API tools faq
paste
paladin316

rat_4d337a943af3dca618153ee4871a9e54_123_2019-07-31_04_30.txt

paladin316
Jul 31st, 2019
2,160
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 39.44 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Remcos"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "rat_4d337a943af3dca618153ee4871a9e54.123"
  7. * File Size: 1069056
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "07ccc471ea4c264b453c7d93746127d9d350490bf85c8c94a61b0ade40b44680"
  10. * MD5: "4d337a943af3dca618153ee4871a9e54"
  11. * SHA1: "d4795237363f569947ceaff39a464c827f5e862d"
  12. * SHA512: "400ac977131349755f1cf2fa9bb45ab0aa6253a52789414345a875c47fb18121679d6895ecc4837e607fba1e48d0edc73aaefd6357768a12a86ade3018fddbcf"
  13. * CRC32: "5543E738"
  14. * SSDEEP: "24576:jAHnh+eWsN3skA4RV1Hom2KXMmHaBtEvyDGL5:uh+ZkldoPK8YaBeUa"
  15.  
  16. * Process Execution:
  17. "rat_4d337a943af3dca618153ee4871a9e54.123",
  18. "rat_4d337a943af3dca618153ee4871a9e54.123",
  19. "wscript.exe",
  20. "cmd.exe",
  21. "WD.exe",
  22. "WD.exe",
  23. "svchost.exe",
  24. "svchost.exe",
  25. "svchost.exe",
  26. "svchost.exe",
  27. "svchost.exe",
  28. "svchost.exe",
  29. "svchost.exe",
  30. "svchost.exe",
  31. "svchost.exe",
  32. "svchost.exe",
  33. "svchost.exe",
  34. "svchost.exe",
  35. "svchost.exe",
  36. "svchost.exe",
  37. "svchost.exe",
  38. "svchost.exe",
  39. "svchost.exe",
  40. "svchost.exe",
  41. "svchost.exe",
  42. "svchost.exe",
  43. "svchost.exe",
  44. "svchost.exe",
  45. "svchost.exe",
  46. "svchost.exe",
  47. "svchost.exe",
  48. "svchost.exe",
  49. "svchost.exe",
  50. "svchost.exe",
  51. "svchost.exe",
  52. "svchost.exe",
  53. "svchost.exe",
  54. "svchost.exe",
  55. "svchost.exe",
  56. "svchost.exe",
  57. "svchost.exe",
  58. "svchost.exe",
  59. "svchost.exe",
  60. "svchost.exe",
  61. "svchost.exe",
  62. "svchost.exe",
  63. "svchost.exe",
  64. "svchost.exe",
  65. "svchost.exe",
  66. "svchost.exe",
  67. "svchost.exe",
  68. "svchost.exe",
  69. "svchost.exe",
  70. "svchost.exe",
  71. "svchost.exe",
  72. "svchost.exe",
  73. "svchost.exe",
  74. "svchost.exe",
  75. "dxdiag.exe",
  76. "svchost.exe",
  77. "svchost.exe",
  78. "WmiPrvSE.exe",
  79. "svchost.exe"
  80.  
  81.  
  82. * Executed Commands:
  83. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs\"",
  84. "C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs ",
  85. "\"C:\\Windows\\System32\\cmd.exe\" /c \"C:\\Users\\user\\KB7645475\\WD.exe\"",
  86. "cmd /c \"C:\\Users\\user\\KB7645475\\WD.exe\"",
  87. "C:\\Users\\user\\KB7645475\\WD.exe",
  88. "C:\\Windows\\SysWOW64\\svchost.exe",
  89. "\"C:\\Windows\\System32\\dxdiag.exe\" /t C:\\Users\\user\\AppData\\Local\\Temp\\sysinfo.txt",
  90. "dxdiag /t C:\\Users\\user\\AppData\\Local\\Temp\\sysinfo.txt",
  91. "C:\\Users\\user\\KB7645475\\WD.exe /stext \"C:\\Users\\user\\AppData\\Local\\Temp\\okhxppaymlphkx\"",
  92. "C:\\Users\\user\\KB7645475\\WD.exe /stext \"C:\\Users\\user\\AppData\\Local\\Temp\\zmnqphlrathlmdqbz\"",
  93. "C:\\Users\\user\\KB7645475\\WD.exe /stext \"C:\\Users\\user\\AppData\\Local\\Temp\\bgaaiavtobzywrfnjpes\"",
  94. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
  95.  
  96.  
  97. * Signatures Detected:
  98.  
  99. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  100. "Details":
  101.  
  102. "IP": "184.28.188.193:80"
  103.  
  104.  
  105.  
  106.  
  107. "Description": "Creates RWX memory",
  108. "Details":
  109.  
  110.  
  111. "Description": "Detected script timer window indicative of sleep style evasion",
  112. "Details":
  113.  
  114. "Window": "WSH-Timer"
  115.  
  116.  
  117.  
  118.  
  119. "Description": "A process attempted to delay the analysis task.",
  120. "Details":
  121.  
  122. "Process": "WmiPrvSE.exe tried to sleep 601 seconds, actually delayed analysis time by 0 seconds"
  123.  
  124.  
  125. "Process": "WD.exe tried to sleep 1710 seconds, actually delayed analysis time by 0 seconds"
  126.  
  127.  
  128. "Process": "dxdiag.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  129.  
  130.  
  131.  
  132.  
  133. "Description": "Reads data out of its own binary image",
  134. "Details":
  135.  
  136. "self_read": "process: wscript.exe, pid: 1276, offset: 0x00000000, length: 0x00000040"
  137.  
  138.  
  139. "self_read": "process: wscript.exe, pid: 1276, offset: 0x000000f0, length: 0x00000018"
  140.  
  141.  
  142. "self_read": "process: wscript.exe, pid: 1276, offset: 0x000001e8, length: 0x00000078"
  143.  
  144.  
  145. "self_read": "process: wscript.exe, pid: 1276, offset: 0x00018000, length: 0x00000020"
  146.  
  147.  
  148. "self_read": "process: wscript.exe, pid: 1276, offset: 0x00018058, length: 0x00000018"
  149.  
  150.  
  151. "self_read": "process: wscript.exe, pid: 1276, offset: 0x000181a8, length: 0x00000018"
  152.  
  153.  
  154. "self_read": "process: wscript.exe, pid: 1276, offset: 0x00018470, length: 0x00000010"
  155.  
  156.  
  157. "self_read": "process: wscript.exe, pid: 1276, offset: 0x00018640, length: 0x00000012"
  158.  
  159.  
  160. "self_read": "process: WD.exe, pid: 2932, offset: 0x00000000, length: 0x00105000"
  161.  
  162.  
  163. "self_read": "process: dxdiag.exe, pid: 3552, offset: 0x00000000, length: 0x00000040"
  164.  
  165.  
  166. "self_read": "process: dxdiag.exe, pid: 3552, offset: 0x000000e0, length: 0x000000f8"
  167.  
  168.  
  169.  
  170.  
  171. "Description": "A process created a hidden window",
  172. "Details":
  173.  
  174. "Process": "rat_4d337a943af3dca618153ee4871a9e54.123 -> C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs"
  175.  
  176.  
  177. "Process": "wscript.exe -> cmd"
  178.  
  179.  
  180. "Process": "WD.exe -> dxdiag"
  181.  
  182.  
  183.  
  184.  
  185. "Description": "Drops a binary and executes it",
  186. "Details":
  187.  
  188. "binary": "C:\\Users\\user\\KB7645475\\WD.exe"
  189.  
  190.  
  191.  
  192.  
  193. "Description": "The binary likely contains encrypted or compressed data.",
  194. "Details":
  195.  
  196. "section": "name: .rsrc, entropy: 7.25, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0003aa00, virtual_size: 0x0003a840"
  197.  
  198.  
  199.  
  200.  
  201. "Description": "Executed a process and injected code into it, probably while unpacking",
  202. "Details":
  203.  
  204. "Injection": "rat_4d337a943af3dca618153ee4871a9e54.123(2000) -> rat_4d337a943af3dca618153ee4871a9e54.123(2016)"
  205.  
  206.  
  207.  
  208.  
  209. "Description": "Sniffs keystrokes",
  210. "Details":
  211.  
  212. "SetWindowsHookExA": "Process: WD.exe(2932)"
  213.  
  214.  
  215.  
  216.  
  217. "Description": "Queries information on disks, possibly for anti-virtualization",
  218. "Details":
  219.  
  220.  
  221. "Description": "Installs itself for autorun at Windows startup",
  222. "Details":
  223.  
  224. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\KB7645475"
  225.  
  226.  
  227. "data": "\"C:\\Users\\user\\KB7645475\\WD.exe\""
  228.  
  229.  
  230.  
  231.  
  232. "Description": "File has been identified by 16 Antiviruses on VirusTotal as malicious",
  233. "Details":
  234.  
  235. "K7GW": "Trojan ( 700000111 )"
  236.  
  237.  
  238. "K7AntiVirus": "Trojan ( 700000111 )"
  239.  
  240.  
  241. "APEX": "Malicious"
  242.  
  243.  
  244. "Rising": "Trojan.Win32.Agent.jxu (CLASSIC)"
  245.  
  246.  
  247. "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.th"
  248.  
  249.  
  250. "SentinelOne": "DFI - Suspicious PE"
  251.  
  252.  
  253. "Antiy-AVL": "GrayWare/Autoit.RunPE.a"
  254.  
  255.  
  256. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  257.  
  258.  
  259. "Endgame": "malicious (high confidence)"
  260.  
  261.  
  262. "AhnLab-V3": "Trojan/Win32.RL_AutoInj.R272810"
  263.  
  264.  
  265. "Acronis": "suspicious"
  266.  
  267.  
  268. "ESET-NOD32": "a variant of Win32/Injector.Autoit.EEF"
  269.  
  270.  
  271. "Fortinet": "AutoIt/Injector.EEF!tr"
  272.  
  273.  
  274. "Paloalto": "generic.ml"
  275.  
  276.  
  277. "CrowdStrike": "win/malicious_confidence_60% (D)"
  278.  
  279.  
  280. "Qihoo-360": "HEUR/QVM10.1.E217.Malware.Gen"
  281.  
  282.  
  283.  
  284.  
  285. "Description": "Checks the version of Bios, possibly for anti-virtualization",
  286. "Details":
  287.  
  288.  
  289. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  290. "Details":
  291.  
  292.  
  293. "Description": "Detects VirtualBox through the presence of a file",
  294. "Details":
  295.  
  296. "file": "C:\\Windows\\sysnative\\VBoxDisp.dll"
  297.  
  298.  
  299. "file": "C:\\Windows\\System32\\VBoxDisp.dll"
  300.  
  301.  
  302.  
  303.  
  304. "Description": "Creates a copy of itself",
  305. "Details":
  306.  
  307. "copy": "C:\\Users\\user\\KB7645475\\WD.exe"
  308.  
  309.  
  310.  
  311.  
  312. "Description": "Attempts to interact with an Alternate Data Stream (ADS)",
  313. "Details":
  314.  
  315. "file": "C:\\$Extend\\$Quota:$Q:$INDEX_ALLOCATION"
  316.  
  317.  
  318.  
  319.  
  320. "Description": "Collects information to fingerprint the system",
  321. "Details":
  322.  
  323.  
  324. "Description": "Anomalous binary characteristics",
  325. "Details":
  326.  
  327. "anomaly": "Actual checksum does not match that reported in PE header"
  328.  
  329.  
  330.  
  331.  
  332.  
  333. * Started Service:
  334.  
  335. * Mutexes:
  336. "Remcos_Mutex_Inj",
  337. "KB76917475-3EGYZ2",
  338. "Local\\ZoneAttributeCacheCounterMutex",
  339. "Local\\ZonesCacheCounterMutex",
  340. "Local\\ZonesLockedCacheCounterMutex",
  341. "Mutex_RemWatchdog",
  342. "Local\\__DDrawExclMode__",
  343. "Local\\__DDrawCheckExclMode__",
  344. "Local\\DDrawWindowListMutex",
  345. "Local\\DDrawDriverObjectListMutex",
  346. "DirectSound Administrator shared thread array (lock)",
  347. "DirectInput.89521361-AA8A-11CF-BFC7-444553540000",
  348. "DirectInput.5944E682-C92E-11CF-BFC7-444553540000",
  349. "DSKQUOTA_SIDCACHE_MUTEX"
  350.  
  351.  
  352. * Modified Files:
  353. "C:\\Users\\user\\KB7645475\\WD.exe",
  354. "C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs",
  355. "C:\\Users\\user\\AppData\\Roaming\\KB7645475\\logs.dat",
  356. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  357. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  358. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B8CC409ACDBF2A2FE04C56F2875B1FD6",
  359. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B8CC409ACDBF2A2FE04C56F2875B1FD6",
  360. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3FBB.tmp",
  361. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3FBC.tmp",
  362. "C:\\Windows\\inf\\setupapi.app.log",
  363. "\\??\\root#system#0000#0a4252a0-7e70-11d0-a5d6-28db04c10000\\cfd669f1-9bc2-11d0-8299-0000f822fe8a&0a4252a0-7e70-11d0-a5d6-28db04c10000",
  364. "\\??\\root#system#0000#3c0d501a-140b-11d1-b40f-00a0c9223196\\96e080c7-143c-11d1-b40f-00a0c9223196&3c0d501a-140b-11d1-b40f-00a0c9223196",
  365. "\\??\\hdaudio#func_01&ven_8384&dev_7680&subsys_83847680&rev_1034#4&31e60982&0&0001#65e8773d-8f56-11d0-a3b9-00a0c9223196\\emicinwave",
  366. "\\??\\hdaudio#func_01&ven_8384&dev_7680&subsys_83847680&rev_1034#4&31e60982&0&0001#65e8773e-8f56-11d0-a3b9-00a0c9223196\\espeakerwave",
  367. "\\??\\root#system#0000#cf1dda2c-9743-11d0-a3ee-00a0c9223196\\cfd669f1-9bc2-11d0-8299-0000f822fe8a&cf1dda2c-9743-11d0-a3ee-00a0c9223196",
  368. "C:\\Users\\user\\AppData\\Local\\Temp\\sysinfo.txt",
  369. "\\??\\PIPE\\samr",
  370. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  371. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  372. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  373. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  374. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  375. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  376. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  377. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  378. "\\??\\WMIDataDevice",
  379. "\\??\\PIPE\\lsarpc",
  380. "\\??\\PIPE\\srvsvc",
  381. "C:\\$Extend\\$Quota:$Q:$INDEX_ALLOCATION",
  382. "\\??\\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#5&2117b2e5&0&1.0.0#53f56308-b6bf-11d0-94f2-00a0c91efb8b",
  383. "C:\\Windows\\sysnative\\drivers\\cdrom.sys"
  384.  
  385.  
  386. * Deleted Files:
  387. "C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs",
  388. "C:\\Users\\user\\AppData\\Local\\Temp\\sysinfo.txt",
  389. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3FBB.tmp",
  390. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3FBC.tmp"
  391.  
  392.  
  393. * Modified Registry Keys:
  394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\KB7645475",
  395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  397. "HKEY_CURRENT_USER\\Software\\KB76917475-3EGYZ2\\",
  398. "HKEY_CURRENT_USER\\Software\\KB76917475-3EGYZ2\\exepath",
  399. "HKEY_CURRENT_USER\\Software\\KB76917475-3EGYZ2\\licence",
  400. "HKEY_CURRENT_USER\\Software\\KB76917475-3EGYZ2\\WD",
  401. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
  402. "HKEY_CLASSES_ROOT\\DxDiag.DxDiagClassObject.1",
  403. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\DxDiag.DxDiagClassObject.1\\(Default)",
  404. "HKEY_CLASSES_ROOT\\DxDiag.DxDiagClassObject.1\\CLSID",
  405. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\DxDiag.DxDiagClassObject.1\\CLSID\\(Default)",
  406. "HKEY_CLASSES_ROOT\\DxDiag.DxDiagClassObject",
  407. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\DxDiag.DxDiagClassObject\\(Default)",
  408. "HKEY_CLASSES_ROOT\\DxDiag.DxDiagClassObject\\CLSID",
  409. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\DxDiag.DxDiagClassObject\\CLSID\\(Default)",
  410. "HKEY_CLASSES_ROOT\\DxDiag.DxDiagClassObject\\CurVer",
  411. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\DxDiag.DxDiagClassObject\\CurVer\\(Default)",
  412. "HKEY_CLASSES_ROOT\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B",
  413. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\(Default)",
  414. "HKEY_CLASSES_ROOT\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\ProgID",
  415. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\ProgID\\(Default)",
  416. "HKEY_CLASSES_ROOT\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\VersionIndependentProgID",
  417. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\VersionIndependentProgID\\(Default)",
  418. "HKEY_CLASSES_ROOT\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\ForceRemove",
  419. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\ForceRemove\\(Default)",
  420. "HKEY_CLASSES_ROOT\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\InprocServer32",
  421. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\InprocServer32\\(Default)",
  422. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B\\InprocServer32\\ThreadingModel",
  423. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\DxDiag.DxDiagProvider.1\\(Default)",
  424. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\DxDiag.DxDiagProvider\\(Default)",
  425. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\DxDiag.DxDiagProvider\\CurVer\\(Default)",
  426. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool",
  427. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In SystemInfo",
  428. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In DirectDraw",
  429. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In DirectSound",
  430. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\DirectDraw\\MostRecentApplication\\Name",
  431. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\DirectDraw\\MostRecentApplication\\ID",
  432. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MediaResources\\DirectSound\\",
  433. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MediaResources\\DirectSound\\Speaker Configuration",
  434. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MediaResources\\DirectSound\\Speaker Configuration\\Speaker Configuration",
  435. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  436. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In DirectInput",
  437. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectInput",
  438. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectInput\\DXDIAG.EXE4A5BC31000040A00",
  439. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectInput\\DXDIAG.EXE4A5BC31000040A00\\Name",
  440. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectInput\\DXDIAG.EXE4A5BC31000040A00\\UsesMapper",
  441. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectInput\\MostRecentApplication",
  442. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectInput\\MostRecentApplication\\Name",
  443. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectInput\\MostRecentApplication\\Id",
  444. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectInput\\MostRecentApplication\\Version",
  445. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectInput\\MostRecentApplication\\MostRecentStart",
  446. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In DirectShow",
  447. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86",
  448. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\mrle",
  449. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\mrle\\FriendlyName",
  450. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\mrle\\CLSID",
  451. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\mrle\\FilterData",
  452. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\mrle\\FccHandler",
  453. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\mrle\\ClassManagerFlags",
  454. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\msvc",
  455. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\msvc\\FriendlyName",
  456. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\msvc\\CLSID",
  457. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\msvc\\FilterData",
  458. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\msvc\\FccHandler",
  459. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\msvc\\ClassManagerFlags",
  460. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\uyvy",
  461. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\uyvy\\FriendlyName",
  462. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\uyvy\\CLSID",
  463. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\uyvy\\FilterData",
  464. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\uyvy\\FccHandler",
  465. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\uyvy\\ClassManagerFlags",
  466. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yuy2",
  467. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yuy2\\FriendlyName",
  468. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yuy2\\CLSID",
  469. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yuy2\\FilterData",
  470. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yuy2\\FccHandler",
  471. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yuy2\\ClassManagerFlags",
  472. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvyu",
  473. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvyu\\FriendlyName",
  474. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvyu\\CLSID",
  475. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvyu\\FilterData",
  476. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvyu\\FccHandler",
  477. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvyu\\ClassManagerFlags",
  478. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\iyuv",
  479. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\iyuv\\FriendlyName",
  480. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\iyuv\\CLSID",
  481. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\iyuv\\FilterData",
  482. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\iyuv\\FccHandler",
  483. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\iyuv\\ClassManagerFlags",
  484. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\i420",
  485. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\i420\\FriendlyName",
  486. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\i420\\CLSID",
  487. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\i420\\FilterData",
  488. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\i420\\FccHandler",
  489. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\i420\\ClassManagerFlags",
  490. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvu9",
  491. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvu9\\FriendlyName",
  492. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvu9\\CLSID",
  493. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvu9\\FilterData",
  494. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvu9\\FccHandler",
  495. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\yvu9\\ClassManagerFlags",
  496. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\cvid",
  497. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\cvid\\FriendlyName",
  498. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\cvid\\CLSID",
  499. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\cvid\\FilterData",
  500. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\cvid\\FccHandler",
  501. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A760-90C8-11D0-BD43-00A0C911CE86\\cvid\\ClassManagerFlags",
  502. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\AudioCompressionManager\\DriverCache",
  503. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.imaadpcm",
  504. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.imaadpcm\\fdwSupport",
  505. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.imaadpcm\\cFormatTags",
  506. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.imaadpcm\\aFormatTagCache",
  507. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.imaadpcm\\cFilterTags",
  508. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msg711",
  509. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msg711\\fdwSupport",
  510. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msg711\\cFormatTags",
  511. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msg711\\aFormatTagCache",
  512. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msg711\\cFilterTags",
  513. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msgsm610",
  514. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msgsm610\\fdwSupport",
  515. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msgsm610\\cFormatTags",
  516. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msgsm610\\aFormatTagCache",
  517. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msgsm610\\cFilterTags",
  518. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msadpcm",
  519. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msadpcm\\fdwSupport",
  520. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msadpcm\\cFormatTags",
  521. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msadpcm\\aFormatTagCache",
  522. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\AudioCompressionManager\\DriverCache\\msacm.msadpcm\\cFilterTags",
  523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Multimedia\\Audio Compression Manager\\",
  524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Multimedia\\Audio Compression Manager\\MSACM",
  525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Multimedia\\Audio Compression Manager\\Priority v4.00",
  526. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86",
  527. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\1PCM",
  528. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\1PCM\\FriendlyName",
  529. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\1PCM\\CLSID",
  530. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\1PCM\\FilterData",
  531. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\1PCM\\AcmId",
  532. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\17IMA ADPCM",
  533. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\17IMA ADPCM\\FriendlyName",
  534. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\17IMA ADPCM\\CLSID",
  535. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\17IMA ADPCM\\FilterData",
  536. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\17IMA ADPCM\\AcmId",
  537. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\6CCITT A-Law",
  538. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\6CCITT A-Law\\FriendlyName",
  539. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\6CCITT A-Law\\CLSID",
  540. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\6CCITT A-Law\\FilterData",
  541. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\6CCITT A-Law\\AcmId",
  542. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\7CCITT u-Law",
  543. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\7CCITT u-Law\\FriendlyName",
  544. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\7CCITT u-Law\\CLSID",
  545. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\7CCITT u-Law\\FilterData",
  546. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\7CCITT u-Law\\AcmId",
  547. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\49GSM 6.10",
  548. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\49GSM 6.10\\FriendlyName",
  549. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\49GSM 6.10\\CLSID",
  550. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\49GSM 6.10\\FilterData",
  551. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\49GSM 6.10\\AcmId",
  552. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\2Microsoft ADPCM",
  553. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\2Microsoft ADPCM\\FriendlyName",
  554. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\2Microsoft ADPCM\\CLSID",
  555. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\2Microsoft ADPCM\\FilterData",
  556. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A761-90C8-11D0-BD43-00A0C911CE86\\2Microsoft ADPCM\\AcmId",
  557. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A762-90C8-11D0-BD43-00A0C911CE86",
  558. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A762-90C8-11D0-BD43-00A0C911CE86\\Microphone (High Definition Aud",
  559. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A762-90C8-11D0-BD43-00A0C911CE86\\Microphone (High Definition Aud\\FriendlyName",
  560. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A762-90C8-11D0-BD43-00A0C911CE86\\Microphone (High Definition Aud\\CLSID",
  561. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A762-90C8-11D0-BD43-00A0C911CE86\\Microphone (High Definition Aud\\FilterData",
  562. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A762-90C8-11D0-BD43-00A0C911CE86\\Microphone (High Definition Aud\\WaveInId",
  563. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\33D9A762-90C8-11D0-BD43-00A0C911CE86\\Microphone (High Definition Aud\\ClassManagerFlags",
  564. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B",
  565. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Microsoft GS Wavetable Synth",
  566. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Microsoft GS Wavetable Synth\\FriendlyName",
  567. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Microsoft GS Wavetable Synth\\CLSID",
  568. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Microsoft GS Wavetable Synth\\FilterData",
  569. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Microsoft GS Wavetable Synth\\MidiOutId",
  570. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Default MidiOut Device",
  571. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Default MidiOut Device\\FriendlyName",
  572. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Default MidiOut Device\\CLSID",
  573. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Default MidiOut Device\\FilterData",
  574. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\4EFE2452-168A-11D1-BC76-00C04FB9453B\\Default MidiOut Device\\MidiOutId",
  575. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86",
  576. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Speakers (High Definition Audio",
  577. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Speakers (High Definition Audio\\FriendlyName",
  578. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Speakers (High Definition Audio\\CLSID",
  579. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Speakers (High Definition Audio\\FilterData",
  580. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Speakers (High Definition Audio\\WaveOutId",
  581. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Speakers (High Definition Audio\\ClassManagerFlags",
  582. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default WaveOut Device",
  583. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default WaveOut Device\\FriendlyName",
  584. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default WaveOut Device\\CLSID",
  585. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default WaveOut Device\\FilterData",
  586. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default WaveOut Device\\WaveOutId",
  587. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\DirectSound: Speakers (High Definition Audio Device)",
  588. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\DirectSound: Speakers (High Definition Audio Device)\\FriendlyName",
  589. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\DirectSound: Speakers (High Definition Audio Device)\\CLSID",
  590. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\DirectSound: Speakers (High Definition Audio Device)\\FilterData",
  591. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\DirectSound: Speakers (High Definition Audio Device)\\DSGuid",
  592. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default DirectSound Device",
  593. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default DirectSound Device\\FriendlyName",
  594. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default DirectSound Device\\CLSID",
  595. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default DirectSound Device\\FilterData",
  596. "HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\E0F158E1-CB04-11D0-BD4E-00A0C911CE86\\Default DirectSound Device\\DSGuid",
  597. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  598. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  599. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  600. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  601. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  602. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  603. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  604. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
  605.  
  606.  
  607. * Deleted Registry Keys:
  608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  609. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  611. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  612. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In SystemInfo",
  613. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In DirectDraw",
  614. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In DirectSound",
  615. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In DirectInput",
  616. "HKEY_CURRENT_USER\\Software\\Microsoft\\DirectX Diagnostic Tool\\DxDiag In DirectShow"
  617.  
  618.  
  619. * DNS Communications:
  620.  
  621. "type": "A",
  622. "request": "2d0low.warzonedns.com",
  623. "answers":
  624.  
  625. "data": "185.165.153.108",
  626. "type": "A"
  627.  
  628.  
  629.  
  630.  
  631.  
  632. * Domains:
  633.  
  634. "ip": "185.165.153.108",
  635. "domain": "2d0low.warzonedns.com"
  636.  
  637.  
  638.  
  639. * Network Communication - ICMP:
  640.  
  641. * Network Communication - HTTP:
  642.  
  643. "count": 1,
  644. "body": "",
  645. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  646. "user-agent": "Microsoft-CryptoAPI/6.1",
  647. "method": "GET",
  648. "host": "crl.microsoft.com",
  649. "version": "1.1",
  650. "path": "/pki/crl/products/microsoftrootcert.crl",
  651. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  652. "port": 80
  653.  
  654.  
  655. "count": 1,
  656. "body": "",
  657. "uri": "http://crl.microsoft.com/pki/crl/products/WinPCA.crl",
  658. "user-agent": "Microsoft-CryptoAPI/6.1",
  659. "method": "GET",
  660. "host": "crl.microsoft.com",
  661. "version": "1.1",
  662. "path": "/pki/crl/products/WinPCA.crl",
  663. "data": "GET /pki/crl/products/WinPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  664. "port": 80
  665.  
  666.  
  667.  
  668. * Network Communication - SMTP:
  669.  
  670. * Network Communication - Hosts:
  671.  
  672. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!