bc0e
2018-09-09 19:27:04	SYM10001.exe	b599d7b91385fce1c4c7affe485e4f55
2018-09-09 19:30:04	RU55534544444434.exe	f79d45b9f8c03f01e7f80fdbd3dfa7d1
2018-09-09 19:33:05	RFQ.exe	6cf44c7cbb4a86e2e0bcbfa6b5bfbb3b
2018-09-09 19:36:06	GREEN.exe	1834ecf107b4610f6fef59deff0a35e7
2018-09-09 19:39:06	Boss11111222222.exe	e3c1735c35570ef225ea2d8a2a2e9efe
2018-09-09 19:42:14	212121212112.exe	d32d7c0691f49015d29ea0fa8b326a67
2018-09-09 19:45:04	98765123.exe	28d80dc1da233e4298fc7ac90222e41a
2018-09-09 19:48:04	5552222.exe	fb650cab98a73f383c48e952c5dd09b2
2018-09-09 19:51:05	RE938373311.exe	275ffee40ff08f8e0d73d44e2314c3df
2018-09-12 13:39:03	alba.exe	2d211950bd8f591aeea82fd3462de34a
2018-09-12 20:48:03	AudioDriver.exe	f53f6f5c8f1f594d528897e6c9fcb37c
2018-09-12 21:12:08	gpg.exe	e34b79f2356cfac117ad96c5602dd2bc
2018-09-15 02:33:06	nownoneed.exe	28f43c4cb4f6abe06c4788a129860d45
2018-09-15 02:36:04	nmolinew.exe	cbddb94d66a9ba11e6cb51e787af1f0f
2018-09-17 22:12:08	setup.exe	264c95b31c856b33608521da713304b9
2018-09-17 22:24:04	PurchaseOrder.exe	87df56561f7926ae3419dc90521e37d4
2018-09-22 11:00:04	mrd.exe	9ae7b6bee225569d83d02ebfcd2116b4
2018-09-22 11:03:02	5b77101b.exe	9541498837fc5be84e7cc96f572450bd
2018-10-04 12:09:04	PO00099.exe	11d5a77f4eaa3fcf203fe88821f53191
2018-10-05 05:30:02	PO20188.jpg	38ea528ddcc8e339c29c7ec31862cf8f
2018-10-06 15:09:06	putty.exe	3817393c212c2d1f2c471472f5cbd34e
2018-10-09 08:15:05	kreport2.exe	244c8651131d55b4637060d287aa7771
2018-10-10 16:09:03	lyd.exe	03323a3f752a1f1287de1ac9efa2e91d
2018-10-10 16:12:03	lm.exe	c71d20c012f7b4350c4a934afcd130f2
2018-10-11 12:06:06	johnqq.jpg	331067058c60a0f4e1c320337a04dbb8
2018-10-11 12:09:04	davidq.jpg	f87e1a7c0e1f10b691182d72cb6bc139
2018-10-11 12:15:04	tozmaq.jpg	4fbb9d4d2fad1db80e47b7d1376a2a9a
2018-10-11 12:30:04	0.exe	8ab102447c9c9f9e6f0a2870f108705a
2018-10-11 12:39:03	DANAAT.exe	43afc961700abb497f37efb467465f66
2018-10-11 12:48:04	yugoqq.exe	7f1348548e97e3c9d6cd6d879677e2a4
2018-10-11 20:24:03	mrd.exe	42bed89d7853a7c5c7343d4799b8215b
2018-10-12 08:50:24	p5.exe	1d6dafaa7edae47cd986c02b41b015a9
2018-10-12 08:57:55	okk.exe	7475c47d3f5b16347cedddb0857ff926
2018-10-16 18:09:18	eherr.exe	ec1150c2f29f9da28b0cbbe064be28ad
2018-10-16 20:42:03	p4KTU9.jpg	3beb1fd8946ef3d9378bf3d42476a631
2018-10-16 21:00:04	nonso.exe	3603d7391d971d5ae37ee33b944d1a49
2018-10-16 21:06:03	eZEaXa.jpg	cbbd19f52a031ad8fa8f423f532bbf6e
2018-10-16 21:09:03	QbRoh.jpg	d7af84e668f8c20f082b9c868d7ade57
2018-10-16 21:12:03	D7k1s1.jpg	92968e73f0eaf8aa1bcba5af34ea73d6
2018-10-16 22:00:04	rick.exe	81a36e65a4125c7563762571ddb7fe4c
2018-10-16 22:06:05	noh.exe	9e81c23eef28a75c414b66dda2de9e87
2018-10-16 22:24:07	dasa.exe	b2a115ad0acfa5a5bdda60ceac56f5ed
2018-10-16 23:51:08	33663446.exe	5552cb537c9b7272e9dbe79ed3489ca2
2018-10-16 23:54:22	1119.exe	e3ee18d6633100345ea28fa258a1a724
2018-10-16 23:57:09	466566.exe	34f98861b13f108902d98cf50db17d6a
2018-10-17 00:00:07	6650.exe	22e7e1540b731eb9df59e41871360510
2018-10-17 00:03:09	879.exe	4f17b3a5af9cc81ac8ad5024891e4793
2018-10-17 00:06:08	111111111.exe	b6d27d9de9c98e06a834b4a5e3fdc8a3
2018-10-17 00:09:09	4932.exe	05273284c474ac31172918f7bb9cdb1b
2018-10-17 00:12:08	95002.exe	e658977fa659ffb4c73070edfe5c6d81
2018-10-17 00:15:07	54550.exe	ee552d335864da6e5f15a628ab0832ef
2018-10-17 02:09:04	2.jpg	15eb73b2fcf5bf9fa09b636a6b7718c2
2018-10-17 07:15:04	z0dm5a.jpg	898446324be148af2b7f41028ed4477a
2018-10-17 08:42:04	vfgrox.jpg	df52240013cecc641b97b14ab8d4233d
2018-10-17 11:03:03	Dvg8Sy.png	86af569475dea22d160dbde5a48dd12e
2018-10-17 12:54:04	crypted.exe	1b2eee357a40a967fcbd8c18a2a29eb8
2018-10-17 12:57:03	putme.exe	24eca305562ce8bd4f36ac89298175d6
2018-10-17 18:33:04	BhhMEx.png	de4e8b172c5ff8f1c2a1a5241bfbc2fe
2018-10-17 19:12:07	ccccc.exe	43c1fa37a457ffd874f0a9436454ebe0
2018-10-17 19:15:03	R9mYYH.jpg	5b4b715c551523a3acb4d7a5fae1ee51
2018-10-17 19:51:07	246.exe	f24adbf2223c7c77621578e3aa68cc6f
2018-10-18 01:27:05	cli.exe	962e4c6e19e169a9a54f7ec84cac1f69
2018-10-18 07:45:03	mFzYpE.jpg	e383fa1a3c33f026431a49ed612a5fa1
2018-10-18 11:54:07	PurchaseOrder.exe	c0822e1638895b32109157fb3b4d659c
2018-10-18 17:36:06	npd.exe	6cdfd7cf3a91280e7c7dbb72b4132e4a
2018-10-18 17:42:10	XXL.jpg	b7bfbe5327957e4d9d3d6d8b224eab37
2018-10-18 20:15:04	hjy.exe	44e5e8b3ea5ecc5930212ac64f1e9aeb
2018-10-19 14:42:08	HTTP%20Builder.exe	c78c01323ec873831d7096545f91fa81
2018-10-19 14:45:04	test.exe	63d091b95bb25f7b420fbe12a7d7c20a
2018-10-19 15:12:04	11.exe	83cb899b4b3574322711037b658759ea
2018-10-19 15:30:11	crypted44.exe	b6378496a96429130a79be27cea99170
2018-10-19 18:36:06	crypt.exe	561bacfd0faf8f5ac4ab771d19f78064
2018-10-19 19:00:04	Crackme.exe	bcf752ee4288d6dc8b825d1bbfb92798
2018-10-19 20:18:08	cj1.exe	a711e426784ac1f8a19f59cffb4eaac3
2018-10-19 21:24:15	cb_signed.exe	4b67a5c9f3cbc26fa1ba8c4a6c2b0887
2018-10-19 22:24:08	svchost.exe	8d9db899260fa0a42eaf69ff35072a31
2018-10-19 22:27:07	im2.exe	4e596ca4358fdc962b8fa523321738b7
2018-10-20 01:51:04	order.exe	9df6bdb6654f7784146d40f7ec89bb07
2018-10-20 01:57:04	CEDAR.exe	b184318d030a8703bd85e72462e545dd
2018-10-20 04:48:04	mzie.exe	e3e29a9714ef3036987540fe5b7f5150
2018-10-20 04:54:04	PPO.exe	f9d8536cb0eb2a37776417aa7dff73a8
2018-10-20 06:21:04	00084675.exe	b9174a0a24a4871c6f04558a227738a0
2018-10-20 06:45:04	spacex.exe	d157e5dbfbf0825524463a43630ab182
2018-10-20 07:12:08	mine001.exe	3e4ff5d64f05cd6a72a6f2981695945e
2018-10-22 20:12:03	DZzwtn.png	8e0064eac5bfe2887fd3c3f00efdaa8c
2018-10-22 23:30:04	iljjj.exe	05015e172ed75fe4b0ead128008afbdf
2018-10-23 07:33:04	abs.exe	efa9f2e305d3ef894e2a3dee90b4375b
2018-10-23 07:39:15	ul.exe	223a3c56d700cb7491b9ebda4316cbc4
2018-10-23 14:21:03	M8VxM3.png	fdf7f1a7d03ccd7525811b6236fc676c
2018-10-23 14:45:08	mine001.exe	1760423fc915f109c02a23a06a3d66e9
2018-10-23 19:42:04	miq.exe	a89e0d0cea8c140c5cbf33ed2a7afd58
2018-10-23 19:51:04	lav.exe	efcd27163da590db4b4da47b67fad24c
2018-10-23 20:00:04	jiz.exe	10a3de5c146e8d4fc5bce18b8485ccc6
2018-10-23 20:57:04	bob.exe	a28c96f9af9266e40a9990d547cb9194
2018-10-23 21:00:04	bgo.exe	3851d2d3688ebaf443143069af5d8343
2018-10-24 11:12:11	crypt.exe	8e71db7720a2b18ec15a4b890afc4ef0
2018-10-24 11:15:07	cryp9.exe	1178bb45b7ab1d6e3487fc67be3d0505
2018-10-24 11:18:06	122222222222333.exe	0e8bd35ef43d424f440a3164b6be511f
2018-10-24 12:48:04	onebillon.exe	4e029a677a9d1015cd811c1f00405209
2018-10-24 12:51:04	biggerfish.exe	cebf3a1f3090055a3498cd556f6ec15c
2018-10-24 15:00:03	Ot6yql.png	4a4c0dc53ec9bd17fc9524c858f0fa87
2018-10-24 17:06:09	go.exe	31a7c7d51105d7ace6d6d7b62ce39346
2018-10-24 17:18:03	donsimon.exe	f63065c14f5e3ef60f3ee1572139c37b
2018-10-24 17:27:04	po%23788.exe	15a07ce8a83189c7d97a2ccc34feeb6e
2018-10-24 17:39:06	order.exe	596fd871488e04beb4cfe5e3dabf7722
2018-10-24 17:42:04	swift.exe	86d39d2e53d8e0aa349237ba02bd02b0
2018-10-24 17:45:03	Q83ygN.png	f057927392d7c46e7a434c02be801976
2018-10-24 20:24:03	gammadyne.exe	9ec45808e480a25e335047150ef7ae8e
2018-10-25 12:39:04	server1.jpg	9f256fbbb542e4ccbe8262d4fc471a2b
2018-10-25 13:24:09	suggynx.exe	855630c8aa2e701f3b77d1b0fb692e45
2018-10-25 16:42:20	hm.exe	163c9e51a6d520445a517a7c82ebd73e
2018-10-26 01:54:21	vcl.exe	97d25a21a8618e7d22b448810825de41
2018-10-26 04:42:18	llk.exe	ce1d914d1dcba3401d87f7415c399d56
2018-10-26 04:45:18	kh.exe	ec883a2fd21cdf2ce48209dec44ef896
2018-10-26 04:48:19	sh.exe	41c7096caf5ab63519d30cdbb8633696
2018-10-26 04:51:19	shaco.exe	86bf633c6d81a838f6350da169dd6d8a
2018-10-26 08:27:05	owt.exe	cb8f3646b1f9120e39b0df7736813817
2018-10-26 13:18:03	crhomes.exe	2b0d70e62632e7177c6b3949c80f2970
2018-10-26 15:51:05	Compr.jpg	d5a171616082ca55b1ac6f0e9c308854
2018-10-28 19:09:06	svchost.exe	c3f5ff914fe4b41d94efa67f9c82a1d8
2018-10-28 19:36:04	solar.msl	379ceab5791d4374f545c7423fc0294a
2018-10-28 20:09:05	start.exe	6b6ffa40fe36321574dc640080aed79e
2018-10-28 20:21:03	start.msi	75323b68de9eca662d67ae249270e20b
2018-10-28 20:33:03	Server1.exe	b98c459d2b8f77b323ad88b051f45e65
2018-10-28 23:39:05	defender_c_g.exe	12169faaddd418ac543042b09c21df38
2018-10-28 23:45:20	DEFENDER_S.EXE	cb2aeb6588f5e753b758370c09ff9b0e
2018-10-29 01:45:04	2.exe	2d8b0ac7ef872168c56db4dfc915cb97
2018-10-29 03:09:09	ejike.exe	84619f80f9e8a5854d681bb195a24baf
2018-10-29 03:15:11	templefile.exe	776f8dbdf12268fae75e727802d02f88
2018-10-29 03:18:12	WindBot.exe	0d003c5e2db9135c384ccefb782a5cf4
2018-10-29 11:30:04	2.exe	c70376670231e2f593386ba9f1620d22
2018-10-29 13:30:10	ordercopy.exe	6b6faf7b58b30419dcb14c182e940e5b
2018-10-29 13:33:10	listitems.exe	b3d2be3116df4d7977129e5c2365cbfc
2018-10-29 17:27:07	qquiwO88A9nirtJ.exe	843cf9b98774aa08fbedf337a701b330
2018-10-29 17:54:03	TmxeD.png	5bd59bc022761d859e8fa67e113d393d
2018-10-29 18:24:10	todb.exe	bb33cd69264d8df8740c4e01fbc25c39
2018-10-29 19:27:06	test.exe	d1bf8a970610264b4958834bb0129c7f
2018-10-29 19:30:14	stub_signed.exe	1cd1210530284679ca3a330fca7019b4
2018-10-29 19:33:07	stub.exe	8e98c8b1880a48f0c391613db737f6ad
2018-10-29 19:36:11	invoice_signed.exe	abc18be3eee56474346ec3ab80653b2e
2018-10-29 19:48:10	Uncleared_Accounts&OctoberInvoice.exe	1666e0be287e26edbdc2e60a3a2b1df8
2018-10-29 21:24:05	21321.exe	a3e71acf4cb478d9d108d393f65017d8
2018-10-29 22:33:08	al.exe	6cb200d1a72871193e9c18bf25d54673
2018-10-29 22:36:06	last.exe	cde8c7633b599834ba5bb56578899a17
2018-10-29 22:39:05	new.exe	396de11b1400ebdf58f381e0c02d43f6
2018-10-29 22:45:04	caleb.exe	f9f038c22b38e5f636e6f7ac24b5aab6
2018-10-30 13:06:04	uk.exe	5661e75ea414b24045f16e67a3eebafc
2018-10-30 20:39:04	putty.jpg	c0537fd9e1eae23fb5cc659c8b08ed10
2018-10-30 22:27:07	cfgb.scr	10d9300bbb67ca1f82c5f2b027e83f37
2018-10-31 04:42:09	pdf.exe	6207454498608392a40fce6675556dbc
2018-10-31 08:03:03	p_395kzojk1.jpg	281562063dc32d2c9f03a564f585c733
2018-10-31 08:06:02	p_422xlwbo1.png	9afec18da33e125e1fb5285072eb5c57
2018-10-31 08:45:03	Hard.exe	9cde939d6a1a9c26fe0fab7873d80ebb
2018-10-31 20:33:05	clip.exe	719dd34dab5c9b8e2eeb5cba0a8a6d3b
2018-10-31 20:36:05	vcc.exe	8d2eb451a9308a5c02b7139e90eb7d4c
2018-10-31 20:45:09	%e2%80%aegpj..exe	b23ded7e08c1c1996e9942f0a806e5a7
2018-10-31 20:57:03	FnIam4.jpg	b82cd5b9bd0f2ef4cadbc3fda32e43c8
2018-10-31 21:09:04	ari.exe	91be39552ab3023e0af682f6ff046373
2018-10-31 21:27:04	nos.exe	bbd1c948420e73b7aa62037c2e6789a8
2018-10-31 22:00:05	chip.exe	b86c4645877eeaffcd83b13acddd6756
2018-10-31 22:06:03	gudyJi.jpg	ca3e916e0ac6cb1a594a48732fe54954
2018-10-31 22:12:05	nano.exe	bd0abf92444d841ceddea780f34999da
2018-11-01 09:18:10	cr7.exe	bc11c61f38f6675747542128d04d953f
2018-11-01 09:21:11	payment%20slip.exe	104a9ee229a1aa14b619554a7a703461
2018-11-01 09:42:13	SOA.exe	eb27c45cea23e521c18b39921abbcb49
2018-11-01 18:48:03	p_82367ep41.jpg	2df62ac7b559030c6f0d2430ee3d8bd2
2018-11-01 18:51:03	p_102230sjx1.jpg	b44b466c29d4b483b32994df047d4735
2018-11-01 18:54:03	p_920uefkfpx3xc1.jpg	ac6a3f0e43c4419610e7e02322646e0f
2018-11-02 00:12:08	kings.exe	dc6d59d5da35e1d424163969374a0387
2018-11-02 00:15:05	nwama.exe	4a657deff9cbc7cbab8d8f53fef6df25
2018-11-02 00:18:06	sima.exe	815a226c78e7f8c3cac95c2152bc4665
2018-11-02 00:48:08	vbc.exe	579f26ced19a2f6959215d69a5d91e1b
2018-11-02 01:30:05	tm.exe	3f77cf2bf59a28ae69b8bc87fb3fc4d1
2018-11-02 01:36:06	jpg2.exe	15612126b4dea86af4cc2dc8fb551090
2018-11-02 05:45:05	Doc007892.exe	5ca4c5f7882fc294a2a194b6d2cf9b7f
2018-11-02 05:48:05	SPI8142018A.exe	5276419580f63b496639a901fdfe8172
2018-11-02 09:06:07	Doc20189700.exe	7bce7d55931c5f34701501a38aa95cd3
2018-11-02 11:15:04	arinze.exe	42879e5b5ca042068b0025c7b4698f77
2018-11-02 11:27:05	zaglema.exe	e6add0f4eca27597591c5ff3290f6717
2018-11-02 11:42:11	tmp.exe	09ef9306539a1cd532d9985f3a2856a6
2018-11-02 12:24:06	ee.png	121294d658ca17555251a4e33cdf2123
2018-11-02 13:21:04	petercody.exe	b4dd18d49796a3005dbcd696ce82459b
2018-11-02 13:51:04	dramab.exe	643370808d5a76f4e803d02e59abd0db
2018-11-02 13:54:04	jay.exe	b3ecb25902d0a254d29aa0e918e8fdc7
2018-11-02 13:57:04	frankjoe.exe	833b14edc04e1691d4be77bd5abd8985
2018-11-02 14:03:04	jeff.exe	e2865271a70abf7116dd9325f7529d0b
2018-11-02 15:33:04	ejike.exe	67b632763c35e3920e8c9af673b9b4fd
2018-11-02 16:15:05	Spider%20Hack%20Tools%20Plus.exe	a1619317fbfd48b128326fd38c9e1e40
2018-11-02 17:39:05	Quotation.exe	3fdd93452d5d98db82edd1a9a46b6f01
2018-11-02 17:42:04	Quo9050186.exe	929cd8a3ff7bc7f85fa25d2c5c3c9379
2018-11-02 17:45:04	pf.exe	1de45bde439a3904517353cb08e197b9
2018-11-02 17:48:10	c.jpg	53774d4cbd044b26ed09909c7f4d32b3
2018-11-02 22:57:07	arigato.exe	a9f4c138818f170a4bfc036bf169a8bf
2018-11-02 23:03:10	Client.all.exe	e97da2af0fe30743740ced1fc213488f
2018-11-02 23:39:09	sss.png	07585e87cb70bf1b30e5723a6be47f13
2018-11-03 00:57:02	Pf40Vm.jpg	289aa0cc2e2a0a3be567ce6e8883da2e
2018-11-03 20:54:13	PO-ZDX78600_pdf.exe	20b87fbb983b33db50c082d426fb0879
2018-11-04 04:00:05	kelvin.exe	f367238aba3346d0d760675ec0af90f9
2018-11-04 05:54:04	po1.png	a6714144a0fd12eba05d2e292e413574
2018-11-04 12:15:05	SOA.exe	8c800ffad75d8a06314715452ea997d2
2018-11-04 13:48:04	flow.exe	5d6ad1f5b286dc235fc0391311ea0631
2018-11-04 13:51:04	Purchase%20Order.exe	07086eafd9df9870e02d2aea71cc2fd7
2018-11-04 15:33:05	PO.exe	33912647349293e530fd8979d076b36b
2018-11-04 16:48:03	p_1021nyrf11.jpg	d77d3262c4b7b9eb9e1a826715bbdba8
2018-11-05 03:30:33	cjhgjh.png	66dccc73f4c826267f33cb4beac2b3f7
2018-11-05 07:45:05	avhmcy.exe	2a725ab4e1e5d1449ea94f12292ec86e
2018-11-05 07:51:05	yygruz.exe	c71b17cf45d7fb2f2977170ae7010cda
2018-11-05 14:03:04	qMeNXQ.jpg	5f556350e6956106bc52ef1cac4e36f7
2018-11-05 14:24:08	ck.exe	feb30172d3c792077132d4f5c0fc7095
2018-11-05 14:27:06	lk.exe	d6f6a5af8586bb0c2b230afe2378cae7
2018-11-05 14:30:06	el.exe	0903293a028b830ac6a2a470bd9402b7
2018-11-05 15:06:09	fbi.exe	7235dc9abe0bb5db5c44d1af95175a08
2018-11-05 15:12:08	Invoice.exe	758bdcd4b29b0459ed7295ec0acc32ff
2018-11-05 16:03:05	SOA.exe	0ce3ab3f90886cd5b4414cd7276b0846
2018-11-05 18:30:04	Rev_PI-09032.exe	b9a3910f352695f5c2bea4fa945a9df5
2018-11-05 18:33:12	flashplayer.exe	8e99ac8175dd1f7553e105a937893bab
2018-11-05 20:36:03	IUQaba.png	4c368432fb0a70e8117f39ede489f71d
2018-11-05 21:06:05	app.exe	c4749db4079de2caa841dd1be5272e45
2018-11-05 21:09:04	client.exe	6932533f49ebb15b8cc088444983a261
2018-11-05 21:12:09	svchost.exe	dc47a88212cf43fe426b491afd9c5e99
2018-11-05 21:18:03	pvU4at.png	221949c69aa5e93d492d59c009a73121
2018-11-05 22:33:04	raw3.exe	48263a3440ab0b496a151c9a43cd3d79
2018-11-06 00:06:05	ss.png	521a8ad405c1ddb159f4eedcfbb17241
2018-11-06 02:27:03	2.exe	3a8c2d63fcfc208a06079dc8b5d08124
2018-11-06 02:33:04	Purchase%20Order.exe	8e381a03e88f5a4cdf3d25146d6a093e
2018-11-06 08:18:04	ngSqge.jpg	ae1f655137de8996d77157a5f66c32b0
2018-11-06 08:48:14	new%20order%20confirmation.exe	3bc3240f9d414e0d7b8cfd3ffc5d4906
2018-11-06 08:54:05	Purchase%20Order.exe	164a1e7c1e3242ed7308c9279025587c
2018-11-06 12:12:04	4nlg9S.jpg	10979112e34d90924ce49c49c8f86271
2018-11-06 12:30:07	cocro.exe	f7382a1a863a8efeedc4c5199a5a5a15
2018-11-06 15:33:03	BI54iv.jpg	ded2544ef7c59ea7d6e6720a2bd0ddec
2018-11-06 23:09:14	Aras_Kargo_Bildirim.exe	b7b39fa7fae259cf10ff8f294e01a329
2018-11-07 12:00:04	3242343243.exe	48ff3776bf9697d21b66db3ac415ba53
2018-11-07 12:57:06	60.exe	add3eb4b5f4ff9e95c5bdc520dcdcece
2018-11-07 16:09:08	Aras_Kargo_Bildirim.exe	b22bb99b3d7d3ee07a9ea8aeb6da24a1
2018-11-08 02:30:07	jccro.exe	c8f44f835149c3d9a7fa1aa4fa938ebc
2018-11-08 12:03:02	bXhHo7.jpg	6fae28a25f5ef4d2828d4587d0428e70
2018-11-08 12:06:04	ml.exe	14a7d1b40264d2814f4831049e1e6c79
2018-11-08 12:09:05	n.exe	b4f1aa0a66b6266a7705543dba497226
2018-11-08 12:15:05	1.exe	cf4e557fae0400be25950605b6b166a2
2018-11-08 12:42:08	ebin.exe	8337750fa2e99f5d38e9f832f8be2fe8
2018-11-08 12:45:06	nbin.exe	7b3f6550abbf431ad7a2cf1dead5a0bb
2018-11-08 12:48:09	nanopill.exe	9f4c415f7fcfcc57faf0801b51581e91
2018-11-08 13:06:04	nytbin.exe	c587d0b498c4f1b9c104b907832bf362
2018-11-09 00:45:04	alcro.exe	a1e2abb719d3aaf8598154cf2f05b95b
2018-11-09 03:00:04	radxl.jpg	4a4418eedf92d9c40bc2e3bc5e4765ae
2018-11-09 11:54:04	best4all.exe	f324a2b84a71d0dab854798297ec5d51
2018-11-10 21:15:04	uoGeRj.jpg	30cd3b06b8dc5afd21c7eb65d233163d
2018-11-12 12:33:03	ndu.exe	3d937c27883d24e31fc90cde09fab6ab
2018-11-12 12:57:04	PugNto.jpg	ff0afeb2e1ecb89d42ff2bfce8fef52b
2018-11-12 14:48:04	z11zi.exe	deb0fe55c002975c49bdfe1db738e761
2018-11-12 17:57:04	vbc.exe	0aafa3deff1c14b00cf8b2fb0c4a366e
2018-11-12 18:00:04	agnt.exe	b36914a454ad9c88e99eaf3b0a46cf42
2018-11-13 00:03:03	Useless_Loading_Bar.exe	54d37cb3e754c7b6374ef6770ad41040
2018-11-13 00:21:10	a.jpg	271612558d61d96cdc731666e482d3ae
2018-11-13 00:24:05	xwizard.exe	c7854bfb83e3d6a3c2849867d8bce688
2018-11-13 00:27:05	xpsrchvw.exe	c19780d09c3ca3c3ed938dfa032f4d46
2018-11-13 00:30:06	write.exe	c01c337a5b9318b175004efacf2c604c
2018-11-13 00:33:05	uio.jpg	ef44a23cca84803fc4989936c357654a
2018-11-13 00:36:03	taskkill.exe	547b5fa9a4126611b855527d82d8e292
2018-11-13 00:51:05	dcu.exe	30c30e1ee62d2d2d4e313ff9691b70d5
2018-11-13 03:00:03	Wv9ACL.jpg	d63ba344dd222690652b3a93aada4fde
2018-11-13 09:48:06	docxx.exe	80762e118f9f95573a986590f47378b7
2018-11-13 09:51:05	doc.exe	12f91672287e28451edb464f65abe819
2018-11-14 01:39:04	ETL2BZ.jpg	a9ec9a0c77ad958a4c443979abda9502
2018-11-14 03:15:03	p_897ao4tp1.jpg	f256abf7b1bc79d6e87fb9bca01f05b8
2018-11-14 21:15:04	marcus.exe	19f8d6f3db54f342111fb31e70052a49
2018-11-14 22:27:04	kendrick.exe	a9209ccaf4bdd0d78cdccb638435ba56
2018-11-14 22:30:04	dramafrnd.exe	75d2f7e4efad58a372fb044fce8f91cd
2018-11-15 03:12:06	p_1042v9c0c1.jpg	44f3a040393c88dcb5277ee7fce82211
2018-11-15 03:33:04	svc.exe	3f2ed700fb99fcde336f6c1ae7df5eb3
2018-11-15 22:27:03	OQAq8a.jpg	8d0505060f0f2282ce99d705e6812b67
2018-11-16 01:42:08	FUD1111.exe	5b67f0e2488e94ba4107d6a4504e8cb2
2018-11-16 06:33:03	ehiz.exe	1f0e59cbafc91f2601798239aeb8e361
2018-11-17 09:33:05	updater.exe	aa73fd88db26bb43bd5e133fb0dc397f
2018-11-17 09:36:03	1.exe	a97cf3fdac54a472076f91bb64f43016
2018-11-17 11:06:03	DhyoTe.jpg	fb063c63ceaad68a05f1ec1ed3a0f9bc
2018-11-17 11:45:03	111111111.exe	e60b27359515e7fdf8e02e87b65430a6
2018-11-20 02:57:04	lsb97n.jpg	011c9344620bfd478f5d5cd2e086906f
2018-11-20 14:08:30	res.exe	7a1e66b3ff87010df7a65254c602c3e2
2018-11-21 03:39:05	ee.exe	0166e811c83b7c396bfcc37b8cbf74fe
2018-11-21 03:42:06	mkl.exe	42e69f5e25494e1ad773b81cc548841a
2018-11-22 17:03:05	docx.exe	828aecfc008397fd38d5131a51f49d42
2018-11-23 01:09:04	YW6zOI	e394b4050e7e35a5a6672228b10fd6c4
2018-11-23 01:57:04	BGIYT0.jpg	b3ac228aa5ee202c03d0dc4fc911cc7a
2018-11-23 08:51:04	bin.exe	84df5bd5d460fcc279c96ca71e731f84
2018-11-23 11:24:09	BL.exe	e54a9db2b6629d6d55e0220851e62ed4
2018-11-23 17:27:04	dhl.exe	311c81f0ac007acf327335c85620ca01
2018-11-23 21:51:04	dll.exe	61e69b6ecf176fc74179fffab0fc4292
2018-11-26 16:57:04	ZD1iPU.jpg	ddd261a6bd8ebcd6cdd8348e02f5dcd5
2018-11-26 21:57:08	file2.exe	87e0c180228ea0c4e46975fc5ac6b2c1
2018-11-27 20:18:04	muruako.exe	7774429f80647641d6a6098c15a5d8ba
2018-11-28 00:15:04	IN_093.exe	d8a223716391dafd36d68a73f1e1a72c
2018-11-28 05:00:04	obm.exe	c54fa7b04d1846514cdf2655fe3368be
2018-11-28 05:03:06	baichi.exe	c5ff95dc2d5c2655264e32215c8ea31f
2018-11-28 07:06:07	Invoice20180205.exe	dfa9ee7c22e93b3ff8a0a21c74b916c9
2018-11-28 16:51:06	r2.exe	b44cb04d7b386816db7805acc0d4d07b
2018-11-28 18:24:05	yes.exe	30054e8ab134e9ebd9b20701d8e62d81
2018-11-29 01:42:03	aEqo87.jpg	1a1ee2bd1f9f211aa77dc4efa97c19ef
2018-11-29 03:51:08	%e2A%aegpjexe	9c8cb2cca9bb51702bd4b3fe9e337888
2018-11-29 06:21:03	rZyOEz.jpg	c30a9bbaa94f7a67207267ee515734db
2018-11-30 02:42:03	U7fD1i.jpg	87aebd323f2231f7dfdef80c162d9325
2018-11-30 04:30:04	otf.exe	0761472899b79af0dc97318cf25afa36
2018-11-30 05:06:07	josh.exe	aa75b7530bf11431e835111274292e35
2018-11-30 05:09:08	excel1234.exe	dd2b4797905fbfddb01593a7821b48ab
2018-11-30 15:54:05	soft1.exe	0ef724276b3aa26af86f5d8dec90ba17
2018-11-30 16:57:05	nvc1.exe	c64fc94b2587878c01378ff3fcef6b3c
2018-11-30 19:06:03	Already.exe	2e85749f14e9ceaeed8e77ead8515348
2018-11-30 19:09:03	today.exe	8f6a5e88df392a5b93699a703639b353
2018-11-30 19:15:03	wiz.exe	fa35fc7e5934ae6a6ab61f7ce0958815
2018-12-01 02:54:07	SCAN-IMG00001.exe	3865b2f214a29870f202e29be014744f
2018-12-01 02:57:03	toquIS.jpg	c0fc04ea92743c453662c724737cea2e
2018-12-01 03:42:06	IMG-0004-PDF.exe	73fad7f43d84bcda12adbfa6cd8e9ea6
2018-12-01 03:45:05	jfile.exe	cfa2a5efab619a29ee8a2a3446fecad1
2018-12-01 03:48:06	Scanned.exe	d30bd44d161347d5ecf0aa5f6ee9506e
2018-12-01 03:51:05	loki.exe	ccfdd35e1c0647e7b383180f8cb07f0a
2018-12-01 03:54:05	document1-11-19-2018.exe	70e336879fb16c0e85763d9853167c5f
2018-12-01 03:57:05	document.exe	dfb46c099bd536469d8f02b847558aa6
2018-12-01 04:03:05	SCAN-00001.exe	2578debd234465c8aa7bcdf53bc3858a
2018-12-01 04:06:06	DOCUMENT1.exe	a5ca29da165f863997a8ff59d06ef0b6
2018-12-01 04:09:06	IMG-0005-PDF.exe	0025306c92ef036623fdd9c8680eb7f6
2018-12-01 04:12:05	docus.exe	28558cb675285ad2605c85b344360953
2018-12-01 04:15:07	server.exe	298d23c0ecd0b23b303eed58288e8209
2018-12-01 04:18:05	chulks.exe	e0f3a7906e43d056bb3dcd59e09ce303
2018-12-01 06:36:05	Installer.exe	04b3fc3d766901faac890089c343d4d6
2018-12-05 13:00:04	cKZX03.jpg	9f640856688e8c984072fd765921142b
2018-12-05 14:35:28	documenti.exe	2288ae3cc673244a3324f85a6f1e3a33
2018-12-05 14:35:44	Richiesta urgente di docency.exe	db553286a76871759ebdbc088f2408fa
2018-12-06 00:18:03	W3WOTo.jpg	50abb56811f14b4c4a6e4d36e737fa90
2018-12-06 13:57:04	cable.exe	2dfad2921659565e30bbd906ecf61bc4
2018-12-06 15:06:06	update1.exe	224e2e9855f849f638bc2625f9fadfb4
2018-12-06 17:15:03	MtRo5.jpg	90ba69e1a01ce9838d3efc47ea44c2c7
2018-12-07 06:24:20	sysinterrupts.exe	215c21158c1d15563340388ec2b42dcd
2018-12-07 08:54:03	GCQ2V2.jpg	b4f7d6c32fd88f6f0743eb92dead9508
2018-12-08 00:18:04	o701HI.jpg	88f92e58bd3ca6643ce92ef105b547c3
2018-12-08 00:39:03	i76eVI.jpg	c249f73201eb29b9fbe3fe463972a93c
2018-12-08 03:33:05	xoio.exe	ca878ab3c5970368907fc5ed1e5b2783
2018-12-08 19:45:03	EJ6Q7V.jpg	76a333eeff5d9e00fa0a807c5ebf4402
2018-12-08 20:54:03	p_1055q1ssb1.jpg	6ef12f96e1a99984a96d6e1657389566
2018-12-09 00:03:08	Payment.exe	2e1dcdfa81e62e4b3a9f0942f294bf0a
2018-12-09 00:27:05	clear.exe	bd47162ec710da989e5e7a83696277f8
2018-12-09 03:27:10	image.exe	287782734f94678617b7028b029320ab
2018-12-09 11:12:04	icce.exe	507f816268a4a65859093a3d7dec2820
2018-12-09 13:15:04	maTC3Y.jpg	f615246b5bc99163330e508d068bc3d3
2018-12-09 21:18:03	password.exe	1dbe12f94d0860e432e2d67b0b79ffed
2018-12-10 15:00:04	temple.exe	fdadff0917048bcb670e896c765b6978
2018-12-11 10:06:07	file.exe	f687578228589112de2af8853c6aea3d
2018-12-11 11:51:03	Curwd.jpg	00dc08f45daea9f3f19edb3991e5f383
2018-12-12 00:06:03	cYJdsf.png	1c38a5c4d5c7fce6a8c09d4bb4202455
2018-12-12 00:09:08	kiio.png	41d368733e6415665c2888c965eaab29
2018-12-12 00:15:06	palma.exe	f8230924c3102434959e2c9bd1725174
2018-12-12 00:33:03	grG92y.jpg	e154ef52bf7c63d898c2873a525b8168
2018-12-12 14:36:10	new.exe	79a2ee66b4cf53490092f51b15dda05e
2018-12-12 17:15:03	yBJZiZ.jpg	3801e479ee6c2e68305cb15da3735049
2018-12-12 18:12:09	justnow.exe	27bbabe96a13b1cb7234003f7d0c6e12
2018-12-12 23:57:07	tt.exe	369e381a5b208e2b75963ece037f38df
2018-12-18 04:00:10	DOR.exe	825c3eadec053655b07dec298796484b
2018-12-18 16:15:05	d.jpg	df91ac31038dda3824b7258c65009808
2018-12-20 13:24:16	winsys.exe	5d618badaf0d80e30c44540d44471b68
2018-12-21 04:51:07	goal.exe	6912902bfa56ec90f8603d026a978ee0
2018-12-22 09:51:05	sgfhh.exe	57c9ca749c7bbd6539c40a5d7d3530a4
2018-12-22 09:54:06	puddy.exe	d7033e166205ea25734c8c4da56ceb7f
2018-12-22 10:00:06	sickbay.exe	176ee0a6e84e1c62e400b983b5956c5c
2018-12-26 02:33:09	hidden-tear.exe	6443f20eac835cab2b8e22c542281e29
2018-12-26 07:45:09	HiddenTear.exe	4a8228f5109bc509936eb5286d86322a
2018-12-29 22:18:05	FLASHUPDATE_068.EXE	f75dd96fe11f91c342d35c5a05c6c688
2018-12-29 22:21:04	flashupdate_044.exe	da44080a3f10e6f579f4c6b31ad8779c
2018-12-29 22:27:04	flashupdate_022.exe	57e66eb958f00a58df90b24ce6a45f18
2018-12-29 22:33:03	flashupdate_073.exe	82711cfb028c8201f5bd769130e64c5b
2018-12-29 22:36:04	flashupdate_063.exe	fc7b109df71378fa118ab9e8eaabc52a
2018-12-29 22:39:04	flashupdate_027.exe	be2d45091723f8e6a78fe46bd07b6144
2018-12-29 22:42:03	flashupdate_076.exe	5a947f6eb204e7b77cc59af1d578e9c3
2018-12-29 22:45:03	flashupdate_083.exe	5e5cd99f8ff67ace052ae92fc2dc7857
2018-12-29 22:48:04	flashupdate_072.exe	677872f6f71d6cdb6f79bda230ef12b8
2018-12-29 22:51:03	flashupdate_029.exe	cb672bdbc85c872637812e3d2cdc4a2b
2018-12-29 22:57:04	flashupdate_038.exe	353c972d301cb37166add5ce4fe5b2a4
2018-12-29 23:03:03	flashupdate_028.exe	f05e798d735422454beb719d0c17f679
2018-12-29 23:06:04	flashupdate_081.exe	242890ee6fb0e6668bf09b2024aaf45b
2018-12-30 00:06:07	RedirectService.exe	5aac4998509c066b8acfdcf461ceaac9
2018-12-30 00:12:04	flashupdate_091.exe	02f7471aeb60e531d3fbbc3b4c7551d8
2018-12-30 00:24:03	flashupdate_071.exe	cae0b9aee54fcb80191da3c2e3813df0
2018-12-30 00:33:03	flashupdate_067.exe	aae27cba6ea7e66e32082966a5853c61
2018-12-30 00:36:04	flashupdate_077.exe	4eb8267d44afa8d3fca259c8c45cbd78
2018-12-30 00:39:03	FLASHUPDATE_016.EXE	c925e5ebf4bac8fe3df4018165e39ba3
2018-12-30 08:57:10	789.exe	feb7d5bc3f8c1bac7869e0723802a384
2018-12-30 09:24:06	RedirectAds.exe	14370a60e4ed1cec026362b8359d57da
2018-12-31 05:57:04	mark.exe	fc4f504538b1dace6d7ef784cb55a492
2018-12-31 16:06:04	cc.exe	34df9acb2cf238af89534746bec33054
2019-01-02 12:18:10	mmmm.exe	8e1c74f13ca40cbe88189ce21829f974
2019-01-03 19:42:16	LeopardRemote.exe	32131a06af8036a9de98839105f16713
2019-01-03 23:12:18	PSEO.exe	0985d098f03f46cafaf92681d0589c12
2019-01-06 18:42:06	MicrosoftOffice.exe	c3ab046844a32b5df201cd7d5929f36a
2019-01-07 11:45:04	22cted.exe	bd24e429e0e30a5fd400dc4b40a2b464
2019-01-07 23:06:04	nanoz.exe	4c7ba315d05e34f2d940481ee4615240
2019-01-08 03:57:06	setup.exe	692921943e8230c6ea44054ce62212e5
2019-01-08 20:42:04	MTKMediaEditor.exe	55091a83cd907ef9598d73b61b829170
2019-01-09 10:03:14	cig.dat	ea3859eba7d847ee1ce9be393bd657d1
2019-01-09 15:21:06	jason.exe	1e309647f51dd353b97cdb200aab10b1
2019-01-09 16:42:07	svchosts.exe	e8f2d24339a36e86affa75f3614e1f4a
2019-01-09 17:36:06	stub.exe	ec262d2f33d76817e351ba24ace468b8
2019-01-09 20:39:06	AutoUpdate.exe	ec3be851dc9794cc1c4491f7743a3458
2019-01-09 22:15:06	AutoUpdate.exe	fb1f1475f9dfda390f731fffd5f769ed
2019-01-10 06:00:07	Apostila-cursos-onlinesp.exe	07afd4aa6e92ef8771483a58ea88541f
2019-01-10 07:54:06	jvi.exe	59fdd5e90392581e6ba985c814b4ddef
2019-01-10 07:57:05	x.exe	6e99440bfbe1db3ad8f68f3499957e43
2019-01-10 08:00:04	lll.exe	d235dde755b593f9b1027254e0ebb3c0
2019-01-10 08:03:05	sad.exe	d2018679d5381c11c9554668935865fe
2019-01-10 08:06:08	rosinject.exe	8cf16019bc7dc6f2517c178f3b1a2851
2019-01-11 15:12:22	wangying.exe	f5a3fafbb6792f8d77c7267c5fdfd3fa
2019-01-11 15:15:24	diantao.exe	648810c343ae9cc440d14e6832df34a9
2019-01-11 15:18:30	lingyi.exe	2206bcabc1d0bd30cece9ca79e020e44
2019-01-11 15:22:00	chengzai.exe	d2a3fb920d982c7a27dc5ffa59499afa
2019-01-11 15:24:21	jingling.exe	59791d13edd64f2ff0cac07f9eec073c
2019-01-11 15:28:19	taobaowang.exe	ca8cb2603e80d9111e7d984c442e0cba
2019-01-11 15:48:16	jingling.exe	99bb541446cc94980f325826aea997a8
2019-01-12 07:30:16	systool.exe	74df64c06fb6b983b9753d4c1ee20970
2019-01-12 09:18:07	svvchost.exe	e199ffd9339f042d05d54a0c54402704
2019-01-12 13:03:07	KeywordService.exe	57f56925110b2885d40e31040b8f4abf
2019-01-12 14:42:03	5c130869bde72mshta.exe	2c98d1d12d5cdc1fdbe3c198871e81bb
2019-01-12 16:30:08	readme.exe	18ee23d07ebd14c18b8931015ba42f59
2019-01-12 16:33:07	win.exe	81945fbda08b6a18af3286e0f526b0fe
2019-01-12 22:03:06	Install_Bsdt_DotNet20.exe	992542b00ac7c8f9b25c17f11b866299
2019-01-12 22:27:06	231.exe	481be3ad5a8b48b4db3858d6de84a970
2019-01-14 14:51:10	VTechRepiar.exe	4cf248bd0710ef55dc447532c0d37e91
2019-01-14 23:45:18	loader.exe	2db7860692f9fc883f08ff3a292e126a
2019-01-15 00:06:04	wall.exe	74bab76984e9561e46305c277cf5b12d
2019-01-15 01:36:05	down.exe	7c37cec76bc17732727eaff9c835ed30
2019-01-16 18:21:04	VeilInjector.exe	15745dbac240993bdf41da546f185342
2019-01-16 18:24:04	dcad3069268a3307.exe	3bc442ee5c6cbf7a1b9b841285df693f
2019-01-17 01:39:05	1.exe	7fa1451564e528a0bbf381b608e56164
2019-01-17 09:42:05	taken2.exe	c1a014f111ad13da6db742c3ab722691
2019-01-17 10:03:03	taken.exe	9dda4a0b46639258b567e5bcc1548a13
2019-01-17 13:15:04	not_a_rat.exe	7f3fdb1ee65c60e68b13e7727e2f43da
2019-01-17 16:27:04	gay_rat.exe	41a89c161db48fe207b1246c09238e39
2019-01-18 01:24:03	Ultimate_Trolling_GUI.exe	ec601d8053420186d79ab7093afd37b4
2019-01-18 01:27:04	RAT.exe	7ad54d78f0707b0418775e8b4ace6403
2019-01-18 13:30:04	Roblox_cracker.exe	b10d1d81bf33f8919beeb4ff0220d846
2019-01-18 14:33:04	good.exe	23da8a28fa471b50a5998557cd333ef5
2019-01-19 01:21:04	Synapse_x_injector.exe	a543544e38e7b88639ef62b11895d16c
2019-01-19 22:06:08	taken3.exe	30e9206ec9838aac54167888768f4911
2019-01-19 22:30:04	taken2.exe	1a1ae849fa2f209fbb1e48cbf8a71981
2019-01-19 22:33:04	taken1.exe	8f651270e46936427cb394a9788cfc43
2019-01-20 08:54:08	bblr.png	219f3822190d25733aef6bbb793c703e
2019-01-20 08:57:06	lawabj.png	8ca2331fa1f78f1b009aae691c1417f0
2019-01-20 09:03:07	smt.png	0679d7f3cdf787d382e83903a916eb4d
2019-01-21 17:09:04	install_flash_player_13_plugin_cc.exe	deb425480b1fc422ac3c772fbdff70e0
2019-01-21 19:03:06	ace.exe	c78cffac0df6b51c2e6388d324d196e1
2019-01-21 19:06:04	jay1.exe	6d4dafdd35e3f2851ba2977570226d67
2019-01-21 19:24:05	ion.exe	8d57adfdcb089759894bcc52f2344edc
2019-01-22 03:15:12	Build100552.exe	667b012c279842a0ee4be931f2f6ce34
2019-01-22 04:48:13	AutoPK.exe	3a7f2baac3f33d6d0af0cba14d7ef428
2019-01-22 04:54:06	RaoVatCTC.exe	4f1b859b7cf98306c0d95a307862bf39
2019-01-22 04:57:06	LoginPVTK.exe	3170ccef60228ac7db4eda4cdc0a50b8
2019-01-22 05:00:07	VLMPLogin.exe	ce5c1b79c68d645895eb363604935338
2019-01-22 05:03:06	LoginCTCus.exe	27279c1e851cfb7e4f41a53d78f12859
2019-01-22 05:18:07	CTCTanthu.exe	eca0860d6a9fe1f12e6e18c2863fb4cd
2019-01-22 05:24:06	VLTKNhatRac.exe	479fdfb2b1e0860dc5cd825187d47f67
2019-01-22 05:30:08	VLTKBacdau.exe	8bb94b416fd08fab1d24ad5f512d467d
2019-01-22 06:30:10	CTCKeoxe2.exe	fd4937d63bc278993ee3e798beb1ce36
2019-01-22 07:54:12	qcoin135.exe	17cda33d988a252dc62e7038d774786b
2019-01-22 08:00:06	qcoin128.exe	c17eca0060a35299ba10f48ab4dcfe61
2019-01-22 08:09:07	qcoin133.exe	414fe6ada5328e44c825069e3af23235
2019-01-22 08:12:07	jd156.exe	852a30a2b95611a520cce3c6ff904ca3
2019-01-22 08:18:07	qcoin130.exe	63c7f84f68c2661a3baf006a02b2c764
2019-01-22 08:21:08	qcoin142.exe	1d5ba6bd6feb0456ade6b15113f53847
2019-01-22 08:24:08	jd124.exe	8ef51652049ad4f69e60676b10bbd3f0
2019-01-22 08:27:10	qcoin141.exe	d98c70aa373bacb8ee843d1a2e4c8375
2019-01-22 08:30:06	jd127.exe	1c89f2fdbadc7d41fd89205e5005126e
2019-01-22 08:36:08	qcoin146.exe	4c7dcbbdc2d65bb8c8d9f5fd8dac7422
2019-01-22 08:42:08	jd145.exe	2d8b481844219e8195b119c69fe6de8c
2019-01-22 08:45:08	qcoin140.exe	166b1183ad5e8e9ef50f8ae723b3d085
2019-01-22 08:51:07	qcoin131.exe	50cb6f081db83490bc2e560326dc04ef
2019-01-22 08:54:05	jd144.exe	d74bee5b0023115a134f7c8a676cac45
2019-01-22 08:57:06	jd138.exe	5ea928760bcbdc138627d94b58e029de
2019-01-22 09:03:06	jd136.exe	59679a4df49f852ba989838ca1a3c5a4
2019-01-22 09:30:07	qcoin139.exe	e9726ea801251c54724da10f656b39cd
2019-01-22 09:33:07	jd137.exe	2b68cbc49ab740df5046f1caf826f957
2019-01-22 10:00:08	qcoin138.exe	b3463dcf1ee4f0ea44e5f2668b413822
2019-01-23 02:39:04	N3tfl1X_Reaper.exe	439fb49cb62c5e3f9a3709305d38507a
2019-01-24 18:12:05	jubajeo.exe	e519167afeccf3eb21772197027a810c
2019-01-25 23:51:08	GetDataAVK.exe	9ce1045ed9b9d6753b47de8cde9b3b4b
2019-01-28 03:57:05	nzejj.exe	61c3a0d5a9ac9bf77562129240b60ed8
2019-01-28 04:00:04	clientbobo33.exe	b6c3692bfbd98dcc39a6347fa9f4fb69
2019-01-28 04:09:10	scan.exe	cbc69887e4a432072be1ecda9dbbf262
2019-01-28 08:54:05	scan.exe	92085960e5f74f8de0219811d4d6723c
2019-01-28 08:57:04	mon.exe	8589df8ffc16b06bbb03e536e0d7744d
2019-01-28 09:06:04	EXPL0RER.exe	a1081cf916c150d38d11afb7099b67b4
2019-01-28 11:57:04	lakuba.exe	38ebfb6ba48d76b7a1d3bb173ce0078d
2019-01-28 19:48:07	test.exe	7c7b2b92922c95615d8e2dd08602fe7b
2019-01-28 19:51:03	vb.exe	7d77623bec9708b187866e94f20ba8ea
2019-01-28 19:54:03	vbc.exe	ebced7a42c5233b136c008c83a8d1c1d
2019-01-28 23:00:04	TheDocBuilder.exe	cc93bfb2d0ad7b47085a7b0db4724a63
2019-01-29 08:12:04	f4bc1ea828b71.jpg	b2c4c3ba3706f61673d05f6c6b7245cd
2019-01-30 06:03:05	amb001.exe	9b05f2be7a17804456fded8301926c0c
2019-01-30 07:36:04	crypted.exe	26c7f08a4760fc18cc3ab666fc97c888
2019-01-30 13:54:06	miguel.exe	d96d5930e801a2ab71eb6925322a29f1
2019-01-30 17:45:07	donpy.exe	8bf604d05638787e408785c4c46a163d
2019-01-30 19:00:05	obn.exe	d9723268c4f4b9e408648b8d8a0c9174
2019-01-30 19:03:05	dg.exe	4002f13fec49ba4f432fc392f8555fc7
2019-01-30 19:06:04	ab.exe	fb58911b77f7b03a7355e88df0a69154
2019-01-30 19:30:07	mrniger.exe	19f103943a60be56c2e26a26066af04d
2019-01-30 23:45:05	vbc.exe	51667a5b1127b0a1b4ef6c2746a62c26
2019-02-01 02:18:19	elvis.png	e0ae0e514bd37873a9160b5a0f828740
2019-02-01 02:51:03	BetaClothing_bot_G0dDamn.exe	d4dd0b6cd6b9007b7025740423c40799
2019-02-01 08:09:07	document003.exe	ea89a9c4eac31b45c8613ba04c923e71
2019-02-01 12:09:07	scan(1).exe	a378fc3d5e899253b7595b23bd5d34f0
2019-02-01 12:18:04	scan(1).exe	574da65930bab974b3f2526cd10cb94c
2019-02-01 12:21:04	nze2.exe	6ae26d4e88727087b68511dc1567b7cf
2019-02-01 12:24:04	Document0022.exe	cf9c95e36bb4ed9f6f8b2996e4bf7e39
2019-02-02 09:57:09	33.exe	603ee0c09ff8e63add39b18ba1bf601d
2019-02-02 11:03:09	ord.exe	8500ce138e2efe74989cb1bc45f2533a
2019-02-02 11:54:05	file.exe	19091abeb4f0f27a8d7a8b2c14316c28
2019-02-02 11:57:07	DOCUMENT.exe	ca9c2913e35c74a38b7f8ece1cb17785
2019-02-03 09:15:04	AdsShow_installer.exe	58d54f0cd034f70626578d388a3ce366
2019-02-03 09:18:06	wizzcaster_installer_v2.exe	30136ac5c03bc8bf208de6e1a0476366
2019-02-03 09:27:05	wizzcaster_uninstaller_v2.exe	d006da609c1390d64448703888496c56
2019-02-03 09:33:04	wizzcaster_v2.exe	0ef1c8a62b29bf298858d4f3da77cc77
2019-02-03 10:00:06	updater.exe	2939e9c16882b32022a1e718035d2b9c
2019-02-03 10:03:04	shutdowntime-uninstaller.exe	ef865f8284a054f052141f5b2f6b38d7
2019-02-03 10:09:04	remote.exe	7adaaa2bed861d4f5d2f73bb3db8cb84
2019-02-03 10:12:05	shutdowntime-installer.exe	cb7ece2a0530cc669b0c102d4aa36bbc
2019-02-03 11:06:04	powerproductions.exe	d4194f33ce761cc71609a0f28c8f6707
2019-02-03 11:18:03	Windows_Patch_Guard_.exe	cb2b362c3fb0bee335ac936e893777ac
2019-02-03 11:21:03	Rbx.Sell.exe	b37e3ec089a4efcd004ce9850d0d5c27
2019-02-03 12:12:04	test.exe	bd73bf6ec76a3e29b48afd1fdfbc2015
2019-02-04 02:33:05	file.exe	22adf1eab4de4c8974dc0ea938060951
2019-02-04 02:42:08	jupiteri.exe	f4c31735ea6aceb1c6b40624ca9b5158
2019-02-04 04:51:04	bloom.exe	4d7e1d649003c140fbeb492c45589de5
2019-02-07 21:54:04	autopatcher.exe	a7058a3a202429b353b02c74ad1b6c91
2019-02-07 22:03:04	Autopatcher.exe	04e6ba94a6961971e97c8b834fbaa6ea
2019-02-07 22:36:03	autopatcher1.exe	5cf8cf9dbc9f8e9ef4c022c6a229a424
2019-02-07 23:36:12	d.exe	06fcf23101e287a10b150149da8a2492
2019-02-07 23:39:11	np.exe	69a2bc4265951b76349ca5e189067be9
2019-02-10 13:33:11	java.exe	1c03eb97cf05830ec1446ee5b0219143
2019-02-10 14:48:05	lokra.exe	d5a3b59f2c25b6d4ab82cfec7339bf1a
2019-02-10 15:51:05	update.exe	ebddee306fa872a99a7c4df6a279c6ee
2019-02-10 16:09:06	jab.exe	ec8df4f4481fcec29e0ce473a0991aac
2019-02-10 18:33:06	1212.exe	720ebbe190c55fd77b837d1dde3e0098
2019-02-12 09:06:06	ZASTI.exe	f3eea1b45ca04f7c0c33122cc2ed0590
2019-02-14 00:21:15	tongbujl.exe	d25c1b6baec619b62ad1d860320e1537
2019-02-14 04:36:06	zhangtjl.exe	18cbce82cff2eae97fb78cf35736676c
2019-02-14 13:51:09	az1.exe	49915b5cc6712a58f8e7da5efe740da5
2019-02-14 16:54:06	LoginTDVL.exe	71380f765a45917b03b9654bb3cf76e5
2019-02-14 19:00:04	az1.exe	a0ec86356e28553a1bd9a60033dbaf12
2019-02-15 04:42:17	net.exe	a4d91d383f8206eb5aa1cc0d89931d2f
2019-02-15 15:30:06	XX.exe	02e70174f1f6c1afb24340a8bef26358
2019-02-15 16:00:04	AA.exe	c0480833e47ceb91dfc949148a58642e
2019-02-15 16:03:05	55.exe	5549f698a59f9fabc4b606b886aa2e70
2019-02-15 17:33:07	document.pdf.exe	eff66439bbbae2cd2194ba453ac3d977
2019-02-16 15:18:07	58.exe	0afafd7fd55ab35a2b27d7b190145ada
2019-02-16 17:51:15	ps.exe	22d2ec2ff1cd94487a7fa8104ff97b05
2019-02-20 13:03:06	FlashUpdate.exe	561a562a0eb58d9eb70955b3bc9ee95e
2019-02-21 05:27:07	ZXMiner.exe	7a4a95857027e5468cc9bb1e35247036
2019-02-23 16:36:12	2.exe	5083e13216e5462e6715979ba9d4a65d
2019-02-24 07:18:18	ufc_2.exe	e04bfd3c3c6f375684dfbd83556d6ceb
2019-02-28 23:48:05	IMM.EXE	0c501c81117bd124e7ac1111c7f0fa68
2019-03-01 06:15:07	strt.exe	acb2840b575bd538efdd76ada3a603a2
2019-03-01 15:03:04	eyu.exe	32ffae9524a6321051248e4313c91852
2019-03-01 18:39:05	kl.exe	076009e57431ad692bd745389ff86a05
2019-03-01 18:54:08	rat.exe	d6f756f414f27124099d7ffae65d9727
2019-03-05 10:39:06	KuQGPllkICewEQFToxsaTcnldneew.exe	0afd3c523727da0991e06e8c118fdf8c
2019-03-07 00:57:05	drive.png	9cabb5bb7e93fe746697252ce64638d4
2019-03-07 01:00:05	drver.png	b3c338dbc6192dea325c4e43ea372811
2019-03-07 01:03:05	file.png	bcc628e58ba88e4e46751df749efd96e
2019-03-11 10:54:05	orderreceipt.exe	95fb70475df8e71ac7da72f241a6c117
2019-03-19 00:36:06	bin.exe	67ef19394f3d78f92bc79bb6c191ef91
2019-03-23 14:06:07	server.exe	96580a68c5c3349db9fd217d6565dd27
2019-03-23 16:06:09	data.exe	09f12bc5f6a10ec24821aaa31684bdc0
2019-03-24 09:33:15	CIG_MHKD.dat	9b8b3ade510c30bc233a260a86a92e52
2019-03-25 13:09:05	vbc.exe	78a97330ffd3fafb96f6884278ade6e9
2019-03-26 14:00:16	vbc.exe	530005f5cddcbf178177ecd2ff08fb19
2019-03-29 10:27:05	vbc.exe	d4a35a334b20ac4984592f0fddce9924
2019-04-04 02:18:06	new.exe	ada86fa7333077686882e311dd569ac3
2019-04-04 03:12:04	nj.exe	97eebaae286dd77c78f2fa727b6b11df
2019-04-08 16:00:11	vbc.exe	2f1bc487120c1d5410a763b20869051b
2019-04-12 16:49:02	winsw.exe	1f41775fcf14aee2085c5fca5cd99d81
2019-04-12 17:31:57	ieqgrkfl65.exe	b3c9f98dd07005fccf57842451ce1b33
2019-04-12 17:32:27	hqpi64.exe	6e72ae22942e7d5e1e5a0c7e1920c595
2019-04-12 17:32:30	hqpi64.exe	36a4243c798e2ebb860c301c14b8f084
2019-04-12 17:34:46	hqpi64.exe	6995e574182cc7eaaae1c45fc44a87d9
2019-04-12 17:34:48	hqpi64.exe	5c248368d88ce227a7773e28b729c189
2019-04-12 17:34:50	hqpi64.exe	458a56504533cc708c79801a35003b80
2019-04-12 17:35:06	hqpi64.exe	76ef09ea4e96109c0592ec8e454e60ae
2019-04-12 19:43:17	svchosts.exe	90157f67f2b7e71bf0ffa985d0dad3c4
2019-04-12 19:43:35	svchosts.exe	3b476bf7a87c6ad76800c1ca964fdcab
2019-04-12 19:44:38	svchosts.exe	5d8300933b2c456063a0e9d2525da4f0
2019-04-12 19:44:46	svchosts.exe	d09e78a05bc979545aa0072c2e0228c4
2019-04-12 19:46:23	svchosts.exe	745eafcabba612c4be96957f9bde08e8
2019-04-12 19:46:35	svchosts.exe	266f71551e3b04d1c95209f371527afc
2019-04-12 19:46:44	svchosts.exe	389ca8b23a431c1e1c5963ce8ca4df25
2019-04-12 19:47:16	svchosts.exe	bca51d7c75c1f3a2410a9fb08b7fb11a
2019-04-12 19:48:04	svchosts.exe	283feb61f1e28c3fb121fe62e381844a
2019-04-12 19:48:08	svchosts.exe	f0e49865ccb5dfc694a517d26dd37d4d
2019-04-12 19:48:53	svchosts.exe	7e75c705498d397cd5320900bf7996cb
2019-04-12 19:49:10	svchosts.exe	6575472c664c57a5370dc770d8474498
2019-04-12 19:49:30	svchosts.exe	14788e0458a7a647a276233ac3dfce9f
2019-04-15 11:21:05	i.exe	72efce53674ad8207af18fc16dc159f5
2019-04-15 11:21:06	sv.exe	6b31a91d831065f08ed70e9d55ec1d98
2019-04-15 11:35:59	ConsoleApp1.exe	9cdfb4be0d593bb1d9c80d9735f65040
2019-04-15 12:09:04	install.exe	29ca9d583059495c031264e2b56f3dbb
2019-04-15 12:12:03	timeclean.exe	55f35bcfd36eeccbc66eae1d44f710af
2019-04-15 12:30:04	cleankombat2.exe	7ddaa9ee091c73e5b7e49a9fa52f88a8
2019-04-15 12:48:03	csrss.exe	a5eefe4b6362f6772eff4d4e9eb762f7
2019-04-15 18:33:04	wormclean.exe	7ecd069d8459f2adbe807f6cc1ac2ce0
2019-04-15 18:57:03	111.jpg	a7e7378e1c13ffcd9a0f1398ff147bb9
2019-04-15 20:39:03	20190410125938	fa4a414fafc8d6d2b5d8eac7aecbbfbc
2019-04-15 22:00:04	setup.exe	ecdd4613dffb8dba4c331e5493366feb
2019-04-15 22:27:04	service.exe	3a54e30efd41cedfa26d0ffd41a2b08a
2019-04-17 15:33:04	sockets.pif	044cbeed4c2a9c26fef4eb7560101cc6
2019-04-18 02:39:05	TT.exe	906aa26b2fabfab4c53c2b1ea53f4309
2019-04-21 05:24:06	sms.exe	487b0c9de7a17ccb35dc4673b486444a
2019-04-21 05:30:05	sl.exe	88e0ea38334d5b6d9353545e22a51621
2019-04-21 06:09:04	vnc.exe	d312ff15227b275800d0eb47b7fced4a
2019-04-21 15:36:04	aba.exe	e145d0267685dd91735857acd7b708ba
2019-04-23 18:00:06	RederictBind.exe	fcc248bdb9b56bdd926a13bbff61fadd
2019-04-28 05:09:07	bad-boy.exe	eff906a637ecbbf5b17c982ae48bfafc
2019-04-28 05:33:05	josh.exe	c9a560b2721b47ca68d577115cfa9d14
2019-04-28 05:48:04	PROTECTED.exe	66ec03a648bf0c5d2376bc947871c5ce
2019-04-29 03:33:04	hasa.exe	9c58424ea3c20cbac6ca0a20c316d2d1
2019-04-29 03:36:06	growtopia_gem_hack.exe	17d7de992ab0ae9d2acf51b82ba62f5d
2019-04-29 05:24:06	security_update.exe	70da2075ac350649f734b0d950c545ca
2019-04-29 08:57:12	synapse_3.0.0.exe	eb6e8318439c723186a8e1a9c017a3a8
2019-04-29 11:24:04	microsoft.exe	1902277f9e0065b54e92370b015070d2
2019-04-30 06:36:09	office1@rigin.exe	5e75042a64c328980048ef2d3810f0c4
2019-05-01 22:24:05	1.exe	6e8cd72f06e888779fe95f162abb5858
2019-05-02 01:54:03	80.exe	ab3338c54e7c9c6c3281d9c603371018
2019-05-02 02:30:03	9006.exe	952a93c0e4a9e9673b085d3f31a6750b
2019-05-03 06:00:09	doc_attached.exe	2fc34cf714906c34c046c52ab48785e7
2019-05-04 00:57:07	readme.exe	a5fca3c0bddc116eab6072c0c6c5b9f2
2019-05-04 01:03:06	ftp.exe	cbd4eefaa76d62fc469005250a506ed5
2019-05-04 01:06:05	read.exe	19f8534dd27ddea549c49a40a06631c9
2019-05-04 01:09:04	file.exe	ae5c37d8ca2f7bc82f360a391992aed6
2019-05-07 17:54:04	main.exe	53da76ddc6fe8e0a1f9a30c2ab29fdc4
2019-05-09 19:45:04	ylmwafqqohh.exe	5905a17da3a04fc4a1f3de2f6d9babe2
2019-05-10 03:45:02	wjiojt1sux3.exe	7f65debb41ebc0019cdc504010636f63
2019-05-14 05:03:09	demo.exe	58b82f6046af7142174639c87cc98049
2019-05-14 09:12:03	file.exe	acb54dd5b48a1e39f3e8bec5fa2d3645
2019-05-14 13:33:04	Lucion%20FileConvert%2010.1.0.20_Keygen[Shadow%20Mask].exe	cd042df973e6a6ab6f91d1b2749b3971
2019-05-15 15:42:06	bintu.exe	3ebbc221f2ae9bbc1be99240aaf206f0
2019-05-15 15:57:13	svshost.exe	1137352b9630eeb1fc19db6f8d08cde9
2019-05-18 10:03:09	batch-mp3-converter.exe	7e46364bee1ed52f9c03d379596bf3d2
2019-05-19 15:06:03	NetworkBrowser.exe	ae5b01b53c318c2fa988430dfddf0400
2019-05-20 09:51:08	serve21.exe	4af780f8a33e65f7ea0106022544c6c4
2019-05-20 14:54:04	serve.exe	a4ef742b98e058119168ce394c768d72
2019-05-20 15:12:07	power2.exe	963c74f6cb6ce4c0a2a6b6124a8d188c
2019-05-20 15:42:04	Smarts.jpg	868cff01ad6607cb29790c29797c78fa
2019-05-20 20:39:03	onetap.su_crack1.exe	cdaa68385861d602a46ec350cbcdfc36
2019-05-20 22:18:07	nokte.exe	1d7aea8c2d195ff0ace70a1e1dddac42
2019-05-22 09:54:03	echoload.exe	a607a1bf33fe2bb4ea542e7c5065a568
2019-05-23 21:18:03	setup.exe	f6e97d8efe91f07ea4d0eb99483a3d55
2019-05-25 00:42:05	Quasar.exe	78e2802f8cca7c8a810a17872c64996c
2019-05-25 04:21:04	sqlbrowser.exe	a122483546ea2e178c61cb6f0d34a0a2

#infosec #automation

TheSystem Itself @ 2018-09-27 04:09:13