GreyEnergy IOCs

GreyEnergy IOCs

Лише певні антивіруси можуть виявити віруси сімейства GreyEnergy. Red & Blue Team провели аналіз відомих нам зразків та ділимося з вами IOC-ми цього небезпечного сімейства.

GreyEnergy Mini

Зразок №1

Назва файлу: WSTDECOD

Статичні данні зразка:
MD5: 9f5309b5960b00f9dc75c6d544b454d2
SHA-1: cb11f36e271306354998bb8abb6ca67c1d6a3e24
SHA-256: 7e154d5be14560b8b2c16969effdb8417559758711b05615513d1c84e56be076
File type: Win32 DLL
File size: 49.5 KB (50688 bytes)

Також зустрічався з наступними назвами:

  • WSTDECOD.DLL
  • {9A7AA2C3-CED8-4C0B-B41B-604BF6BFAED5}.db
  • 9f5309b5960b00f9dc75c6d544b454d2.virus

Зразок №2

Назва файлу: d4e97a18be820a1a3af639c9bca21c5f85a3f49a37275b37fd012faeffcb7c4a.bin

Статичні данні зразка:
MD5: 73676711f838906a9a64e6528e0481f6
SHA-1: 51309371673acd310f327a10476f707eb914e255
SHA-256: d4e97a18be820a1a3af639c9bca21c5f85a3f49a37275b37fd012faeffcb7c4a
File type: Win32 EXE
File size: 116 KB (118784 bytes)

Також зустрічався з наступними назвами:

  • 73676711f838906a9a64e6528e0481f6.vir
  • favicon.ico
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{FA17E5EB-9499-4985-85A4-F12974C2E25E}.db
  • C:\Documents and Settings\Administrator\Application Data\ .lnk
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{99FE2AB5-9CEF-4943-88C0-BF0304C31D06}.db
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{AB5E27DE-E03B-43D5-91B4-CA3E010A2FC6}.db
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{B06351A8-FF67-4882-9DFE-1941772BA07D}.db
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{79805CB7-150E-45BD-B0BA-F7D65B414375}.db
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{C8F19483-2C1A-4295-90E9-A7B3D36CCF97}.db
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{2CF59D31-3F6D-4D6A-A892-4139B8495E10}.db
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{BA87AF86-716B-47D1-B8BC-C4F993AD42E8}.db
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{B5FD6FEF-9B1E-47C6-ADD8-36B1FE97D584}.db
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{97C5B72A-0A51-4096-AB40-CB0DF0B97591}.db

Permissions Requested

  • SE_LOAD_DRIVER_PRIVILEGE

Processes Created

  • C:\WINDOWS\system32\cmd.exe
  • C:\WINDOWS\system32\rundll32.exe
  • C:\WINDOWS\system32\ping.exe

Shell Commands

  • “C:\WINDOWS\system32\cmd.exe” /c move “C:\Documents and Settings\Administrator\Application Data\ .lnk” “C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\ .lnk”
  • “C:\WINDOWS\System32\rundll32.exe” {FA17E5EB-9499-4985-85A4-F12974C2E25E}.db, #1 #1
  • “C:\WINDOWS\system32\cmd.exe” /c (ping localhost >> nul & del C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\EB93A6\996E.exe >> nul)
  • ping localhost
  • “C:\WINDOWS\System32\rundll32.exe” {99FE2AB5-9CEF-4943-88C0-BF0304C31D06}.db, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {AB5E27DE-E03B-43D5-91B4-CA3E010A2FC6}.db, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {B06351A8-FF67-4882-9DFE-1941772BA07D}.db, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {79805CB7-150E-45BD-B0BA-F7D65B414375}.db, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {C8F19483-2C1A-4295-90E9-A7B3D36CCF97}.db, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {2CF59D31-3F6D-4D6A-A892-4139B8495E10}.db, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {BA87AF86-716B-47D1-B8BC-C4F993AD42E8}.db, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {B5FD6FEF-9B1E-47C6-ADD8-36B1FE97D584}.db, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {97C5B72A-0A51-4096-AB40-CB0DF0B97591}.db, #1 #1

Registry Keys Opened

  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe
  • \Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WTSAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KERNEL32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSAPI.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winime32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USP10.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LPK.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMRes.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLBCATQ.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsp2res.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\actxprxy.dll
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoInternetIcon
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoControlPanel
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoSetFolders
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll
  • \Registry\Machine\Software\Policies\Microsoft\System\DNSclient
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Documents
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Desktop
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500_CLASSES\.exe
  • \Registry\Machine\Software\Classes\.exe
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500_Classes\.exe
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LINKINFO.dll
  • \REGISTRY\MACHINE\SOFTWARE\Classes\Network\SharingHandler\
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ATL.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local Settings
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\System
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntshrui.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common AppData
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\My Pictures
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonPictures
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonMusic
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonVideo
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\urlmon.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cookies
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500_Classes\exefile\shell\open\command
  • \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\command
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\RestrictRun
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\Levels
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\SaferFlags
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\SaferFlags
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\DefaultLevel
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\PolicyScope
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\LogFileName
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\System
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{FA17E5EB-9499-4985-85A4-F12974C2E25E}.db
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\RpcThreadPoolThrottle
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe
  • \REGISTRY\MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\WinSock_Registry_Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Serial_Access_Num
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\00000007
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Next_Catalog_Entry_ID
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Num_Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Serial_Access_Num
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\00000004
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Num_Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\StoresServiceClassInfo
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\StoresServiceClassInfo
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\StoresServiceClassInfo
  • \REGISTRY\MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Ws2_32NumHandleBuckets
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Ws2_32SpinCount
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Winsock\Parameters\Transports
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Winsock\HelperDllName
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASN1.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CRYPT32.dll
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM\Ime File
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{99FE2AB5-9CEF-4943-88C0-BF0304C31D06}.db
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{AB5E27DE-E03B-43D5-91B4-CA3E010A2FC6}.db
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{B06351A8-FF67-4882-9DFE-1941772BA07D}.db
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{79805CB7-150E-45BD-B0BA-F7D65B414375}.db
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{C8F19483-2C1A-4295-90E9-A7B3D36CCF97}.db
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{2CF59D31-3F6D-4D6A-A892-4139B8495E10}.db
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{BA87AF86-716B-47D1-B8BC-C4F993AD42E8}.db
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{B5FD6FEF-9B1E-47C6-ADD8-36B1FE97D584}.db
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{97C5B72A-0A51-4096-AB40-CB0DF0B97591}.db

Зразок №3

Назва файлу: (1)01.exe

Статичні данні зразка:
MD5: 1cb35f4340a37e75aff1f901629b59f3
SHA-1: cc1ce3073937552459fb8ed0adb5d56fa00bcd43
SHA-256: b60c0c04badc8c5defab653c581d57505b3455817b57ee70af74311fa0b65e22
File type: Win32 EXE
File size: 116.5 KB (119299 bytes)

Також зустрічався з наступними назвами:

  • 18.exe
  • 01.exe
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{1F5CE9E9-FF70-4A88-A3D4-7FE8B293C3BF}.dbf
  • C:\Documents and Settings\Administrator\Application Data\ .lnk
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{17CBDA6E-B416-4476-9177-F5061146956B}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{A4F6A555-7CAA-4FCE-83D0-C570EAE453C3}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{B3C830CB-BFF7-4F2A-9AD6-22FA8155BE99}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{28ABF007-234D-487E-9A65-B2017C652CC7}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{0640DC04-94B8-494E-A689-E5DDEB254B61}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{7FF79022-79AE-4031-9BDE-22483A4A8D2A}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{342CA566-CDCE-4771-8306-0114D96DF56F}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{B6FA0E48-103D-4B46-BFE4-B67087839C30}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{5C4145FA-9F96-42AC-80D3-A0CF780A9228}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{B2E45CDA-4526-4E7D-9719-89463391C43D}.dbf

Permissions Requested

  • SE_LOAD_DRIVER_PRIVILEGE

Processes Created

  • C:\WINDOWS\system32\cmd.exe
  • C:\WINDOWS\system32\rundll32.exe
  • C:\WINDOWS\system32\ping.exe

Shell Commands

  • “C:\WINDOWS\system32\cmd.exe” /c move “C:\Documents and Settings\Administrator\Application Data\ .lnk” “C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\ .lnk”
  • “C:\WINDOWS\System32\rundll32.exe” {1F5CE9E9-FF70-4A88-A3D4-7FE8B293C3BF}.dbf, #1 #1
  • “C:\WINDOWS\system32\cmd.exe” /c (ping localhost >> nul & del C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\EB93A6\996E.exe >> nul)
  • ping localhost
  • “C:\WINDOWS\System32\rundll32.exe” {17CBDA6E-B416-4476-9177-F5061146956B}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {A4F6A555-7CAA-4FCE-83D0-C570EAE453C3}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {B3C830CB-BFF7-4F2A-9AD6-22FA8155BE99}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {28ABF007-234D-487E-9A65-B2017C652CC7}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {0640DC04-94B8-494E-A689-E5DDEB254B61}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {7FF79022-79AE-4031-9BDE-22483A4A8D2A}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {342CA566-CDCE-4771-8306-0114D96DF56F}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {B6FA0E48-103D-4B46-BFE4-B67087839C30}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {5C4145FA-9F96-42AC-80D3-A0CF780A9228}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {B2E45CDA-4526-4E7D-9719-89463391C43D}.dbf, #1 #1

Registry Keys Opened

  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe
  • \Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WTSAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KERNEL32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSAPI.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winime32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USP10.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LPK.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMRes.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLBCATQ.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsp2res.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\actxprxy.dll
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoInternetIcon
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoControlPanel
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoSetFolders
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll
  • \Registry\Machine\Software\Policies\Microsoft\System\DNSclient
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Documents
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Desktop
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500_CLASSES\.exe
  • \Registry\Machine\Software\Classes\.exe
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500_Classes\.exe
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LINKINFO.dll
  • \REGISTRY\MACHINE\SOFTWARE\Classes\Network\SharingHandler\
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ATL.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local Settings
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\System
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntshrui.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common AppData
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\My Pictures
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonPictures
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonMusic
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonVideo
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\urlmon.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cookies
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500_Classes\exefile\shell\open\command
  • \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\command
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\RestrictRun
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\Levels
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\SaferFlags
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\SaferFlags
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\DefaultLevel
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\PolicyScope
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\LogFileName
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\System
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\RpcThreadPoolThrottle
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{1F5CE9E9-FF70-4A88-A3D4-7FE8B293C3BF}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe
  • \REGISTRY\MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\WinSock_Registry_Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Serial_Access_Num
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\00000007
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Next_Catalog_Entry_ID
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Num_Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Serial_Access_Num
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\00000004
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Num_Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\StoresServiceClassInfo
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\StoresServiceClassInfo
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\StoresServiceClassInfo
  • \REGISTRY\MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Ws2_32NumHandleBuckets
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Ws2_32SpinCount
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Winsock\Parameters\Transports
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Winsock\HelperDllName
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASN1.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CRYPT32.dll
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM\Ime File
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{17CBDA6E-B416-4476-9177-F5061146956B}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{A4F6A555-7CAA-4FCE-83D0-C570EAE453C3}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{B3C830CB-BFF7-4F2A-9AD6-22FA8155BE99}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{28ABF007-234D-487E-9A65-B2017C652CC7}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{0640DC04-94B8-494E-A689-E5DDEB254B61}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{7FF79022-79AE-4031-9BDE-22483A4A8D2A}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{342CA566-CDCE-4771-8306-0114D96DF56F}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{B6FA0E48-103D-4B46-BFE4-B67087839C30}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{5C4145FA-9F96-42AC-80D3-A0CF780A9228}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{B2E45CDA-4526-4E7D-9719-89463391C43D}.dbf

Зразок №4

Назва файлу: WSTDECOD

Статичні данні зразка:
MD5: 92f63b1227a6b37335495f9bcb939ea2

SHA-1: 30af51f1f7cb9a9a46df3abffb6ae3e39935d82c
SHA-256: c2d06ad0211c24f36978fe34d25b0018ffc0f22b0c74fd1f915c608bf2cfad15
File type: Win32 DLL
File size: 49.5 KB (50688 bytes)

Також зустрічався з наступними назвами:

  • WSTDECOD.DLL
  • {F9564F63-32B9-4377-B753-CC650B81EC3A}.dbf
  • {3F9B277E-0522-4B2C-9EAF-807FFBBD75D9}.dbf
  • 92f63b1227a6b37335495f9bcb939ea2.virus
  • {c7c416dc-f8eb-4024-adb1-167e6d47ce8b}.dbf
  • {4a001e92-1a86-45de-8dea-df8e730b39f6}.dbf
  • c2d06ad0211c24f36978fe34d25b0018ffc0f22b0c74fd1f915c608bf2cfad15.sample

Зразок №5

Назва файлу: WSTDECOD

Статичні данні зразка:
MD5: 5f58059d894e8aaf58b2da6be6f97aa8

SHA-1: 455d9eb9e11aa9af9717e0260a70611ff84ef900
SHA-256: dcade5e14c26c19e935b13d5170d74f99e75d3e4dba443db1dab8bea78745584
File type: Win32 DLL
File size: 49.5 KB (50688 bytes)

Також зустрічався з наступними назвами:

  • WSTDECOD.DLL
  • {9D5D074B-1C31-4732-BD3B-0C9325911B29}.dat

Зразок №6

Назва файлу: 78734cd268e5c9ab4184e1bbe21a6eb9.virus

Статичні данні зразка:
MD5: 78734cd268e5c9ab4184e1bbe21a6eb9

SHA-1: d5ac50d38f8b98decda52fb8fcf85a576b0494c7
SHA-256: 573ea78afb50100f896185164da3b8519e2e0f609a34a7c70460eca5b4ae640d
File type: Win32 EXE
File size: 116.5 KB (119296 bytes)

Contacted URLs: http://217.12.204.100/news/

Contacted IPs: 217.12.204.100

 

  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{3479B41A-5B1E-4694-88C3-F50F7C8488E9}.dbf
  • C:\Documents and Settings\Administrator\Application Data\ .lnk
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{8105617A-CA35-42AA-B0D3-149B4BED6DCB}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{B997E610-2169-4200-B82F-DE61DDEEF66D}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{76C8192F-C760-4605-8B4D-FC08769D1C26}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{44FB1D37-DC8C-4040-A013-58AE5079450E}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{018BFBE6-3F5E-4A79-8598-3EA72549A102}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{75B64431-1608-44A6-A752-A69BACB38DE4}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{47BE844F-1AF1-433F-9748-594644037772}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{EC60B9C3-28D2-46D5-ACE2-746C5CA1281A}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{16EA8B54-B095-46F9-83F0-2CC7EA6E991A}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{42A0EDBF-E802-4C77-A20A-68C1CD27298B}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{191DF1C3-E28D-4EF3-B8A8-146C2796C005}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{CBCF8585-E4D3-4D56-9CE5-D18DFE44FACE}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{C4C0B803-DFC6-4EBF-B819-CEF69C3DA782}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{84F9FE11-BB4B-4BA5-8C89-FD694AEB524F}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{0D648798-7F52-4039-B796-FFB5EDDA9821}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{03D5F98A-6726-4C26-A097-EB414B016B0B}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{818C866A-55C6-4EFD-9729-504429EB9C2D}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{30A10B31-ACDD-40EA-8BFA-63FF1D204417}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{4A84FD55-CC94-4E43-A73E-AEE678028C5A}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{0F600465-A8C2-489C-88ED-4C49B6C2E98B}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{6777AEA0-7268-497E-B05F-3A43095EB780}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{76761411-00E2-4B7A-A33B-BD240A204EFE}.dbf
  • C:\Documents and Settings\Administrator\Application Data\Microsoft\{C9FB0E6B-CA38-4BB5-8AD0-1944D0CE67BF}.dbf

Permissions Requested

  • SE_LOAD_DRIVER_PRIVILEGE

Processes Created

  • C:\WINDOWS\system32\cmd.exe
  • C:\WINDOWS\system32\rundll32.exe
  • C:\WINDOWS\system32\ping.exe

Shell Commands

  • “C:\WINDOWS\system32\cmd.exe” /c move “C:\Documents and Settings\Administrator\Application Data\ .lnk” “C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\ .lnk”
  • “C:\WINDOWS\System32\rundll32.exe” {3479B41A-5B1E-4694-88C3-F50F7C8488E9}.dbf, #1 #1
  • “C:\WINDOWS\system32\cmd.exe” /c (ping localhost >> nul & del C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\EB93A6\996E.exe >> nul)
  • ping localhost
  • “C:\WINDOWS\System32\rundll32.exe” {8105617A-CA35-42AA-B0D3-149B4BED6DCB}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {B997E610-2169-4200-B82F-DE61DDEEF66D}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {76C8192F-C760-4605-8B4D-FC08769D1C26}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {44FB1D37-DC8C-4040-A013-58AE5079450E}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {018BFBE6-3F5E-4A79-8598-3EA72549A102}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {75B64431-1608-44A6-A752-A69BACB38DE4}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {47BE844F-1AF1-433F-9748-594644037772}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {EC60B9C3-28D2-46D5-ACE2-746C5CA1281A}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {16EA8B54-B095-46F9-83F0-2CC7EA6E991A}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {42A0EDBF-E802-4C77-A20A-68C1CD27298B}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {191DF1C3-E28D-4EF3-B8A8-146C2796C005}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {CBCF8585-E4D3-4D56-9CE5-D18DFE44FACE}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {C4C0B803-DFC6-4EBF-B819-CEF69C3DA782}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {84F9FE11-BB4B-4BA5-8C89-FD694AEB524F}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {0D648798-7F52-4039-B796-FFB5EDDA9821}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {03D5F98A-6726-4C26-A097-EB414B016B0B}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {818C866A-55C6-4EFD-9729-504429EB9C2D}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {30A10B31-ACDD-40EA-8BFA-63FF1D204417}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {4A84FD55-CC94-4E43-A73E-AEE678028C5A}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {0F600465-A8C2-489C-88ED-4C49B6C2E98B}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {6777AEA0-7268-497E-B05F-3A43095EB780}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {76761411-00E2-4B7A-A33B-BD240A204EFE}.dbf, #1 #1
  • “C:\WINDOWS\System32\rundll32.exe” {C9FB0E6B-CA38-4BB5-8AD0-1944D0CE67BF}.dbf, #1 #1
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe
  • \Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WTSAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KERNEL32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSAPI.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winime32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USP10.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LPK.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMRes.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLBCATQ.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsp2res.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\actxprxy.dll
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoInternetIcon
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoControlPanel
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoSetFolders
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll
  • \Registry\Machine\Software\Policies\Microsoft\System\DNSclient
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Documents
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Desktop
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500_CLASSES\.exe
  • \Registry\Machine\Software\Classes\.exe
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500_Classes\.exe
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LINKINFO.dll
  • \REGISTRY\MACHINE\SOFTWARE\Classes\Network\SharingHandler\
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ATL.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local Settings
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\System
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntshrui.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common AppData
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\My Pictures
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonPictures
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonMusic
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonVideo
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\urlmon.dll
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cookies
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500_Classes\exefile\shell\open\command
  • \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
  • \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\command
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\RestrictRun
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
  • \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\Levels
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\SaferFlags
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\SaferFlags
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\DefaultLevel
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\PolicyScope
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\LogFileName
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\System
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{3479B41A-5B1E-4694-88C3-F50F7C8488E9}.dbf
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\RpcThreadPoolThrottle
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe
  • \REGISTRY\MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\WinSock_Registry_Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Serial_Access_Num
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\00000007
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Next_Catalog_Entry_ID
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Num_Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Serial_Access_Num
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\00000004
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Num_Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\StoresServiceClassInfo
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\StoresServiceClassInfo
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\StoresServiceClassInfo
  • \REGISTRY\MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Ws2_32NumHandleBuckets
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Ws2_32SpinCount
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Winsock\Parameters\Transports
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Winsock\HelperDllName
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASN1.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CRYPT32.dll
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM\Ime File
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{8105617A-CA35-42AA-B0D3-149B4BED6DCB}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{B997E610-2169-4200-B82F-DE61DDEEF66D}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{76C8192F-C760-4605-8B4D-FC08769D1C26}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{44FB1D37-DC8C-4040-A013-58AE5079450E}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{018BFBE6-3F5E-4A79-8598-3EA72549A102}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{75B64431-1608-44A6-A752-A69BACB38DE4}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{47BE844F-1AF1-433F-9748-594644037772}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{EC60B9C3-28D2-46D5-ACE2-746C5CA1281A}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{16EA8B54-B095-46F9-83F0-2CC7EA6E991A}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{42A0EDBF-E802-4C77-A20A-68C1CD27298B}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{191DF1C3-E28D-4EF3-B8A8-146C2796C005}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{CBCF8585-E4D3-4D56-9CE5-D18DFE44FACE}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{C4C0B803-DFC6-4EBF-B819-CEF69C3DA782}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{84F9FE11-BB4B-4BA5-8C89-FD694AEB524F}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{0D648798-7F52-4039-B796-FFB5EDDA9821}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{03D5F98A-6726-4C26-A097-EB414B016B0B}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{818C866A-55C6-4EFD-9729-504429EB9C2D}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{30A10B31-ACDD-40EA-8BFA-63FF1D204417}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{4A84FD55-CC94-4E43-A73E-AEE678028C5A}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{0F600465-A8C2-489C-88ED-4C49B6C2E98B}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{6777AEA0-7268-497E-B05F-3A43095EB780}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{76761411-00E2-4B7A-A33B-BD240A204EFE}.dbf
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{C9FB0E6B-CA38-4BB5-8AD0-1944D0CE67BF}.dbf

GreyEnergy Mini - Unpacked

Зразок №1

Зразок №2

Назва файлу: b0959c8df85147fd7dc13c83082d2a9d8e464c7e846083d4a9850fa254482106.sample

Статичні данні зразка:
MD5: 8a5daa9bbc0f217a8bf94bf3b0281cdf

SHA-1: 882f89b325ac64541f0f69109d634ca57d2e2a6a
SHA-256: b0959c8df85147fd7dc13c83082d2a9d8e464c7e846083d4a9850fa254482106
File type: Win32 DLL
File size: 48 KB (49152 bytes)

GreyEnergy - Dropper - Unpacked

Зразок №1

Назва файлу: d13191de5cca61574e041d4ef2ee83ba618e4bc324fc93ff850c6922370fa651.sample

Статичні данні зразка:

MD5: 703eb9369b008c1e0a705c7b34608f01
SHA-1: 0cfb85d3c05e01241bb9394ad94e7b3d9d0ae964
SHA-256: d13191de5cca61574e041d4ef2ee83ba618e4bc324fc93ff850c6922370fa651
File type: Win32 EXE
File size: 144 KB (147456 bytes)

Зразок №2

Назва файлу: 9e64b19434beee9fad059926a968e64bf31417914f638cd220894a3b6a4780f7.sample

Статичні данні зразка:
MD5: f262e8f16a13e3391ee96f626b143c80
SHA-1: 85d61bddaae8674c7cdb3adfeea27a6e6d173d50
SHA-256: 9e64b19434beee9fad059926a968e64bf31417914f638cd220894a3b6a4780f7
File type: Win32 EXE
File size: 144 KB (147456 bytes)

 

Processes Created

  • C:\WINDOWS\system32\drwtsn32 -p 412 -e 168 -g

GreyEnergy - Dropper

Зразок №1

Назва файлу: TPVCGateway

Статичні данні зразка:

MD5: 7a7103a5fc1cf7c4b6eef1a6935554b7
SHA-1: 94f445b65bf9a0ab134fad2aaad70779eafd9288
SHA-256: 6c52a5850a57bea43a0a52ff0e2d2179653b97ae5406e884aee63e1cf340f58b
File type: Win32 EXE
File size: 216.87 KB (222072 bytes)

Contacted URLs

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Contacted IPs

109.200.202.7
88.221.14.145
88.221.14.122

Files Written

  • C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp
  • C:\Documents and Settings\Administrator\Local Settings\Temp\RCX3.tmp
  • C:\WINDOWS\system32\pypl.dll

Files Copied

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RCX3.tmp  ->  C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp  ->  C:\WINDOWS\system32\qvtkbg.dll

C:\Documents and Settings\Administrator\Local Settings\Temp\RCX3.tmp  -> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp

C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp  ->  C:\WINDOWS\system32\qvtkbg.dll

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp  -> C:\WINDOWS\system32\fymmh.dll

C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp  ->  C:\WINDOWS\system32\fymmh.dll

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp  ->  C:\WINDOWS\system32\suofc.dll

C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp  ->  C:\WINDOWS\system32\suofc.dll

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp  ->  C:\WINDOWS\system32\tgnjf.dll

C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp  ->  C:\WINDOWS\system32\tgnjf.dll

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp  ->  C:\WINDOWS\system32\fgxe.dll

C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp  ->  C:\WINDOWS\system32\fgxe.dll

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp  -> C:\WINDOWS\system32\pypl.dll

C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp  ->  C:\WINDOWS\system32\pypl.dll

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp ->  C:\WINDOWS\system32\ywfr.dll

C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp  ->  C:\WINDOWS\system32\ywfr.dll

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp  ->  C:\WINDOWS\system32\pvjogr.dll

C:\Documents and Settings\Administrator\Local Settings\Temp\2.tmp  ->  C:\WINDOWS\system32\pvjogr.dll

Registry Keys Set

  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\Parameters\ServiceDll  :  %SystemRoot%\system32\qvtkbg.dll
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\FailureActions  :  0000000000000000000000000300000090DD12000100000060EA00000000000060EA00000000000060EA0000
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\ErrorControl  :  00000000
  • \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData  :  C:\Documents and Settings\LocalService\Application Data
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\HidServ\Parameters\ServiceDll  :  %SystemRoot%\system32\fymmh.dll
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\HidServ\FailureActions  :  0000000000000000000000000300000090DD12000100000060EA00000000000060EA00000000000060EA0000
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\HidServ\ErrorControl  :  00000000
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\Parameters\ServiceDll  :  %SystemRoot%\system32\suofc.dll
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\Parameters\ServiceDll  :  %SystemRoot%\system32\tgnjf.dll
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\HidServ\Parameters\ServiceDll  :  %SystemRoot%\system32\fgxe.dll
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\Parameters\ServiceDll  :  %SystemRoot%\system32\pypl.dll
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteRegistry\Parameters\ServiceDll  :  %SystemRoot%\system32\ywfr.dll
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteRegistry\FailureActions  :  0000000000000000000000000300000090DD12000100000060EA00000000000060EA00000000000060EA0000
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteRegistry\ErrorControl  :  00000000
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\HidServ\Parameters\ServiceDll  :  %SystemRoot%\system32\pvjogr.dll

Registry Keys Opened

  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe
  • \Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KERNEL32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSAPI.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winime32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USP10.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LPK.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\imagehlp.dll
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsaenh.dll
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Cryptography
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMRes.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLBCATQ.DLL
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsp2res.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbemcomn.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbemprox.dll
  • \Registry\Machine\Software\Policies\Microsoft\System\DNSclient
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbemsvc.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVCP60.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows NT\DnsClient
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTDSAPI.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fastprox.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAMLIB.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTMARTA.DLL
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\ImagePath
  • \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\Levels
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\SaferFlags
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\SaferFlags
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemData
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\HashAlg
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemSize
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\SaferFlags
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
  • \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\DefaultLevel
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\PolicyScope
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
  • \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\LogFileName
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
  • \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\System
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qvtkbg.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASN1.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CRYPT32.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINHTTP.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSOERT2.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\inetcomm.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\inetres.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mlang.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe
  • \REGISTRY\MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\WinSock_Registry_Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Serial_Access_Num
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\00000007
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Next_Catalog_Entry_ID
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Num_Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015\PackedCatalogItem
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Serial_Access_Num
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\00000004
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Num_Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\StoresServiceClassInfo
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\StoresServiceClassInfo
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\LibraryPath
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\DisplayString
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\ProviderId
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\AddressFamily
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\SupportedNameSpace
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Enabled
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Version
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\StoresServiceClassInfo
  • \REGISTRY\MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Ws2_32NumHandleBuckets
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinSock2\Parameters\Ws2_32SpinCount
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll
  • \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ping.exe\RpcThreadPoolThrottle
  • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Winsock\Parameters\Transports
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Winsock\HelperDllName
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\HidServ\ImagePath
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fymmh.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\suofc.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tgnjf.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fgxe.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pypl.dll
  • \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\RemoteRegistry\ImagePath
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ywfr.dll
  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvjogr.dll

Processes Created

  • C:\WINDOWS\system32\cmd.exe
  • C:\WINDOWS\system32\reg.exe
  • C:\WINDOWS\system32\ping.exe

Shell Commands

  • /c reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteAccess\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ^%SystemRoot^%\system32\qvtkbg.dll /f
  • reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteAccess\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\system32\qvtkbg.dll /f
  • /c move /Y “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp” “C:\WINDOWS\system32\qvtkbg.dll”
  • /c ping localhost -n 3 > nul & del “C:\Documents and Settings\Administrator\Local Settings\Temp\EB93A6\996E.exe”
  • ping localhost -n 3
  • /c reg add HKLM\SYSTEM\CurrentControlSet\services\HidServ\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ^%SystemRoot^%\system32\fymmh.dll /f
  • reg add HKLM\SYSTEM\CurrentControlSet\services\HidServ\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\system32\fymmh.dll /f
  • /c move /Y “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp” “C:\WINDOWS\system32\fymmh.dll”
  • /c reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteAccess\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ^%SystemRoot^%\system32\suofc.dll /f
  • reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteAccess\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\system32\suofc.dll /f
  • /c move /Y “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp” “C:\WINDOWS\system32\suofc.dll”
  • /c reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteAccess\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ^%SystemRoot^%\system32\tgnjf.dll /f
  • reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteAccess\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\system32\tgnjf.dll /f
  • /c move /Y “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp” “C:\WINDOWS\system32\tgnjf.dll”
  • /c reg add HKLM\SYSTEM\CurrentControlSet\services\HidServ\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ^%SystemRoot^%\system32\fgxe.dll /f
  • reg add HKLM\SYSTEM\CurrentControlSet\services\HidServ\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\system32\fgxe.dll /f
  • /c move /Y “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp” “C:\WINDOWS\system32\fgxe.dll”
  • /c reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteAccess\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ^%SystemRoot^%\system32\pypl.dll /f
  • reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteAccess\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\system32\pypl.dll /f
  • /c move /Y “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp” “C:\WINDOWS\system32\pypl.dll”
  • /c reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteRegistry\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ^%SystemRoot^%\system32\ywfr.dll /f
  • reg add HKLM\SYSTEM\CurrentControlSet\services\RemoteRegistry\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\system32\ywfr.dll /f
  • /c move /Y “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp” “C:\WINDOWS\system32\ywfr.dll”
  • /c reg add HKLM\SYSTEM\CurrentControlSet\services\HidServ\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ^%SystemRoot^%\system32\pvjogr.dll /f
  • reg add HKLM\SYSTEM\CurrentControlSet\services\HidServ\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %SystemRoot%\system32\pvjogr.dll /f
  • /c move /Y “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2.tmp” “C:\WINDOWS\system32\pvjogr.dll”

GreyEnergy - Payload

Зразок №1

Назва файлу: SWPRV.DLL

Статичні данні зразка:

MD5: c9d46876d5ab346e8921973b719aff58
SHA-1: f36ecac8696aa0862ad3779ca464b2cd399d8099
SHA-256: c21cf6018c2ee0a90b9d2c401aae8071c90b5a4bc9848a94d678d77209464f79
File type: Win32 DLL
File size: 94.5 KB (96768 bytes)

Також зустрічався з наступними назвами:

  • jqisrv.dll

Share this post