魔盾安全分析报告

分析类型 开始时间 结束时间 持续时间 分析引擎版本
FILE 2022-09-24 16:15:42 2022-09-24 16:17:53 131 秒 1.4-Maldun
虚拟机机器名 标签 虚拟机管理 开机时间 关机时间
win7-sp1-x64-shaapp03-2 win7-sp1-x64-shaapp03-2 KVM 2022-09-24 16:15:43 2022-09-24 16:17:55
魔盾分数

10.0

恶意的

文件详细信息

文件名 搜刮发卡网.exe
文件大小 4362240 字节
文件类型 PE32 executable (GUI) Intel 80386, for MS Windows
CRC32 B1DA2513
MD5 4d6047f994cdf2a99236fe40f0469d7e
SHA1 87968ec94f28a0671d79ab79590c96de1b9d8a9e
SHA256 54bc027fd46360184aeadffe8bd29d3d7ca384b82a138202a32494bcc10be81d
SHA512 b09ade12e52aad4f65b4b797e1757e4e6ca066db263ea8679626ec369c77a6042993997d29cbca2ea3428c9bc369da93300e260ff476a553fa67b25200cf5378
Ssdeep 98304:LrE0PUCpY0nGB35ZrSOFAlxyPGNazegO4Gwo77E5XR:XSonGBOOelxyeNaah4Gfk
PEiD 无匹配
Yara
  • Advapi_Hash_API (Looks for advapi API functions)
  • CRC32_poly_Constant (Look for CRC32 [poly])
  • CRC32_table (Look for CRC32 table)
  • CRC32b_poly_Constant (Look for CRC32b [poly])
  • MD5_Constants (Look for MD5 constants)
  • SHA1_Constants (Look for SHA1 constants)
  • BASE64_table (Look for Base64 table)
  • with_images (Detected the presence of an or several images)
  • with_urls (Detected the presence of an or several urls)
  • IsPE32 (Detected a 32bit PE sample)
  • IsWindowsGUI (Detected a Windows GUI sample)
  • IsPacked (Detected Entropy signature)
  • HasRichSignature (Detected Rich Signature)
  • UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ()
  • DebuggerTiming__Ticks (Detected timing ticks function)
  • network_http (Detected communications function over HTTP)
  • win_mutex (Create or check mutex)
  • maldoc_OLE_file_magic_number (Detected OLE in the file)
  • screenshot (Detected take screenshot function)
  • create_process (Detection function for creating a new process)
  • keylogger (Detected keylogger function)
  • win_registry (Detected system registries modification function)
  • change_win_registry (Change registries to affect system)
  • win_files_operation (Affect private profile)
  • win_hook (Detected hook table access function)
  • win_private_profile (Detected private profile access function)
  • Maldun_Anomoly_Combined_Activities_Network_Logging (Spotted potential abnormal behaviors, like logging and network communications)
  • Maldun_Anomoly_Combined_Activities_7 (Spotted potential malicious behaviors from a small size target, like process manipultion, privilege, token and files)
  • UPX (Detected UPX. Commonly used by RAT!)
VirusTotal VirusTotal查询失败

特征

创建RWX内存
魔盾wping.org IP地址信誉系统
Greylist: 180.111.199.110
二进制文件可能包含加密或压缩数据
section: name: .rdata, entropy: 7.80, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x002fa000, virtual_size: 0x002f982c
从文件自身的二进制镜像中读取数据
self_read: process: _______________.exe, pid: 2588, offset: 0x00000000, length: 0x00000040
self_read: process: _______________.exe, pid: 2588, offset: 0x00000100, length: 0x00000020
self_read: process: _______________.exe, pid: 2588, offset: 0x00000183, length: 0x00080000
魔盾安全Yara规则检测结果 - 高危
Warning: Looks for advapi API functions
Critical: Detected OLE in the file
Critical: Spotted potential abnormal behaviors, like logging and network communications
Critical: Spotted potential malicious behaviors from a small size target, like process manipultion, privilege, token and files
Warning: Detected UPX. Commonly used by RAT!
尝试断开连接或更改沙箱进程监控的Windows功能
unhook: function_name: SetWindowLongA, type: modification
unhook: function_name: SetWindowLongW, type: modification

运行截图

网络分析

访问主机记录

直接访问 IP地址 国家名
否 180.111.199.110 China

域名解析

域名 响应
q1.qlogo.cn CNAME q.qlogo.cn
A 180.111.199.93
A 180.111.198.52
A 180.111.199.110
A 180.111.198.158
A 180.111.199.109
A 180.111.199.184
A 180.111.199.95
A 180.111.198.41
A 180.111.198.106
A 180.111.198.198

TCP连接

IP地址 端口
180.111.199.110 443
23.192.228.89 80

UDP连接

IP地址 端口
192.168.122.1 53
192.168.122.1 53

HTTP请求

URL HTTP数据
http://acroipm.adobe.com/11/rdr/CHS/win/nooem/none/message.zip 
GET /11/rdr/CHS/win/nooem/none/message.zip HTTP/1.1
Accept: */*
If-Modified-Since: Mon, 08 Nov 2017 08:44:36 GMT
User-Agent: IPM
Host: acroipm.adobe.com
Connection: Keep-Alive
Cache-Control: no-cache

静态分析

PE 信息

初始地址 0x00400000
入口地址 0x004e11ee
声明校验值 0x0042e9c6
实际校验值 0x0042e9c6
最低操作系统版本要求 4.0
编译时间 2022-09-24 16:08:44
载入哈希 d868d553f7158bf853cb1a515c10e1ab
图标
图标精确哈希值 7e8d0dbe5de19f74f384ae459c5abecf
图标相似性哈希值 439e81c5165936c3ea55d4df339c6380

版本信息

LegalCopyright: \xe9\xe9\xe8\xe5 yflt.vip \xe7\xe6\xe6\xe6
FileVersion: 1.0.0.0
CompanyName: \xe9\xe9\xe8\xe5 yflt.vip
Comments: \xe9\xe9\xe8\xe5 yflt.vip
ProductName: \xe9\xe9\xe8\xe5 yflt.vip
ProductVersion: 1.0.0.0
FileDescription: \xe9\xe9\xe8\xe5 yflt.vip
Translation: 0x0804 0x04b0

PE数据组成

名称 虚拟地址 虚拟大小 原始数据大小 特征 熵(Entropy)
.text 0x00001000 0x00106666 0x00107000 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.53
.rdata 0x00108000 0x002f982c 0x002fa000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 7.80
.data 0x00402000 0x00068faa 0x00023000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5.63
.rsrc 0x0046b000 0x00003e6c 0x00004000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 5.26

资源

名称 偏移量 大小 语言 子语言 熵(Entropy) 文件类型
TEXTINCLUDE 0x0046b7a8 0x00000151 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 5.25 C source, ASCII text, with CRLF line terminators
TEXTINCLUDE 0x0046b7a8 0x00000151 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 5.25 C source, ASCII text, with CRLF line terminators
TEXTINCLUDE 0x0046b7a8 0x00000151 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 5.25 C source, ASCII text, with CRLF line terminators
WAVE 0x0046b8fc 0x00001448 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 6.35 RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 22050 Hz
RT_CURSOR 0x0046d2c8 0x00000134 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.43 AmigaOS bitmap font
RT_CURSOR 0x0046d2c8 0x00000134 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.43 AmigaOS bitmap font
RT_CURSOR 0x0046d2c8 0x00000134 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.43 AmigaOS bitmap font
RT_CURSOR 0x0046d2c8 0x00000134 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.43 AmigaOS bitmap font
RT_CURSOR 0x0046d2c8 0x00000134 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.43 AmigaOS bitmap font
RT_CURSOR 0x0046d2c8 0x00000134 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.43 AmigaOS bitmap font
RT_BITMAP 0x0046d568 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.88 data
RT_BITMAP 0x0046d568 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.88 data
RT_ICON 0x0046decc 0x00000668 LANG_NEUTRAL SUBLANG_NEUTRAL 2.62 dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 0, next used block 0
RT_ICON 0x0046decc 0x00000668 LANG_NEUTRAL SUBLANG_NEUTRAL 2.62 dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 0, next used block 0
RT_ICON 0x0046decc 0x00000668 LANG_NEUTRAL SUBLANG_NEUTRAL 2.62 dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 0, next used block 0
RT_ICON 0x0046decc 0x00000668 LANG_NEUTRAL SUBLANG_NEUTRAL 2.62 dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 0, next used block 0
RT_ICON 0x0046decc 0x00000668 LANG_NEUTRAL SUBLANG_NEUTRAL 2.62 dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 0, next used block 0
RT_DIALOG 0x0046e6d4 0x000000e2 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 3.39 data
RT_DIALOG 0x0046e6d4 0x000000e2 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 3.39 data
RT_DIALOG 0x0046e6d4 0x000000e2 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 3.39 data
RT_STRING 0x0046e7b8 0x000001c4 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 6.11 data
RT_GROUP_CURSOR 0x0046e9cc 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.25 MS Windows cursor resource - 2 icons, 32x256, hotspot @1x1
RT_GROUP_CURSOR 0x0046e9cc 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.25 MS Windows cursor resource - 2 icons, 32x256, hotspot @1x1
RT_GROUP_CURSOR 0x0046e9cc 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.25 MS Windows cursor resource - 2 icons, 32x256, hotspot @1x1
RT_GROUP_CURSOR 0x0046e9cc 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.25 MS Windows cursor resource - 2 icons, 32x256, hotspot @1x1
RT_GROUP_CURSOR 0x0046e9cc 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 2.25 MS Windows cursor resource - 2 icons, 32x256, hotspot @1x1
RT_GROUP_ICON 0x0046e9f0 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL 2.37 MS Windows icon resource - 3 icons, 16x16, 16 colors
RT_VERSION 0x0046ea20 0x0000027c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 3.58 data
RT_MANIFEST 0x0046ec9c 0x000001cd LANG_NEUTRAL SUBLANG_NEUTRAL 5.08 XML 1.0 document, ASCII text, with very long lines, with no line terminators

导入

库 SHLWAPI.dll:
• 0x5084d4 - PathFileExistsW
库 WINMM.dll:
• 0x508784 - midiStreamStop
• 0x508788 - midiStreamRestart
• 0x50878c - midiOutReset
• 0x508790 - midiStreamClose
• 0x508794 - midiStreamOut
• 0x508798 - midiOutPrepareHeader
• 0x50879c - midiStreamProperty
• 0x5087a0 - midiStreamOpen
• 0x5087a4 - midiOutUnprepareHeader
• 0x5087a8 - waveOutOpen
• 0x5087ac - waveOutGetNumDevs
• 0x5087b0 - waveOutClose
• 0x5087b4 - waveOutReset
• 0x5087b8 - waveOutPause
• 0x5087bc - waveOutWrite
• 0x5087c0 - waveOutPrepareHeader
• 0x5087c4 - waveOutUnprepareHeader
• 0x5087c8 - PlaySoundA
• 0x5087cc - waveOutRestart
库 WS2_32.dll:
• 0x5087ec - closesocket
• 0x5087f0 - WSACleanup
• 0x5087f4 - inet_ntoa
• 0x5087f8 - ntohl
• 0x5087fc - WSAAsyncSelect
• 0x508800 - accept
• 0x508804 - getpeername
• 0x508808 - recv
• 0x50880c - ioctlsocket
• 0x508810 - recvfrom
库 VERSION.dll:
• 0x508770 - VerLanguageNameA
• 0x508774 - VerQueryValueA
• 0x508778 - GetFileVersionInfoA
• 0x50877c - GetFileVersionInfoSizeA
库 MSVFW32.dll:
• 0x508444 - DrawDibDraw
库 AVIFIL32.dll:
• 0x508030 - AVIStreamInfoA
• 0x508034 - AVIStreamGetFrame
库 KERNEL32.dll:
• 0x5081e8 - InterlockedIncrement
• 0x5081ec - LocalFree
• 0x5081f0 - FormatMessageA
• 0x5081f4 - FileTimeToSystemTime
• 0x5081f8 - FileTimeToLocalFileTime
• 0x5081fc - lstrcpynA
• 0x508200 - DuplicateHandle
• 0x508204 - FlushFileBuffers
• 0x508208 - LockFile
• 0x50820c - UnlockFile
• 0x508210 - SetEndOfFile
• 0x508214 - GetThreadLocale
• 0x508218 - lstrcmpiA
• 0x50821c - GlobalDeleteAtom
• 0x508220 - GlobalFindAtomA
• 0x508224 - GlobalAddAtomA
• 0x508228 - GlobalGetAtomNameA
• 0x50822c - lstrcmpA
• 0x508230 - LocalAlloc
• 0x508234 - TlsAlloc
• 0x508238 - GlobalHandle
• 0x50823c - TlsFree
• 0x508240 - TlsSetValue
• 0x508244 - LocalReAlloc
• 0x508248 - TlsGetValue
• 0x50824c - GetFileTime
• 0x508250 - GetCurrentThread
• 0x508254 - GlobalFlags
• 0x508258 - SetErrorMode
• 0x50825c - GetProcessVersion
• 0x508260 - GetCPInfo
• 0x508264 - GetOEMCP
• 0x508268 - GetStartupInfoA
• 0x50826c - RtlUnwind
• 0x508270 - GetSystemTime
• 0x508274 - GetLocalTime
• 0x508278 - RaiseException
• 0x50827c - HeapSize
• 0x508280 - GetACP
• 0x508284 - UnhandledExceptionFilter
• 0x508288 - FreeEnvironmentStringsA
• 0x50828c - FreeEnvironmentStringsW
• 0x508290 - GetEnvironmentStrings
• 0x508294 - GetEnvironmentStringsW
• 0x508298 - SetHandleCount
• 0x50829c - GetStdHandle
• 0x5082a0 - GetFileType
• 0x5082a4 - GetEnvironmentVariableA
• 0x5082a8 - HeapDestroy
• 0x5082ac - HeapCreate
• 0x5082b0 - VirtualFree
• 0x5082b4 - SetEnvironmentVariableA
• 0x5082b8 - LCMapStringA
• 0x5082bc - LCMapStringW
• 0x5082c0 - VirtualAlloc
• 0x5082c4 - IsBadWritePtr
• 0x5082c8 - SetUnhandledExceptionFilter
• 0x5082cc - GetStringTypeA
• 0x5082d0 - GetStringTypeW
• 0x5082d4 - CompareStringA
• 0x5082d8 - CompareStringW
• 0x5082dc - IsBadReadPtr
• 0x5082e0 - IsBadCodePtr
• 0x5082e4 - SetStdHandle
• 0x5082e8 - SuspendThread
• 0x5082ec - ReleaseMutex
• 0x5082f0 - CreateMutexA
• 0x5082f4 - TerminateThread
• 0x5082f8 - GetTempFileNameA
• 0x5082fc - GetVersion
• 0x508300 - GetTimeZoneInformation
• 0x508304 - SetLastError
• 0x508308 - GetSystemDirectoryA
• 0x50830c - GetWindowsDirectoryA
• 0x508310 - CreateToolhelp32Snapshot
• 0x508314 - Process32First
• 0x508318 - Process32Next
• 0x50831c - GetModuleHandleW
• 0x508320 - GetTempPathW
• 0x508324 - CreateFileW
• 0x508328 - SetFilePointer
• 0x50832c - GetFileSize
• 0x508330 - GetCurrentProcess
• 0x508334 - TerminateProcess
• 0x508338 - LoadLibraryW
• 0x50833c - DeleteFileW
• 0x508340 - CreateSemaphoreA
• 0x508344 - ResumeThread
• 0x508348 - ReleaseSemaphore
• 0x50834c - EnterCriticalSection
• 0x508350 - LeaveCriticalSection
• 0x508354 - GetProfileStringA
• 0x508358 - WriteFile
• 0x50835c - WaitForMultipleObjects
• 0x508360 - CreateFileA
• 0x508364 - SetEvent
• 0x508368 - FindResourceA
• 0x50836c - LoadResource
• 0x508370 - LockResource
• 0x508374 - ReadFile
• 0x508378 - lstrlenW
• 0x50837c - GetModuleFileNameA
• 0x508380 - GetCurrentThreadId
• 0x508384 - ExitProcess
• 0x508388 - GlobalSize
• 0x50838c - GlobalFree
• 0x508390 - DeleteCriticalSection
• 0x508394 - InitializeCriticalSection
• 0x508398 - lstrcatA
• 0x50839c - lstrlenA
• 0x5083a0 - WinExec
• 0x5083a4 - lstrcpyA
• 0x5083a8 - FindNextFileA
• 0x5083ac - GlobalReAlloc
• 0x5083b0 - HeapFree
• 0x5083b4 - HeapReAlloc
• 0x5083b8 - GetProcessHeap
• 0x5083bc - HeapAlloc
• 0x5083c0 - GetUserDefaultLCID
• 0x5083c4 - MultiByteToWideChar
• 0x5083c8 - WideCharToMultiByte
• 0x5083cc - GetFullPathNameA
• 0x5083d0 - FreeLibrary
• 0x5083d4 - LoadLibraryA
• 0x5083d8 - GetLastError
• 0x5083dc - GetVersionExA
• 0x5083e0 - WritePrivateProfileStringA
• 0x5083e4 - CreateThread
• 0x5083e8 - CreateEventA
• 0x5083ec - Sleep
• 0x5083f0 - GlobalAlloc
• 0x5083f4 - GlobalLock
• 0x5083f8 - GlobalUnlock
• 0x5083fc - GetTempPathA
• 0x508400 - FindFirstFileA
• 0x508404 - FindClose
• 0x508408 - SetFileAttributesA
• 0x50840c - GetFileAttributesA
• 0x508410 - DeleteFileA
• 0x508414 - SetCurrentDirectoryA
• 0x508418 - GetVolumeInformationA
• 0x50841c - GetModuleHandleA
• 0x508420 - GetProcAddress
• 0x508424 - MulDiv
• 0x508428 - GetCommandLineA
• 0x50842c - GetTickCount
• 0x508430 - WaitForSingleObject
• 0x508434 - CloseHandle
• 0x508438 - InterlockedExchange
• 0x50843c - InterlockedDecrement
库 USER32.dll:
• 0x5084dc - GetNextDlgGroupItem
• 0x5084e0 - GetSysColorBrush
• 0x5084e4 - LoadStringA
• 0x5084e8 - MapDialogRect
• 0x5084ec - SetWindowContextHelpId
• 0x5084f0 - CharNextA
• 0x5084f4 - GetMenuCheckMarkDimensions
• 0x5084f8 - GetMenuState
• 0x5084fc - SetMenuItemBitmaps
• 0x508500 - CheckMenuItem
• 0x508504 - MoveWindow
• 0x508508 - SetWindowTextA
• 0x50850c - IsDialogMessageA
• 0x508510 - ScrollWindowEx
• 0x508514 - SendDlgItemMessageA
• 0x508518 - MapWindowPoints
• 0x50851c - AdjustWindowRectEx
• 0x508520 - GetScrollPos
• 0x508524 - RegisterClassA
• 0x508528 - GetMenuItemCount
• 0x50852c - GetMenuItemID
• 0x508530 - SetWindowsHookExA
• 0x508534 - CallNextHookEx
• 0x508538 - GetClassLongA
• 0x50853c - SetPropA
• 0x508540 - UnhookWindowsHookEx
• 0x508544 - GetPropA
• 0x508548 - RemovePropA
• 0x50854c - GetMessageTime
• 0x508550 - GetLastActivePopup
• 0x508554 - RegisterWindowMessageA
• 0x508558 - GetWindowPlacement
• 0x50855c - EndDialog
• 0x508560 - CreateDialogIndirectParamA
• 0x508564 - DestroyWindow
• 0x508568 - GrayStringA
• 0x50856c - DrawTextA
• 0x508570 - TabbedTextOutA
• 0x508574 - EndPaint
• 0x508578 - BeginPaint
• 0x50857c - GetWindowDC
• 0x508580 - CharUpperA
• 0x508584 - GetWindowTextLengthA
• 0x508588 - GetForegroundWindow
• 0x50858c - GetNextDlgTabItem
• 0x508590 - GetWindowTextA
• 0x508594 - UnregisterClassA
• 0x508598 - GetDlgItem
• 0x50859c - GetClassNameA
• 0x5085a0 - GetDesktopWindow
• 0x5085a4 - UnregisterHotKey
• 0x5085a8 - RegisterHotKey
• 0x5085ac - CreateWindowExA
• 0x5085b0 - CallWindowProcA
• 0x5085b4 - MessageBoxW
• 0x5085b8 - LoadIconA
• 0x5085bc - TranslateMessage
• 0x5085c0 - DrawFrameControl
• 0x5085c4 - DrawEdge
• 0x5085c8 - DrawFocusRect
• 0x5085cc - WindowFromPoint
• 0x5085d0 - GetMessageA
• 0x5085d4 - DispatchMessageA
• 0x5085d8 - RegisterClipboardFormatA
• 0x5085dc - CreateIconFromResourceEx
• 0x5085e0 - CreateIconFromResource
• 0x5085e4 - DrawIconEx
• 0x5085e8 - CreatePopupMenu
• 0x5085ec - AppendMenuA
• 0x5085f0 - ModifyMenuA
• 0x5085f4 - CreateMenu
• 0x5085f8 - CreateAcceleratorTableA
• 0x5085fc - GetDlgCtrlID
• 0x508600 - GetSubMenu
• 0x508604 - EnableMenuItem
• 0x508608 - ClientToScreen
• 0x50860c - EnumDisplaySettingsA
• 0x508610 - LoadImageA
• 0x508614 - SystemParametersInfoA
• 0x508618 - ShowWindow
• 0x50861c - IsWindowEnabled
• 0x508620 - TranslateAcceleratorA
• 0x508624 - GetKeyState
• 0x508628 - CopyAcceleratorTableA
• 0x50862c - PostQuitMessage
• 0x508630 - IsZoomed
• 0x508634 - GetClassInfoA
• 0x508638 - DefWindowProcA
• 0x50863c - GetSystemMenu
• 0x508640 - DeleteMenu
• 0x508644 - GetMenu
• 0x508648 - SetMenu
• 0x50864c - PeekMessageA
• 0x508650 - IsIconic
• 0x508654 - SetFocus
• 0x508658 - GetActiveWindow
• 0x50865c - GetWindow
• 0x508660 - DestroyAcceleratorTable
• 0x508664 - SetWindowRgn
• 0x508668 - GetMessagePos
• 0x50866c - ScreenToClient
• 0x508670 - ChildWindowFromPointEx
• 0x508674 - LoadBitmapA
• 0x508678 - WinHelpA
• 0x50867c - KillTimer
• 0x508680 - SetTimer
• 0x508684 - ReleaseCapture
• 0x508688 - GetCapture
• 0x50868c - SetCapture
• 0x508690 - GetScrollRange
• 0x508694 - SetScrollRange
• 0x508698 - SetScrollPos
• 0x50869c - SetRect
• 0x5086a0 - InflateRect
• 0x5086a4 - IntersectRect
• 0x5086a8 - DestroyIcon
• 0x5086ac - PtInRect
• 0x5086b0 - OffsetRect
• 0x5086b4 - IsWindowVisible
• 0x5086b8 - EnableWindow
• 0x5086bc - RedrawWindow
• 0x5086c0 - GetWindowLongA
• 0x5086c4 - SetWindowLongA
• 0x5086c8 - GetSysColor
• 0x5086cc - SetActiveWindow
• 0x5086d0 - SetCursorPos
• 0x5086d4 - LoadCursorA
• 0x5086d8 - SetCursor
• 0x5086dc - GetDC
• 0x5086e0 - FillRect
• 0x5086e4 - IsRectEmpty
• 0x5086e8 - ReleaseDC
• 0x5086ec - IsChild
• 0x5086f0 - TrackPopupMenu
• 0x5086f4 - DestroyMenu
• 0x5086f8 - SetForegroundWindow
• 0x5086fc - GetWindowRect
• 0x508700 - EqualRect
• 0x508704 - UpdateWindow
• 0x508708 - ValidateRect
• 0x50870c - InvalidateRect
• 0x508710 - GetClientRect
• 0x508714 - GetFocus
• 0x508718 - GetParent
• 0x50871c - GetTopWindow
• 0x508720 - PostMessageA
• 0x508724 - IsWindow
• 0x508728 - SetParent
• 0x50872c - DestroyCursor
• 0x508730 - SendMessageA
• 0x508734 - SetWindowPos
• 0x508738 - MessageBeep
• 0x50873c - MessageBoxA
• 0x508740 - GetCursorPos
• 0x508744 - GetSystemMetrics
• 0x508748 - EmptyClipboard
• 0x50874c - SetClipboardData
• 0x508750 - OpenClipboard
• 0x508754 - GetClipboardData
• 0x508758 - CloseClipboard
• 0x50875c - wsprintfA
• 0x508760 - PostThreadMessageA
• 0x508764 - SetRectEmpty
• 0x508768 - CopyRect
库 GDI32.dll:
• 0x50806c - GetStretchBltMode
• 0x508070 - GetPolyFillMode
• 0x508074 - GetROP2
• 0x508078 - CreateCompatibleBitmap
• 0x50807c - CreateDCA
• 0x508080 - CreateBrushIndirect
• 0x508084 - GetBkColor
• 0x508088 - CreateHatchBrush
• 0x50808c - SetTextColor
• 0x508090 - StretchDIBits
• 0x508094 - SetDIBitsToDevice
• 0x508098 - SaveDC
• 0x50809c - RestoreDC
• 0x5080a0 - SetPolyFillMode
• 0x5080a4 - SetROP2
• 0x5080a8 - SetMapMode
• 0x5080ac - SetViewportOrgEx
• 0x5080b0 - OffsetViewportOrgEx
• 0x5080b4 - SetViewportExtEx
• 0x5080b8 - ScaleViewportExtEx
• 0x5080bc - CreateBitmap
• 0x5080c0 - SetWindowExtEx
• 0x5080c4 - ScaleWindowExtEx
• 0x5080c8 - GetClipBox
• 0x5080cc - ExcludeClipRect
• 0x5080d0 - MoveToEx
• 0x5080d4 - LineTo
• 0x5080d8 - CreatePatternBrush
• 0x5080dc - ExtSelectClipRgn
• 0x5080e0 - GetViewportExtEx
• 0x5080e4 - PtVisible
• 0x5080e8 - RectVisible
• 0x5080ec - ExtTextOutA
• 0x5080f0 - Escape
• 0x5080f4 - GetTextMetricsA
• 0x5080f8 - GetMapMode
• 0x5080fc - TranslateCharsetInfo
• 0x508100 - CreateFontA
• 0x508104 - SetBkColor
• 0x508108 - CreateRectRgnIndirect
• 0x50810c - CreateDIBSection
• 0x508110 - SetPixel
• 0x508114 - ExtCreateRegion
• 0x508118 - SetStretchBltMode
• 0x50811c - GetClipRgn
• 0x508120 - CreatePolygonRgn
• 0x508124 - SelectClipRgn
• 0x508128 - DeleteObject
• 0x50812c - CreateDIBitmap
• 0x508130 - GetSystemPaletteEntries
• 0x508134 - CreatePalette
• 0x508138 - StretchBlt
• 0x50813c - SelectPalette
• 0x508140 - RealizePalette
• 0x508144 - GetDIBits
• 0x508148 - GetWindowExtEx
• 0x50814c - GetViewportOrgEx
• 0x508150 - GetWindowOrgEx
• 0x508154 - BeginPath
• 0x508158 - SelectObject
• 0x50815c - CreatePen
• 0x508160 - PatBlt
• 0x508164 - CombineRgn
• 0x508168 - CreateRectRgn
• 0x50816c - FillRgn
• 0x508170 - CreateSolidBrush
• 0x508174 - CreateFontIndirectA
• 0x508178 - GetStockObject
• 0x50817c - GetObjectA
• 0x508180 - EndPage
• 0x508184 - EndDoc
• 0x508188 - DeleteDC
• 0x50818c - StartDocA
• 0x508190 - StartPage
• 0x508194 - BitBlt
• 0x508198 - GetPixel
• 0x50819c - CreateCompatibleDC
• 0x5081a0 - SetBkMode
• 0x5081a4 - TextOutA
• 0x5081a8 - Ellipse
• 0x5081ac - Rectangle
• 0x5081b0 - LPtoDP
• 0x5081b4 - DPtoLP
• 0x5081b8 - GetCurrentObject
• 0x5081bc - RoundRect
• 0x5081c0 - GetTextExtentPoint32A
• 0x5081c4 - SetWindowOrgEx
• 0x5081c8 - GetDeviceCaps
• 0x5081cc - EndPath
• 0x5081d0 - PathToRegion
• 0x5081d4 - CreateEllipticRgn
• 0x5081d8 - CreateRoundRectRgn
• 0x5081dc - GetTextColor
• 0x5081e0 - GetBkMode
库 WINSPOOL.DRV:
• 0x5087d4 - ClosePrinter
• 0x5087d8 - DocumentPropertiesA
• 0x5087dc - OpenPrinterA
库 comdlg32.dll:
• 0x508818 - GetFileTitleA
• 0x50881c - GetSaveFileNameA
• 0x508820 - GetOpenFileNameA
• 0x508824 - ChooseFontA
• 0x508828 - ChooseColorA
库 ADVAPI32.dll:
• 0x508000 - RegCreateKeyExA
• 0x508004 - CryptGetHashParam
• 0x508008 - CryptAcquireContextA
• 0x50800c - CryptCreateHash
• 0x508010 - CryptHashData
• 0x508014 - CryptDestroyHash
• 0x508018 - CryptReleaseContext
• 0x50801c - RegQueryValueA
• 0x508020 - RegSetValueExA
• 0x508024 - RegOpenKeyExA
• 0x508028 - RegCloseKey
库 SHELL32.dll:
• 0x5084b8 - SHGetSpecialFolderPathA
• 0x5084bc - DragQueryFileA
• 0x5084c0 - DragFinish
• 0x5084c4 - DragAcceptFiles
• 0x5084c8 - Shell_NotifyIconA
• 0x5084cc - ShellExecuteA
库 ole32.dll:
• 0x508830 - CoRevokeClassObject
• 0x508834 - CoRegisterMessageFilter
• 0x508838 - CoFreeUnusedLibraries
• 0x50883c - CreateILockBytesOnHGlobal
• 0x508840 - StgCreateDocfileOnILockBytes
• 0x508844 - StgOpenStorageOnILockBytes
• 0x508848 - OleFlushClipboard
• 0x50884c - OleIsCurrentClipboard
• 0x508850 - CoGetClassObject
• 0x508854 - CoTaskMemFree
• 0x508858 - CoTaskMemAlloc
• 0x50885c - CLSIDFromProgID
• 0x508860 - ReleaseStgMedium
• 0x508864 - RevokeDragDrop
• 0x508868 - RegisterDragDrop
• 0x50886c - OleInitialize
• 0x508870 - OleUninitialize
• 0x508874 - CLSIDFromString
• 0x508878 - CoCreateInstance
• 0x50887c - OleRun
库 OLEAUT32.dll:
• 0x50844c - VariantInit
• 0x508450 - VariantCopyInd
• 0x508454 - SafeArrayGetElement
• 0x508458 - SafeArrayAccessData
• 0x50845c - SafeArrayUnaccessData
• 0x508460 - SafeArrayGetDim
• 0x508464 - SysAllocString
• 0x508468 - SafeArrayGetUBound
• 0x50846c - VariantChangeType
• 0x508470 - VariantClear
• 0x508474 - VariantCopy
• 0x508478 - SafeArrayDestroy
• 0x50847c - SafeArrayCreate
• 0x508480 - SafeArrayPutElement
• 0x508484 - RegisterTypeLib
• 0x508488 - LHashValOfNameSys
• 0x50848c - VariantTimeToSystemTime
• 0x508490 - SysStringLen
• 0x508494 - LoadTypeLib
• 0x508498 - SafeArrayGetLBound
• 0x50849c - OleCreateFontIndirect
• 0x5084a0 - UnRegisterTypeLib
• 0x5084a4 - SysFreeString
• 0x5084a8 - SafeArrayGetElemsize
• 0x5084ac - SysAllocStringByteLen
• 0x5084b0 - SysAllocStringLen
库 COMCTL32.dll:
• 0x50803c - _TrackMouseEvent
• 0x508040 - None
• 0x508044 - ImageList_EndDrag
• 0x508048 - ImageList_Add
• 0x50804c - ImageList_BeginDrag
• 0x508050 - ImageList_Create
• 0x508054 - ImageList_Destroy
• 0x508058 - ImageList_DragEnter
• 0x50805c - ImageList_DragLeave
• 0x508060 - ImageList_DragMove
• 0x508064 - ImageList_DragShowNolock
库 oledlg.dll:
• 0x508884 - None
库 WLDAP32.dll:
• 0x5087e4 - None

投放文件

无信息

行为分析

互斥量(Mutexes)
  • Local\MSCTF.Asm.MutexDefault1
执行的命令 无信息
创建的服务 无信息
启动的服务 无信息

进程

_______________.exe PID: 2588, 上一级进程 PID: 2304

访问的文件
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Users\test\AppData\Local\Temp\iext1.fnr.bbs.125.la
  • C:\Users\test\AppData\Local\Temp\_______________.exe.Local\
  • C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
  • C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
  • C:\Users\test\AppData\Local\Temp\\x0b\x0c\x1aw
  • C:\Users\test\AppData\Local\Temp\_______________.exe
  • C:\Windows\Fonts\staticcache.dat
  • C:\Users\test\AppData\Local\Temp\gdiplus.dll
  • C:\Users\test\AppData\Local\Temp\kernel32.DLL
  • C:\Users\test\AppData\Local\Temp\ole32.dll
  • C:\Users\test\AppData\Local\Temp\GdiPlus.dll
  • C:\Users\test\AppData\Local\Temp\user32.DLL
  • C:\Users\test\AppData\Local\Temp\gdi32.DLL
  • C:\Users\test\AppData\Local\Temp\user32.dll
  • C:\Windows\System32\winhttp.dll
  • C:\Windows\System32\p2pcollab.dll
  • C:\Windows\System32\qagentrt.dll
  • C:\Windows\System32\dnsapi.dll
  • C:\Users\test\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\*
  • C:\Users\test\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\*
  • C:\Users\test\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\*
读取的文件
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Users\test\AppData\Local\Temp\iext1.fnr.bbs.125.la
  • C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
  • C:\Users\test\AppData\Local\Temp\\x0b\x0c\x1aw
  • C:\Users\test\AppData\Local\Temp\_______________.exe
  • C:\Windows\Fonts\staticcache.dat
  • C:\Windows\System32\winhttp.dll
修改的文件
  • C:\Users\test\AppData\Local\Temp\iext1.fnr.bbs.125.la
删除的文件 无信息
注册表键
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
  • HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000804
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\a
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\System
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\\xe5\xbe\xae\xe8\xbd\xaf\xe9\x9b\x85\xe9\xbb\x91
  • HKEY_CURRENT_USER
  • HKEY_CURRENT_USER\Control Panel\Desktop
  • HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\\xe5\xae\x8b\xe4\xbd\x93
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane11
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane12
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane13
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane14
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane15
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane16
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\_______________.exe
  • HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3697C5FA-60DD-4B56-92D4-74A569205C16}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3FC47A08-E5C9-4BCA-A2C7-BC9A282AED14}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
  • HKEY_CURRENT_USER\Keyboard Layout\Toggle
  • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
  • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
  • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
  • HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\KnownClasses
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Tracing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Tracing\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ShareCredsWithWinHttp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\DisableBranchCache
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextLockCount
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextListCount
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4b\AAF68885
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\AAF68885\LanguageList
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\AAF68885\@%SystemRoot%\system32\p2pcollab.dll,-8042
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\AAF68885\@%SystemRoot%\system32\dnsapi.dll,-103
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\ChainEngine\Config
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv
  • HKEY_USERS\S-1-5-21-2280033686-3172497658-3481507381-1000
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\PhysicalStores
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2280033686-3172497658-3481507381-1000
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2280033686-3172497658-3481507381-1000\ProfileImagePath
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\MY\
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\MY\Certificates
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\MY\CRLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\MY\CTLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\MY\Keys
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\PhysicalStores
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\CRLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\CTLs
  • HKEY_CURRENT_USER\
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA\Certificates
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA\CRLs
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\475BA6DA2AFD5AE3ADAE78A261CA0E3E548B9532
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\475BA6DA2AFD5AE3ADAE78A261CA0E3E548B9532\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\CA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CTLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPublisher\Safer
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\Certificates
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\CRLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\CTLs
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Disallowed
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\PhysicalStores
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\03A5B14663EB12023091B84A6D6A68BC871DE66B
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\03A5B14663EB12023091B84A6D6A68BC871DE66B\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\36527D4FA26A68F9EB4596F1D99ABB2C0EA76DFA
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\36527D4FA26A68F9EB4596F1D99ABB2C0EA76DFA\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\58E8ABB0361533FB80F79B1B6D29D3FF8D5F00F0
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\58E8ABB0361533FB80F79B1B6D29D3FF8D5F00F0\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\9F744E9F2B4DBAEC0F312C50B6563B8E2D93C311
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\9F744E9F2B4DBAEC0F312C50B6563B8E2D93C311\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\D69B561148F01C77C54578C10926DF5B856976AD
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\CRLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\CTLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A7217F919843199C958C128449DD52D2723B0A8A
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A7217F919843199C958C128449DD52D2723B0A8A\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D85213E038F309D02A40917B59E142368AE6B1C0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D85213E038F309D02A40917B59E142368AE6B1C0\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DBB84423C928ABE889D0E368FC3191D151DDB1AB
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DBB84423C928ABE889D0E368FC3191D151DDB1AB\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CTLs
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\SmartCardRoot
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CTLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\PhysicalStores
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\Certificates
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\CRLs
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\CTLs
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust\Certificates
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust\CRLs
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\trust
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CTLs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
  • HKEY_LOCAL_MACHINE\System\Setup
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllVerifyEncodedSignature
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllVerifyEncodedSignature
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllImportPublicKeyInfoEx2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllImportPublicKeyInfoEx2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyCertificateChainPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCertificateChainPolicy
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WOW\boot
  • HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib\ 800x600x24(BGR 0)
读取的注册表键
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000804
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\a
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
  • HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\\xe5\xae\x8b\xe4\xbd\x93
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane11
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane12
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane13
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane14
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane15
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane16
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
  • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
  • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
  • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Tracing\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ShareCredsWithWinHttp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\DisableBranchCache
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextLockCount
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextListCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\AAF68885\@%SystemRoot%\system32\p2pcollab.dll,-8042
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\AAF68885\@%SystemRoot%\system32\dnsapi.dll,-103
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2280033686-3172497658-3481507381-1000\ProfileImagePath
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\475BA6DA2AFD5AE3ADAE78A261CA0E3E548B9532\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\03A5B14663EB12023091B84A6D6A68BC871DE66B\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\36527D4FA26A68F9EB4596F1D99ABB2C0EA76DFA\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\58E8ABB0361533FB80F79B1B6D29D3FF8D5F00F0\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\9F744E9F2B4DBAEC0F312C50B6563B8E2D93C311\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob
  • HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A7217F919843199C958C128449DD52D2723B0A8A\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D85213E038F309D02A40917B59E142368AE6B1C0\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DBB84423C928ABE889D0E368FC3191D151DDB1AB\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
修改的注册表键
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\AAF68885\LanguageList
  • HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib
  • HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib\ 800x600x24(BGR 0)
删除的注册表键 无信息
API解析
  • kernel32.dll.IsProcessorFeaturePresent
  • cryptbase.dll.SystemFunction036
  • kernel32.dll.SortGetHandle
  • kernel32.dll.SortCloseHandle
  • kernel32.dll.InitializeCriticalSectionEx
  • kernel32.dll.FlsAlloc
  • kernel32.dll.FlsSetValue
  • kernel32.dll.FlsGetValue
  • kernel32.dll.LCMapStringEx
  • api-ms-win-core-synch-l1-2-0.dll.SleepConditionVariableCS
  • api-ms-win-core-synch-l1-2-0.dll.WakeAllConditionVariable
  • kernel32.dll.AreFileApisANSI
  • iext1.fnr.bbs.125.la.CreateIextInterface
  • user32.dll.GetWindowInfo
  • user32.dll.GetAncestor
  • user32.dll.GetMonitorInfoA
  • user32.dll.EnumDisplayMonitors
  • user32.dll.EnumDisplayDevicesA
  • gdi32.dll.ExtTextOutW
  • gdi32.dll.GdiIsMetaPrintDC
  • kernel32.dll.lstrcpynA
  • kernel32.dll.RtlMoveMemory
  • kernel32.dll.VirtualAlloc
  • kernel32.dll.LoadLibraryA
  • kernel32.dll.GetProcAddress
  • kernel32.dll.VirtualProtect
  • kernel32.dll.VirtualFree
  • comctl32.dll.ImageList_Draw
  • gdi32.dll.BitBlt
  • msimg32.dll.TransparentBlt
  • msvcrt.dll.free
  • msvfw32.dll.DrawDibOpen
  • user32.dll.GetDC
  • kernel32.dll.MulDiv
  • kernel32.dll.FlushInstructionCache
  • kernel32.dll.GetCurrentProcess
  • kernel32.dll.GetTickCount
  • kernel32.dll.VirtualQuery
  • kernel32.dll.SetFilePointer
  • kernel32.dll.GlobalAlloc
  • kernel32.dll.GlobalLock
  • kernel32.dll.GlobalUnlock
  • kernel32.dll.GlobalReAlloc
  • kernel32.dll.GlobalFree
  • kernel32.dll.FindResourceA
  • kernel32.dll.LoadResource
  • kernel32.dll.LockResource
  • kernel32.dll.SizeofResource
  • kernel32.dll.FreeLibrary
  • kernel32.dll.GetModuleFileNameA
  • kernel32.dll.GetModuleHandleA
  • kernel32.dll.GetVersion
  • kernel32.dll.GetCurrentThreadId
  • kernel32.dll.CreateFileA
  • kernel32.dll.GetFileSize
  • kernel32.dll.CloseHandle
  • kernel32.dll.ReadFile
  • kernel32.dll.SetLastError
  • comctl32.dll.ImageList_GetIcon
  • comctl32.dll.ImageList_GetImageInfo
  • comctl32.dll.ImageList_GetIconSize
  • gdi32.dll.SetWindowExtEx
  • gdi32.dll.SetWindowOrgEx
  • gdi32.dll.SetMapMode
  • gdi32.dll.SelectClipPath
  • gdi32.dll.EndPath
  • gdi32.dll.BeginPath
  • gdi32.dll.TextOutA
  • gdi32.dll.GetClipRgn
  • gdi32.dll.GetPixel
  • gdi32.dll.CreatePatternBrush
  • gdi32.dll.CreateFontIndirectA
  • gdi32.dll.SetViewportOrgEx
  • gdi32.dll.GetStockObject
  • gdi32.dll.GetTextExtentPoint32A
  • gdi32.dll.CreateRoundRectRgn
  • gdi32.dll.CreateFontA
  • gdi32.dll.SetViewportExtEx
  • gdi32.dll.SelectClipRgn
  • gdi32.dll.SelectObject
  • gdi32.dll.CreateCompatibleDC
  • gdi32.dll.DeleteDC
  • gdi32.dll.OffsetRgn
  • gdi32.dll.CombineRgn
  • gdi32.dll.CreateRectRgn
  • gdi32.dll.CreatePen
  • gdi32.dll.ExtCreateRegion
  • gdi32.dll.DeleteObject
  • gdi32.dll.Rectangle
  • gdi32.dll.SetPixel
  • gdi32.dll.PtInRegion
  • gdi32.dll.SetTextColor
  • gdi32.dll.SetBkMode
  • gdi32.dll.PatBlt
  • gdi32.dll.CreateDIBSection
  • gdi32.dll.GetObjectA
  • gdi32.dll.CreateCompatibleBitmap
  • gdi32.dll.GetTextExtentPointA
  • gdi32.dll.ExtTextOutA
  • gdi32.dll.SetBkColor
  • gdi32.dll.GetTextColor
  • gdi32.dll.CreateSolidBrush
  • msvcrt.dll.??3@YAXPAX@Z
  • msvcrt.dll.__CxxFrameHandler
  • msvcrt.dll.??2@YAPAXI@Z
  • msvcrt.dll._ftol
  • msvcrt.dll._mbsstr
  • msvcrt.dll._mbscmp
  • msvcrt.dll.__dllonexit
  • msvcrt.dll.malloc
  • msvcrt.dll._initterm
  • msvcrt.dll._adjust_fdiv
  • msvcrt.dll._onexit
  • msvcrt.dll.memcpy
  • msvfw32.dll.DrawDibDraw
  • msvfw32.dll.DrawDibClose
  • user32.dll.SetWindowsHookExA
  • user32.dll.UnhookWindowsHookEx
  • user32.dll.CallNextHookEx
  • user32.dll.GetClassNameA
  • user32.dll.IsWindow
  • user32.dll.EnumThreadWindows
  • user32.dll.EnumChildWindows
  • user32.dll.LockWindowUpdate
  • user32.dll.DestroyIcon
  • user32.dll.DrawStateA
  • user32.dll.ShowWindow
  • user32.dll.GetMenuItemID
  • user32.dll.GetWindowRgn
  • user32.dll.SetMenu
  • user32.dll.GetMenu
  • user32.dll.GetSubMenu
  • user32.dll.TrackPopupMenu
  • user32.dll.CreateWindowExA
  • user32.dll.DestroyWindow
  • user32.dll.SetWindowPos
  • user32.dll.GetClassLongA
  • user32.dll.ScreenToClient
  • user32.dll.SystemParametersInfoA
  • user32.dll.GetSystemMetrics
  • user32.dll.MenuItemFromPoint
  • user32.dll.GetMenuItemRect
  • user32.dll.GetMenuItemCount
  • user32.dll.SetMenuItemInfoA
  • user32.dll.IsMenu
  • user32.dll.GetUpdateRect
  • user32.dll.EqualRect
  • user32.dll.ShowScrollBar
  • user32.dll.SetWindowRgn
  • user32.dll.WindowFromDC
  • user32.dll.MoveWindow
  • user32.dll.GetSysColor
  • user32.dll.EnableScrollBar
  • user32.dll.GetScrollBarInfo
  • user32.dll.GetCapture
  • user32.dll.SetScrollPos
  • user32.dll.SetScrollInfo
  • user32.dll.GetScrollRange
  • user32.dll.GetScrollPos
  • user32.dll.GetScrollInfo
  • user32.dll.ReleaseDC
  • user32.dll.GetWindowDC
  • user32.dll.GetDCEx
  • user32.dll.EndPaint
  • user32.dll.BeginPaint
  • user32.dll.GetWindowLongW
  • user32.dll.SetWindowLongW
  • user32.dll.SetWindowLongA
  • user32.dll.ClientToScreen
  • user32.dll.FindWindowExA
  • user32.dll.GetMenuItemInfoA
  • user32.dll.GetParent
  • user32.dll.GetComboBoxInfo
  • user32.dll.TrackMouseEvent
  • user32.dll.GetIconInfo
  • user32.dll.GetClientRect
  • user32.dll.GetFocus
  • user32.dll.InflateRect
  • user32.dll.InvalidateRect
  • user32.dll.SetPropA
  • user32.dll.RemovePropA
  • user32.dll.CallWindowProcA
  • user32.dll.GetPropA
  • user32.dll.SetTimer
  • user32.dll.OffsetRect
  • user32.dll.KillTimer
  • user32.dll.EnableWindow
  • user32.dll.GetWindowLongA
  • user32.dll.SetRectEmpty
  • user32.dll.DrawIconEx
  • user32.dll.GetWindowTextA
  • user32.dll.DrawTextA
  • user32.dll.IsRectEmpty
  • user32.dll.IsIconic
  • user32.dll.IsZoomed
  • user32.dll.GetSystemMenu
  • user32.dll.GetMenuState
  • user32.dll.ReleaseCapture
  • user32.dll.GetMessageA
  • user32.dll.SetScrollRange
  • user32.dll.DispatchMessageA
  • user32.dll.SetRect
  • user32.dll.IsWindowVisible
  • user32.dll.RegisterClassExA
  • user32.dll.DefWindowProcA
  • user32.dll.IsWindowEnabled
  • user32.dll.SendMessageA
  • user32.dll.GetCursorPos
  • user32.dll.LoadCursorA
  • user32.dll.SetCursor
  • user32.dll.GetWindowRect
  • user32.dll.PtInRect
  • user32.dll.SetCapture
  • user32.dll.UpdateLayeredWindow
  • user32.dll.SetLayeredWindowAttributes
  • dciman32.dll.DCIOpenProvider
  • dciman32.dll.DCICloseProvider
  • dciman32.dll.DCICreatePrimary
  • dciman32.dll.DCIEndAccess
  • dciman32.dll.DCIBeginAccess
  • dciman32.dll.DCIDestroy
  • comctl32.dll.RegisterClassNameW
  • uxtheme.dll.EnableThemeDialogTexture
  • uxtheme.dll.OpenThemeData
  • imm32.dll.ImmIsIME
  • gdi32.dll.GetLayout
  • gdi32.dll.GdiRealizationInfo
  • gdi32.dll.FontIsLinked
  • advapi32.dll.RegOpenKeyExW
  • advapi32.dll.RegQueryInfoKeyW
  • gdi32.dll.GetTextFaceAliasW
  • advapi32.dll.RegEnumValueW
  • advapi32.dll.RegCloseKey
  • advapi32.dll.RegQueryValueExW
  • advapi32.dll.RegQueryValueExA
  • advapi32.dll.RegEnumKeyExW
  • gdi32.dll.GetTextExtentExPointWPri
  • urlmon.dll.#414
  • gdiplus.dll.GdiplusStartup
  • ole32.dll.CreateStreamOnHGlobal
  • gdiplus.dll.GdipLoadImageFromStream
  • windowscodecs.dll.DllGetClassObject
  • kernel32.dll.WerRegisterMemoryBlock
  • gdiplus.dll.GdipGetImageDimension
  • gdiplus.dll.GdipCreateFromHDC
  • gdiplus.dll.GdipDrawImageRect
  • gdiplus.dll.GdipDisposeImage
  • gdiplus.dll.GdipDeleteGraphics
  • ole32.dll.CoInitializeEx
  • ole32.dll.CoUninitialize
  • ole32.dll.CoRegisterInitializeSpy
  • ole32.dll.CoRevokeInitializeSpy
  • ole32.dll.CoInitialize
  • oleaut32.dll.#161
  • sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid
  • oleaut32.dll.#8
  • oleaut32.dll.#28
  • oleaut32.dll.#9
  • shlwapi.dll.StrRChrA
  • oleaut32.dll.#12
  • shlwapi.dll.StrCmpNW
  • oleaut32.dll.#4
  • oleaut32.dll.#6
  • shlwapi.dll.#153
  • ws2_32.dll.GetAddrInfoW
  • ws2_32.dll.WSASocketW
  • ws2_32.dll.#2
  • ws2_32.dll.#21
  • ws2_32.dll.#9
  • ws2_32.dll.WSAIoctl
  • ws2_32.dll.FreeAddrInfoW
  • ws2_32.dll.#6
  • ws2_32.dll.#5
  • schannel.dll.SpUserModeInitialize
  • advapi32.dll.RegCreateKeyExW
  • ws2_32.dll.WSASend
  • ws2_32.dll.WSARecv
  • secur32.dll.FreeContextBuffer
  • ncrypt.dll.SslOpenProvider
  • ncrypt.dll.GetSChannelInterface
  • bcryptprimitives.dll.GetHashInterface
  • ncrypt.dll.SslIncrementProviderReferenceCount
  • ncrypt.dll.SslImportKey
  • bcryptprimitives.dll.GetCipherInterface
  • ncrypt.dll.SslLookupCipherSuiteInfo
  • user32.dll.LoadStringW
  • ncrypt.dll.BCryptOpenAlgorithmProvider
  • ncrypt.dll.BCryptGetProperty
  • ncrypt.dll.BCryptCreateHash
  • ncrypt.dll.BCryptHashData
  • ncrypt.dll.BCryptFinishHash
  • ncrypt.dll.BCryptDestroyHash
  • crypt32.dll.CertGetCertificateChain
  • userenv.dll.GetUserProfileDirectoryW
  • sechost.dll.ConvertSidToStringSidW
  • sechost.dll.ConvertStringSidToSidW
  • userenv.dll.RegisterGPNotification
  • gpapi.dll.RegisterGPNotificationInternal
  • sechost.dll.OpenSCManagerW
  • sechost.dll.OpenServiceW
  • sechost.dll.CloseServiceHandle
  • sechost.dll.QueryServiceConfigW
  • cryptsp.dll.CryptAcquireContextA
  • cryptsp.dll.CryptCreateHash
  • cryptsp.dll.CryptHashData
  • cryptsp.dll.CryptVerifySignatureA
  • cryptsp.dll.CryptDestroyKey
  • cryptsp.dll.CryptDestroyHash
  • bcryptprimitives.dll.GetAsymmetricEncryptionInterface
  • ncrypt.dll.BCryptImportKeyPair
  • ncrypt.dll.BCryptVerifySignature
  • ncrypt.dll.BCryptDestroyKey
  • crypt32.dll.CertVerifyCertificateChainPolicy
  • crypt32.dll.CertFreeCertificateChain
  • crypt32.dll.CertDuplicateCertificateContext
  • ncrypt.dll.SslEncryptPacket
  • ncrypt.dll.SslDecryptPacket
  • oleaut32.dll.#2
  • ole32.dll.GetHGlobalFromStream
  • oleaut32.dll.#411
  • oleaut32.dll.#23
  • oleaut32.dll.#24
  • crypt32.dll.CertFreeCertificateContext
  • rpcrt4.dll.RpcBindingFree
  • oleaut32.dll.SysAllocString
  • oleaut32.dll.SysStringLen
  • oleaut32.dll.SysFreeString
  • kernel32.dll.lstrcpyn
  • ws2_32.dll.#3
  • ncrypt.dll.SslDecrementProviderReferenceCount
  • ncrypt.dll.SslFreeObject
  • ws2_32.dll.#116