General Info

File name

openvpn-install-2.4.7-I603.exe

Full analysis
https://app.any.run/tasks/6fb5e258-e1f2-4cf3-a982-991470ae7ab1
Verdict
Malicious activity
Analysis date
3/14/2019, 20:52:45
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
MD5

b04c1b28baac54b415cb88635b4dc815

SHA1

e34f5291917d1a9d2e0e94af8cf34c2f6d0eca1b

SHA256

0237be0be0156f869f38fb2f38842e3ab5df46c79b914eba580de3031c116651

SSDEEP

98304:6+ldZJUIozgux1p3zNoVmljXvz1oy8pvenqIkMK/JFhv07MTE:/XLUh91J+mp7d8pvsxkRhv0YY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
60 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Changes the autorun value in the registry
  • openvpn-install-2.4.7-I603.exe (PID: 3952)
Loads dropped or rewritten executable
  • tap-windows.exe (PID: 2628)
  • openvpn-install-2.4.7-I603.exe (PID: 3952)
Application was dropped or rewritten from another process
  • openvpnserv.exe (PID: 2824)
  • tapinstall.exe (PID: 4080)
  • tap-windows.exe (PID: 2628)
  • tapinstall.exe (PID: 3872)
  • ns4E61.tmp (PID: 3316)
  • ns4D75.tmp (PID: 3208)
  • ns4BF0.tmp (PID: 3524)
Removes files from Windows directory
  • DrvInst.exe (PID: 3092)
  • DrvInst.exe (PID: 3476)
Uses RUNDLL32.EXE to load library
  • DrvInst.exe (PID: 3476)
Executable content was dropped or overwritten
  • DrvInst.exe (PID: 3092)
  • DrvInst.exe (PID: 3476)
  • tapinstall.exe (PID: 3872)
  • tap-windows.exe (PID: 2628)
  • openvpn-install-2.4.7-I603.exe (PID: 3952)
Creates files in the driver directory
  • DrvInst.exe (PID: 3092)
  • DrvInst.exe (PID: 3476)
Modifies the open verb of a shell class
  • openvpn-install-2.4.7-I603.exe (PID: 3952)
Creates a software uninstall entry
  • tap-windows.exe (PID: 2628)
  • openvpn-install-2.4.7-I603.exe (PID: 3952)
Searches for installed software
  • DrvInst.exe (PID: 3476)
Creates files in the Windows directory
  • DrvInst.exe (PID: 3476)
  • DrvInst.exe (PID: 3092)
Starts application with an unusual extension
  • openvpn-install-2.4.7-I603.exe (PID: 3952)
  • tap-windows.exe (PID: 2628)
Creates files in the program directory
  • tap-windows.exe (PID: 2628)
  • openvpn-install-2.4.7-I603.exe (PID: 3952)
Low-level read access rights to disk partition
  • vssvc.exe (PID: 3892)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win32 Executable MS Visual C++ (generic) (42.2%)
.exe
|   Win64 Executable (generic) (37.3%)
.dll
|   Win32 Dynamic Link Library (generic) (8.8%)
.exe
|   Win32 Executable (generic) (6%)
.exe
|   Generic Win/DOS Executable (2.7%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2016:04:27 03:27:47+02:00
PEType:
PE32
LinkerVersion:
2.26
CodeSize:
35840
InitializedDataSize:
38912
UninitializedDataSize:
110080
EntryPoint:
0x4375
OSVersion:
4
ImageVersion:
6
SubsystemVersion:
4
Subsystem:
Windows GUI
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
27-Apr-2016 01:27:47
Detected languages
English - United States
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0090
Pages in file:
0x0003
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x0000
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x0000
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000080
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
7
Time date stamp:
27-Apr-2016 01:27:47
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x00008B24 0x00008C00 IMAGE_SCN_ALIGN_1024BYTES,IMAGE_SCN_ALIGN_16BYTES,IMAGE_SCN_ALIGN_1BYTES,IMAGE_SCN_ALIGN_256BYTES,IMAGE_SCN_ALIGN_2BYTES,IMAGE_SCN_ALIGN_32BYTES,IMAGE_SCN_ALIGN_4096BYTES,IMAGE_SCN_ALIGN_4BYTES,IMAGE_SCN_ALIGN_512BYTES,IMAGE_SCN_ALIGN_64BYTES,IMAGE_SCN_ALIGN_8192BYTES,IMAGE_SCN_ALIGN_MASK,IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 5.94493
.data 0x0000A000 0x000000E0 0x00000200 IMAGE_SCN_ALIGN_1024BYTES,IMAGE_SCN_ALIGN_16BYTES,IMAGE_SCN_ALIGN_2048BYTES,IMAGE_SCN_ALIGN_2BYTES,IMAGE_SCN_ALIGN_32BYTES,IMAGE_SCN_ALIGN_4096BYTES,IMAGE_SCN_ALIGN_4BYTES,IMAGE_SCN_ALIGN_512BYTES,IMAGE_SCN_ALIGN_64BYTES,IMAGE_SCN_ALIGN_8192BYTES,IMAGE_SCN_ALIGN_8BYTES,IMAGE_SCN_ALIGN_MASK,IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 1.62454
.rdata 0x0000B000 0x00006A38 0x00006C00 IMAGE_SCN_ALIGN_1024BYTES,IMAGE_SCN_ALIGN_16BYTES,IMAGE_SCN_ALIGN_2048BYTES,IMAGE_SCN_ALIGN_2BYTES,IMAGE_SCN_ALIGN_32BYTES,IMAGE_SCN_ALIGN_4096BYTES,IMAGE_SCN_ALIGN_4BYTES,IMAGE_SCN_ALIGN_512BYTES,IMAGE_SCN_ALIGN_64BYTES,IMAGE_SCN_ALIGN_8192BYTES,IMAGE_SCN_ALIGN_8BYTES,IMAGE_SCN_ALIGN_MASK,IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 7.22225
.bss 0x00012000 0x0001AD00 0x00000000 IMAGE_SCN_ALIGN_1024BYTES,IMAGE_SCN_ALIGN_16BYTES,IMAGE_SCN_ALIGN_2048BYTES,IMAGE_SCN_ALIGN_2BYTES,IMAGE_SCN_ALIGN_32BYTES,IMAGE_SCN_ALIGN_4096BYTES,IMAGE_SCN_ALIGN_4BYTES,IMAGE_SCN_ALIGN_512BYTES,IMAGE_SCN_ALIGN_64BYTES,IMAGE_SCN_ALIGN_8192BYTES,IMAGE_SCN_ALIGN_8BYTES,IMAGE_SCN_ALIGN_MASK,IMAGE_SCN_CNT_UNINITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.idata 0x0002D000 0x0000127C 0x00001400 IMAGE_SCN_ALIGN_1024BYTES,IMAGE_SCN_ALIGN_16BYTES,IMAGE_SCN_ALIGN_1BYTES,IMAGE_SCN_ALIGN_256BYTES,IMAGE_SCN_ALIGN_2BYTES,IMAGE_SCN_ALIGN_32BYTES,IMAGE_SCN_ALIGN_4096BYTES,IMAGE_SCN_ALIGN_4BYTES,IMAGE_SCN_ALIGN_512BYTES,IMAGE_SCN_ALIGN_64BYTES,IMAGE_SCN_ALIGN_8192BYTES,IMAGE_SCN_ALIGN_MASK,IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 5.15437
.ndata 0x0002F000 0x0001A000 0x00000400 IMAGE_SCN_ALIGN_1024BYTES,IMAGE_SCN_ALIGN_16BYTES,IMAGE_SCN_ALIGN_2048BYTES,IMAGE_SCN_ALIGN_2BYTES,IMAGE_SCN_ALIGN_32BYTES,IMAGE_SCN_ALIGN_4096BYTES,IMAGE_SCN_ALIGN_4BYTES,IMAGE_SCN_ALIGN_512BYTES,IMAGE_SCN_ALIGN_64BYTES,IMAGE_SCN_ALIGN_8192BYTES,IMAGE_SCN_ALIGN_8BYTES,IMAGE_SCN_ALIGN_MASK,IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.rsrc 0x00049000 0x00006DC8 0x00006E00 IMAGE_SCN_ALIGN_1024BYTES,IMAGE_SCN_ALIGN_16BYTES,IMAGE_SCN_ALIGN_1BYTES,IMAGE_SCN_ALIGN_256BYTES,IMAGE_SCN_ALIGN_2BYTES,IMAGE_SCN_ALIGN_32BYTES,IMAGE_SCN_ALIGN_4096BYTES,IMAGE_SCN_ALIGN_4BYTES,IMAGE_SCN_ALIGN_512BYTES,IMAGE_SCN_ALIGN_64BYTES,IMAGE_SCN_ALIGN_8192BYTES,IMAGE_SCN_ALIGN_MASK,IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 4.84468
Resources
1

2

3

4

5

6

102

103

104

105

106

107

110

111

Imports
    ADVAPI32.dll

    COMCTL32.DLL

    GDI32.dll

    KERNEL32.dll

    ole32.dll

    SHELL32.dll

    USER32.dll

Exports

    No exports.

Screenshots

Processes

Total processes
51
Monitored processes
14
Malicious processes
5
Suspicious processes
2

Behavior graph

+
drop and start start drop and start drop and start openvpn-install-2.4.7-i603.exe no specs openvpn-install-2.4.7-i603.exe ns4bf0.tmp no specs tap-windows.exe ns4d75.tmp no specs tapinstall.exe no specs ns4e61.tmp no specs tapinstall.exe drvinst.exe rundll32.exe no specs vssvc.exe no specs drvinst.exe no specs drvinst.exe openvpnserv.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3080
CMD
"C:\Users\admin\AppData\Local\Temp\openvpn-install-2.4.7-I603.exe"
Path
C:\Users\admin\AppData\Local\Temp\openvpn-install-2.4.7-I603.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
3221226540
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\openvpn-install-2.4.7-i603.exe
c:\systemroot\system32\ntdll.dll

PID
3952
CMD
"C:\Users\admin\AppData\Local\Temp\openvpn-install-2.4.7-I603.exe"
Path
C:\Users\admin\AppData\Local\Temp\openvpn-install-2.4.7-I603.exe
Indicators
Parent process
––
User
admin
Integrity Level
HIGH
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\openvpn-install-2.4.7-i603.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\version.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shdocvw.dll
c:\users\admin\appdata\local\temp\nsvee2f.tmp\system.dll
c:\users\admin\appdata\local\temp\nsvee2f.tmp\userinfo.dll
c:\windows\system32\riched20.dll
c:\users\admin\appdata\local\temp\nsvee2f.tmp\nsdialogs.dll
c:\windows\system32\comdlg32.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\users\admin\appdata\local\temp\nsvee2f.tmp\simplesc.dll
c:\users\admin\appdata\local\temp\nsvee2f.tmp\nsprocess.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\program files\openvpn\bin\openvpn.exe
c:\users\admin\appdata\local\temp\nsvee2f.tmp\nsexec.dll
c:\users\admin\appdata\local\temp\nsvee2f.tmp\ns4bf0.tmp
c:\program files\openvpn\bin\openvpn-gui.exe
c:\users\admin\appdata\local\temp\nsvee2f.tmp\dotnetchecker.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\microsoft.net\framework\v4.0.30319\clr.dll

PID
3524
CMD
"C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\ns4BF0.tmp" "C:\Users\admin\AppData\Local\Temp\tap-windows.exe" /S /SELECT_UTILITIES=1
Path
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\ns4BF0.tmp
Indicators
No indicators
Parent process
openvpn-install-2.4.7-I603.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\nsvee2f.tmp\ns4bf0.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\tap-windows.exe

PID
2628
CMD
"C:\Users\admin\AppData\Local\Temp\tap-windows.exe" /S /SELECT_UTILITIES=1
Path
C:\Users\admin\AppData\Local\Temp\tap-windows.exe
Indicators
Parent process
ns4BF0.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\tap-windows.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\users\admin\appdata\local\temp\nsn4d36.tmp\userinfo.dll
c:\users\admin\appdata\local\temp\nsn4d36.tmp\system.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\users\admin\appdata\local\temp\nsn4d36.tmp\nsexec.dll
c:\users\admin\appdata\local\temp\nsn4d36.tmp\ns4d75.tmp
c:\users\admin\appdata\local\temp\nsn4d36.tmp\ns4e61.tmp
c:\windows\system32\netutils.dll

PID
3208
CMD
"C:\Users\admin\AppData\Local\Temp\nsn4D36.tmp\ns4D75.tmp" "C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
Path
C:\Users\admin\AppData\Local\Temp\nsn4D36.tmp\ns4D75.tmp
Indicators
No indicators
Parent process
tap-windows.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\nsn4d36.tmp\ns4d75.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\program files\tap-windows\bin\tapinstall.exe

PID
4080
CMD
"C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
Path
C:\Program Files\TAP-Windows\bin\tapinstall.exe
Indicators
No indicators
Parent process
ns4D75.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Windows (R) Win 7 DDK provider
Description
Windows Setup API
Version
6.1.7600.16385 built by: WinDDK
Modules
Image
c:\program files\tap-windows\bin\tapinstall.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\wintrust.dll

PID
3316
CMD
"C:\Users\admin\AppData\Local\Temp\nsn4D36.tmp\ns4E61.tmp" "C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
Path
C:\Users\admin\AppData\Local\Temp\nsn4D36.tmp\ns4E61.tmp
Indicators
No indicators
Parent process
tap-windows.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\nsn4d36.tmp\ns4e61.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\program files\tap-windows\bin\tapinstall.exe

PID
3872
CMD
"C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
Path
C:\Program Files\TAP-Windows\bin\tapinstall.exe
Indicators
Parent process
ns4E61.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Windows (R) Win 7 DDK provider
Description
Windows Setup API
Version
6.1.7600.16385 built by: WinDDK
Modules
Image
c:\program files\tap-windows\bin\tapinstall.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\spinf.dll
c:\windows\system32\netcfgx.dll
c:\windows\system32\slc.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nci.dll
c:\windows\system32\wlaninst.dll
c:\windows\system32\wwaninst.dll
c:\windows\system32\newdev.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\drvstore.dll

PID
3476
CMD
DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{3502f335-5614-43cb-98fc-407179cd7253}\oemvista.inf" "0" "6d14a44ff" "000005C0" "WinSta0\Default" "000005BC" "208" "c:\program files\tap-windows\driver"
Path
C:\Windows\system32\DrvInst.exe
Indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Driver Installation Module
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\drvstore.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\spinf.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rundll32.exe
c:\windows\system32\ntmarta.dll
c:\windows\system32\srclient.dll
c:\windows\system32\spp.dll
c:\windows\system32\vssapi.dll
c:\windows\system32\atl.dll
c:\windows\system32\vsstrace.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\vss_ps.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\es.dll
c:\windows\system32\sxs.dll
c:\windows\system32\propsys.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\netutils.dll

PID
2416
CMD
rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{5cfbbe6b-6bcb-0bab-07e7-276333807744} Global\{1f50f1de-0d59-092c-6969-1f0873c9e706} C:\Windows\System32\DriverStore\Temp\{1c0b2307-c612-761b-fd51-a07f75371e1a}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{1c0b2307-c612-761b-fd51-a07f75371e1a}\tap0901.cat
Path
C:\Windows\system32\rundll32.exe
Indicators
No indicators
Parent process
DrvInst.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows host process (Rundll32)
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\pnpui.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\dui70.dll
c:\windows\system32\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\spinf.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\propsys.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\slc.dll
c:\windows\system32\imageres.dll
c:\windows\system32\duser.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\xmllite.dll
c:\windows\system32\netutils.dll

PID
3892
CMD
C:\Windows\system32\vssvc.exe
Path
C:\Windows\system32\vssvc.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
Microsoft Corporation
Description
Microsoft® Volume Shadow Copy Service
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\atl.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\vssapi.dll
c:\windows\system32\vsstrace.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\clusapi.dll
c:\windows\system32\cryptdll.dll
c:\windows\system32\xolehlp.dll
c:\windows\system32\version.dll
c:\windows\system32\resutils.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\authz.dll
c:\windows\system32\virtdisk.dll
c:\windows\system32\fltlib.dll
c:\windows\system32\msctf.dll
c:\windows\system32\imm32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\vss_ps.dll
c:\windows\system32\samlib.dll
c:\windows\system32\es.dll
c:\windows\system32\propsys.dll
c:\windows\system32\catsrvut.dll
c:\windows\system32\mfcsubs.dll
c:\windows\system32\sxs.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll

PID
3340
CMD
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000005E0" "000005D4"
Path
C:\Windows\system32\DrvInst.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Driver Installation Module
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\spinf.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\spfileq.dll

PID
3092
CMD
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oemvista.inf:tap0901:tap0901.ndi:9.0.0.21:tap0901" "6d14a44ff" "000005C0" "000005D0" "000005E0"
Path
C:\Windows\system32\DrvInst.exe
Indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Driver Installation Module
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\spinf.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\netcfgx.dll
c:\windows\system32\slc.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nci.dll
c:\windows\system32\wlaninst.dll
c:\windows\system32\wwaninst.dll
c:\windows\system32\spfileq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ndiscapcfg.dll
c:\windows\system32\rascfg.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\mprapi.dll
c:\windows\system32\mprmsg.dll
c:\windows\system32\tcpipcfg.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\wshnetbs.dll

PID
2824
CMD
"C:\Program Files\OpenVPN\bin\openvpnserv.exe"
Path
C:\Program Files\OpenVPN\bin\openvpnserv.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
The OpenVPN Project
Description
OpenVPN Service
Version
2.4.7.0
Modules
Image
c:\program files\openvpn\bin\openvpnserv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll

Registry activity

Total events
1556
Read events
960
Write events
546
Delete events
50

Modification events

PID
Process
Operation
Key
Name
Value
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
config_dir
C:\Program Files\OpenVPN\config
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
config_ext
ovpn
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
exe_path
C:\Program Files\OpenVPN\bin\openvpn.exe
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
log_dir
C:\Program Files\OpenVPN\log
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
priority
NORMAL_PRIORITY_CLASS
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
log_append
0
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
ovpn_admin_group
OpenVPN Administrators
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
disable_save_passwords
0
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
tap
installed
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\OpenVPN_UserSetup
OpenVPN Setup
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\OpenVPN_UserSetup
Version
2,4,0,0
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\OpenVPN_UserSetup
IsInstalled
1
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\OpenVPN_UserSetup
DontAsk
2
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\OpenVPN_UserSetup
StubPath
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OPENVPN-GUI /t REG_SZ /d "C:\Program Files\OpenVPN\bin\openvpn-gui.exe" /f
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ovpn
OpenVPNFile
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OpenVPNFile
OpenVPN Config File
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OpenVPNFile\shell
open
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon
C:\Program Files\OpenVPN\icon.ico,0
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command
notepad.exe "%1"
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run
Start OpenVPN on this config file
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command
"C:\Program Files\OpenVPN\bin\openvpn.exe" --pause-exit --config "%1"
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
C:\Program Files\OpenVPN
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
DisplayName
OpenVPN 2.4.7-I603
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
UninstallString
C:\Program Files\OpenVPN\Uninstall.exe
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
DisplayIcon
C:\Program Files\OpenVPN\icon.ico
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
DisplayVersion
2.4.7-I603
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
HelpLink
https://openvpn.net/index.php/open-source.html
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
InstallLocation
C:\Program Files\OpenVPN\
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
Language
1033
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
NoModify
1
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
NoRepair
1
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
Publisher
OpenVPN Technologies, Inc.
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
URLInfoAbout
https://openvpn.net
3952
openvpn-install-2.4.7-I603.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenVPN
EstimatedSize
7122
2628
tap-windows.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\TAP-Windows
C:\Program Files\TAP-Windows
2628
tap-windows.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TAP-Windows
DisplayName
TAP-Windows 9.21.2
2628
tap-windows.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TAP-Windows
UninstallString
C:\Program Files\TAP-Windows\Uninstall.exe
2628
tap-windows.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TAP-Windows
DisplayIcon
C:\Program Files\TAP-Windows\icon.ico
2628
tap-windows.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TAP-Windows
DisplayVersion
9.21.2
3872
tapinstall.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
setupapi.app.log
4096
3872
tapinstall.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
setupapi.dev.log
4096
3872
tapinstall.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3476
DrvInst.exe
write
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
SrCreateRp (Enter)
4000000000000000DA0EA79C9FDAD401940D00007C0D0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppCreate (Enter)
4000000000000000DA0EA79C9FDAD401940D00007C0D0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
LastIndex
20
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppGatherWriterMetadata (Enter)
4000000000000000AC58129D9FDAD401940D00007C0D0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
IDENTIFY (Enter)
4000000000000000AC58129D9FDAD401940D0000BC0F0000E8030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
IDENTIFY (Leave)
40000000000000006C3AF79D9FDAD401940D0000BC0F0000E8030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppGatherWriterMetadata (Leave)
40000000000000003E3827A39FDAD401940D00007C0D0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppAddInterestingComponents (Enter)
40000000000000003E3827A39FDAD401940D00007C0D0000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppAddInterestingComponents (Leave)
4000000000000000B4E837A39FDAD401940D00007C0D0000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
PREPAREBACKUP (Enter)
400000000000000084FB4AA39FDAD401940D0000BC0C0000E9030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
PREPAREBACKUP (Leave)
4000000000000000BC9767A39FDAD401940D0000BC0C0000E9030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
GETSTATE (Enter)
4000000000000000BC9767A39FDAD401940D0000D80C0000F9030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
GETSTATE (Leave)
40000000000000007E8373A39FDAD401940D0000D80C0000F9030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
DOSNAPSHOT (Enter)
4000000000000000324878A39FDAD401940D00007C0D00000A040000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
DOSNAPSHOT (Leave)
4000000000000000DE8A7EA49FDAD401940D0000E40C00000A040000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppCreate (Leave)
4000000000000000DE8A7EA49FDAD401940D00007C0D0000D0070000010000000000000000000000000000000000000000000000000000000000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
SrCreateRp (Leave)
400000000000000038ED80A49FDAD401940D00007C0D0000D5070000010000000000000000000000000000000000000000000000000000000000000000000000
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
FirstRun
0
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
LastIndex
20
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
NestingLevel
1
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
StartNesting
DA0EA79C9FDAD401
3476
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
NestingLevel
0
2416
rundll32.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
IDENTIFY (Enter)
40000000000000007C6B259D9FDAD401340F0000180E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
IDENTIFY (Enter)
40000000000000007C6B259D9FDAD401340F0000100E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
IDENTIFY (Enter)
40000000000000007C6B259D9FDAD401340F0000B0090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
IDENTIFY (Enter)
40000000000000007C6B259D9FDAD401340F0000A4090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
IDENTIFY (Leave)
400000000000000030302A9D9FDAD401340F0000A4090000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
IDENTIFY (Leave)
40000000000000008A922C9D9FDAD401340F0000180E0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
IDENTIFY (Leave)
40000000000000008A922C9D9FDAD401340F0000B0090000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
IDENTIFY (Leave)
40000000000000003E57319D9FDAD401340F0000100E0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_BEGINPREPARE (Enter)
40000000000000002A9948A39FDAD401340F0000100E000001040000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_BEGINPREPARE (Leave)
400000000000000084FB4AA39FDAD401340F0000100E000001040000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPAREBACKUP (Enter)
400000000000000046E756A39FDAD401340F0000180E0000E9030000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPAREBACKUP (Enter)
400000000000000046E756A39FDAD401340F0000100E0000E9030000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPAREBACKUP (Enter)
400000000000000046E756A39FDAD401340F0000B0090000E9030000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPAREBACKUP (Leave)
4000000000000000A04959A39FDAD401340F0000180E0000E9030000000000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_STABLE (SetCurrentState)
4000000000000000A04959A39FDAD401340F0000180E000001000000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPAREBACKUP (Leave)
4000000000000000A04959A39FDAD401340F0000B0090000E9030000000000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_STABLE (SetCurrentState)
4000000000000000A04959A39FDAD401340F0000B009000001000000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPAREBACKUP (Leave)
4000000000000000A04959A39FDAD401340F0000100E0000E9030000000000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_STABLE (SetCurrentState)
4000000000000000A04959A39FDAD401340F0000100E000001000000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
GETSTATE (Enter)
4000000000000000242171A39FDAD401340F0000100E0000F9030000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
GETSTATE (Enter)
4000000000000000242171A39FDAD401340F0000180E0000F9030000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
GETSTATE (Enter)
4000000000000000242171A39FDAD401340F0000B0090000F9030000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
GETSTATE (Leave)
40000000000000007E8373A39FDAD401340F0000180E0000F9030000000000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
GETSTATE (Leave)
40000000000000007E8373A39FDAD401340F0000B0090000F9030000000000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
GETSTATE (Leave)
40000000000000007E8373A39FDAD401340F0000100E0000F9030000000000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_ENDPREPARE (Enter)
4000000000000000324878A39FDAD401340F0000DC0C000002040000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_ENDPREPARE (Leave)
40000000000000000492E3A39FDAD401340F0000DC0C000002040000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
PREPARESNAPSHOT (Enter)
40000000000000000492E3A39FDAD401340F0000DC0C0000EA030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPARESNAPSHOT (Enter)
40000000000000007A42F4A39FDAD401340F00004C0D0000EA030000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPARESNAPSHOT (Enter)
40000000000000007A42F4A39FDAD401340F0000880C0000EA030000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPARESNAPSHOT (Enter)
40000000000000007A42F4A39FDAD401340F00008C0C0000EA030000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPARESNAPSHOT (Leave)
4000000000000000FE190CA49FDAD401340F00004C0D0000EA030000000000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
4000000000000000FE190CA49FDAD401340F00004C0D000002000000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPARESNAPSHOT (Leave)
4000000000000000587C0EA49FDAD401340F0000880C0000EA030000000000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
4000000000000000587C0EA49FDAD401340F0000880C000002000000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPARESNAPSHOT (Leave)
40000000000000000C4113A49FDAD401340F00008C0C0000EA030000000000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
40000000000000000C4113A49FDAD401340F00008C0C000002000000010000000100000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
PREPARESNAPSHOT (Leave)
400000000000000006C93BA49FDAD401340F0000DC0C0000EA030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE (Enter)
400000000000000006C93BA49FDAD401340F0000DC0C0000EB030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_FRONT (Enter)
400000000000000006C93BA49FDAD401340F0000DC0C0000EC030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
FREEZE (Enter)
4000000000000000602B3EA49FDAD401340F00008C0C0000EB030000010000000200000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
FREEZE (Leave)
4000000000000000602B3EA49FDAD401340F00008C0C0000EB030000000000000200000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
4000000000000000602B3EA49FDAD401340F00008C0C000003000000010000000200000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BKGND_FREEZE_THREAD (Enter)
4000000000000000602B3EA49FDAD401340F0000B80E0000FC030000010000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_FRONT (Leave)
4000000000000000BA8D40A49FDAD401340F0000DC0C0000EC030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_BACK (Enter)
4000000000000000BA8D40A49FDAD401340F0000DC0C0000ED030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_BACK (Leave)
400000000000000014F042A49FDAD401340F0000DC0C0000ED030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_SYSTEM (Enter)
400000000000000014F042A49FDAD401340F0000DC0C0000EE030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
FREEZE (Enter)
40000000000000006E5245A49FDAD401340F00004C0D0000EB030000010000000200000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
FREEZE (Leave)
40000000000000006E5245A49FDAD401340F00004C0D0000EB030000000000000200000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
40000000000000006E5245A49FDAD401340F00004C0D000003000000010000000200000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BKGND_FREEZE_THREAD (Enter)
4000000000000000C8B447A49FDAD401340F00009C0E0000FC030000010000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_SYSTEM (Leave)
4000000000000000D6DB4EA49FDAD401340F0000DC0C0000EE030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_KTM (Enter)
4000000000000000D6DB4EA49FDAD401340F0000DC0C0000F0030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_KTM (Leave)
4000000000000000D6DB4EA49FDAD401340F0000DC0C0000F0030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_RM (Enter)
4000000000000000D6DB4EA49FDAD401340F0000DC0C0000EF030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
FREEZE (Enter)
40000000000000008AA053A49FDAD401340F0000880C0000EB030000010000000200000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
FREEZE (Leave)
40000000000000003E6558A49FDAD401340F0000880C0000EB030000000000000200000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
40000000000000003E6558A49FDAD401340F0000880C000003000000010000000200000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BKGND_FREEZE_THREAD (Enter)
40000000000000003E6558A49FDAD401340F000044080000FC030000010000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_RM (Leave)
40000000000000003E6558A49FDAD401340F0000DC0C0000EF030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE (Leave)
40000000000000003E6558A49FDAD401340F0000DC0C0000EB030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PRECOMMIT (Enter)
40000000000000003E6558A49FDAD401340F0000DC0C000003040000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PRECOMMIT (Leave)
40000000000000003E6558A49FDAD401340F0000DC0C000003040000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
OPEN_VOLUME_HANDLE (Enter)
40000000000000003E6558A49FDAD401340F0000DC0C0000FD030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
OPEN_VOLUME_HANDLE (Enter)
400000000000000098C75AA49FDAD401340F0000000F0000FD030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
OPEN_VOLUME_HANDLE (Leave)
400000000000000068DA6DA49FDAD401340F0000000F0000FD030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
OPEN_VOLUME_HANDLE (Leave)
400000000000000068DA6DA49FDAD401340F0000DC0C0000FD030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_FLUSH_AND_HOLD (Enter)
400000000000000068DA6DA49FDAD401340F0000000F0000FE030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_FLUSH_AND_HOLD (Leave)
40000000000000002AC679A49FDAD401340F0000000F0000FE030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_RELEASE (Enter)
40000000000000002AC679A49FDAD401340F0000000F0000FF030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_RELEASE (Leave)
40000000000000002AC679A49FDAD401340F0000000F0000FF030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_FLUSH_AND_HOLD (Enter)
400000000000000068DA6DA49FDAD401340F0000DC0C0000FE030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_FLUSH_AND_HOLD (Leave)
40000000000000002AC679A49FDAD401340F0000DC0C0000FE030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_RELEASE (Enter)
40000000000000002AC679A49FDAD401340F0000DC0C0000FF030000010000000000000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_RELEASE (Leave)
40000000000000002AC679A49FDAD401340F0000DC0C0000FF030000000000000000000000000000000000000000000000000000000000000000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_COMMIT (Enter)
40000000000000002AC679A49FDAD401340F0000DC04000004040000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_COMMIT (Leave)
40000000000000002AC679A49FDAD401340F0000DC04000004040000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTCOMMIT (Enter)
40000000000000002AC679A49FDAD401340F0000DC0C000005040000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTCOMMIT (Leave)
4000000000000000DE8A7EA49FDAD401340F0000DC0C000005040000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW_KTM (Enter)
4000000000000000DE8A7EA49FDAD401340F0000DC0C0000F4030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW_KTM (Leave)
4000000000000000DE8A7EA49FDAD401340F0000DC0C0000F4030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW (Enter)
4000000000000000DE8A7EA49FDAD401340F0000DC0C0000F2030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
THAW (Enter)
4000000000000000461488A49FDAD401340F0000880C0000F2030000010000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BKGND_FREEZE_THREAD (Leave)
4000000000000000461488A49FDAD401340F000044080000FC030000000000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
THAW (Leave)
4000000000000000461488A49FDAD401340F0000880C0000F2030000000000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
4000000000000000461488A49FDAD401340F0000880C000004000000010000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
THAW (Enter)
4000000000000000461488A49FDAD401340F0000B80C0000F2030000010000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BKGND_FREEZE_THREAD (Leave)
4000000000000000461488A49FDAD401340F00009C0E0000FC030000000000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
THAW (Leave)
4000000000000000461488A49FDAD401340F0000B80C0000F2030000000000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
4000000000000000461488A49FDAD401340F0000B80C000004000000010000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
THAW (Enter)
4000000000000000461488A49FDAD401340F00004C0D0000F2030000010000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BKGND_FREEZE_THREAD (Leave)
4000000000000000461488A49FDAD401340F0000B80E0000FC030000000000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
THAW (Leave)
4000000000000000461488A49FDAD401340F00004C0D0000F2030000000000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
4000000000000000461488A49FDAD401340F00004C0D000004000000010000000300000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW (Leave)
4000000000000000461488A49FDAD401340F0000DC0C0000F2030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PREFINALCOMMIT (Enter)
4000000000000000461488A49FDAD401340F0000DC0C000006040000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PREFINALCOMMIT (Leave)
4000000000000000865FD4A49FDAD401340F0000DC0C000006040000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
POSTSNAPSHOT (Enter)
4000000000000000865FD4A49FDAD401340F0000DC0C0000F5030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
POSTSNAPSHOT (Enter)
4000000000000000B0D4E9A49FDAD401340F000000060000F5030000010000000400000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
POSTSNAPSHOT (Enter)
4000000000000000B0D4E9A49FDAD401340F0000D80C0000F5030000010000000400000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
POSTSNAPSHOT (Enter)
4000000000000000B0D4E9A49FDAD401340F00004C0D0000F5030000010000000400000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
POSTSNAPSHOT (Leave)
4000000000000000B0D4E9A49FDAD401340F00004C0D0000F5030000000000000400000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
4000000000000000B0D4E9A49FDAD401340F00004C0D000005000000010000000400000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
POSTSNAPSHOT (Leave)
4000000000000000B0D4E9A49FDAD401340F000000060000F5030000000000000400000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
4000000000000000B0D4E9A49FDAD401340F00000006000005000000010000000400000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
POSTSNAPSHOT (Leave)
40000000000000002AF3AAA59FDAD401340F0000D80C0000F5030000000000000400000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
40000000000000002AF3AAA59FDAD401340F0000D80C000005000000010000000400000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
POSTSNAPSHOT (Leave)
40000000000000002AF3AAA59FDAD401340F0000DC0C0000F5030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTFINALCOMMIT (Enter)
40000000000000002AF3AAA59FDAD401340F0000DC0C000007040000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTFINALCOMMIT (Leave)
400000000000000070B6CEA59FDAD401340F0000DC0C000007040000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
BACKUPSHUTDOWN (Enter)
4000000000000000D83FD8A59FDAD401340F0000DC0C0000FB030000010000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BACKUPSHUTDOWN (Enter)
4000000000000000E666DFA59FDAD401340F00008C0C0000FB030000010000000500000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BACKUPSHUTDOWN (Leave)
4000000000000000E666DFA59FDAD401340F00008C0C0000FB030000000000000500000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BACKUPSHUTDOWN (Enter)
4000000000000000E666DFA59FDAD401340F0000880C0000FB030000010000000500000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BACKUPSHUTDOWN (Leave)
4000000000000000E666DFA59FDAD401340F0000880C0000FB030000000000000500000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BACKUPSHUTDOWN (Enter)
4000000000000000E666DFA59FDAD401340F0000B80C0000FB030000010000000500000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BACKUPSHUTDOWN (Leave)
4000000000000000E666DFA59FDAD401340F0000B80C0000FB030000000000000500000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3892
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
BACKUPSHUTDOWN (Leave)
4000000000000000E666DFA59FDAD401340F0000DC0C0000FB030000000000000000000000000000321D587DF0A8A243A967834D74B740F10000000000000000
3340
DrvInst.exe
write
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\Interfaces
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin\enum
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MAC
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus\enum
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ip
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ipv6
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ip
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ipv6
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ip
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ipv6
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\00000017
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration\Providers\NetBIOS
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\00000018
3092
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NetCfgLockHolder
3092
DrvInst.exe
write
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi
Service
tap0901
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\Interfaces
UpperRange
ndis5
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\Interfaces
LowerRange
ethernet
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey
Manufacturer
TAP-Windows Provider V9
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey
ProductName
TAP-Windows Adapter V9
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
ParamDesc
MTU
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Type
int
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Default
1500
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Optional
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Min
100
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Max
1500
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Step
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
ParamDesc
Media Status
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
Type
enum
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
Default
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
Optional
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus\enum
0
Application Controlled
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus\enum
1
Always Connected
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MAC
ParamDesc
MAC Address
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MAC
Type
edit
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MAC
Optional
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
ParamDesc
Non-Admin Access
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
Type
enum
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
Default
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
Optional
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin\enum
0
Not Allowed
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin\enum
1
Allowed
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles
%SystemPath%\system32\DRIVERS\tap0901.sys
5
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
NewDeviceInstall
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
NetCfgInstanceId
{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
*IfType
6
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
Characteristics
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
*MediaType
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
*PhysicalMediaType
14
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{66531E34-9D48-4A63-9ABB-208388FC56BD}\Connection
DefaultNameResourceId
1803
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{66531E34-9D48-4A63-9ABB-208388FC56BD}\Connection
DefaultNameIndex
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{66531E34-9D48-4A63-9ABB-208388FC56BD}\Connection
Name
Local Area Connection
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
NetLuidIndex
9
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
DeviceInstanceID
ROOT\NET\0000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
InstallTimeStamp
E307030004000E001300350033004B03
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi
Service
tap0901
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\Interfaces
UpperRange
ndis5
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\Interfaces
LowerRange
ethernet
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
Manufacturer
TAP-Windows Provider V9
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
ProductName
TAP-Windows Adapter V9
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
ParamDesc
MTU
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Type
int
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Default
1500
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Optional
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Min
100
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Max
1500
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Step
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin\enum
1
Allowed
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\GroupOrderList
NDIS
170000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F0000001000000011000000120000001300000014000000150000001600000017000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NetCfgLockHolder
INetCfg Installer Interface
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus
ParamDesc
Media Status
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus
Type
enum
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus
Default
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus
Optional
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus\enum
0
Application Controlled
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus\enum
1
Always Connected
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MAC
ParamDesc
MAC Address
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MAC
Type
edit
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MAC
Optional
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin
ParamDesc
Non-Admin Access
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin
Type
enum
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin
Default
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin
Optional
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin\enum
0
Not Allowed
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
ComponentId
tap0901
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions
TAP-Windows Adapter V9
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\NET\0000\Device Parameters
InstanceIndex
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
AllowNonAdmin
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
MediaStatus
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
MTU
1500
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Linkage
Bind
\Device\Smb_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Linkage
Route
"Smb" "Tcpip" "{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Linkage
Export
\Device\LanmanServer_Smb_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Linkage
LanaMap
01030100010401010102
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Parameters
MaxLana
4
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Linkage
Bind
\Device\NetBT_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Linkage
Route
"NetBT" "Tcpip" "{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Linkage
Export
\Device\NetBIOS_NetBT_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Linkage
Bind
\Device\Smb_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Linkage
Route
"Smb" "Tcpip" "{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Linkage
Export
\Device\LanmanWorkstation_Smb_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio\Linkage
Bind
\Device\{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio\Linkage
Route
"{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio\Linkage
Export
\Device\Ndisuio_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe\Linkage
Bind
\Device\{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe\Linkage
Route
"{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe\Linkage
Export
\Device\RasPppoe_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr\Linkage
Bind
\Device\{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr\Linkage
Route
"{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr\Linkage
Export
\Device\rspndr_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio\Linkage
Bind
\Device\{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio\Linkage
Route
"{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio\Linkage
Export
\Device\lltdio_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Linkage
Bind
\Device\{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Linkage
Route
"{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Linkage
Export
\Device\Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb\Linkage
Bind
\Device\Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb\Linkage
Route
"Tcpip" "{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb\Linkage
Export
\Device\Smb_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Linkage
Bind
\Device\Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Linkage
Route
"Tcpip" "{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Linkage
Export
\Device\NetBT_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Linkage
Bind
\Device\{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Linkage
Route
"{66531E34-9D48-4A63-9ABB-208388FC56BD}"
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Linkage
Export
\Device\Tcpip6_{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Linkage
RootDevice
{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Linkage
UpperBind
Ndisuio
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Linkage
Export
\Device\{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces
Stamp
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
InterfaceName
Loopback
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
Type
5
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
Enabled
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\RouterManagers
Stamp
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
Stamp
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ip
ProtocolId
33
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ip
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
InterfaceName
Internal
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
Type
4
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
Enabled
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
Stamp
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ip
ProtocolId
33
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ip
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ipv6
ProtocolId
87
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ipv6
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ipv6
ProtocolId
87
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ipv6
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
InterfaceName
{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
Type
3
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
Enabled
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
Stamp
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ip
ProtocolId
33
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ip
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ipv6
ProtocolId
87
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ipv6
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3
InterfaceName
{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3
Type
3
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3
Enabled
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3
Stamp
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3\Ip
ProtocolId
33
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3\Ip
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3\Ipv6
ProtocolId
87
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3\Ipv6
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0004
MaxWanEndpoints
3
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0003
MaxWanEndpoints
3
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0002
MaxWanEndpoints
3
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0000
MaxWanEndpoints
3
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0001
MaxWanEndpoints
3
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0003
WanEndpoints
2
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0002
WanEndpoints
2
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0000
WanEndpoints
2
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0001
WanEndpoints
2
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
SearchList
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
UseDomainNameDevolution
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
IPEnableRouter
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
EnableICMPRedirect
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
DeadGWDetectDefault
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
DontAddDefaultGatewayDefault
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Adapters\{66531E34-9D48-4A63-9ABB-208388FC56BD}
LLInterface
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Adapters\{66531E34-9D48-4A63-9ABB-208388FC56BD}
IpConfig
Tcpip\Parameters\Interfaces\{66531E34-9D48-4A63-9ABB-208388FC56BD}
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
EnableDHCP
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
NameServer
192.168.100.2
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Domain
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
RegistrationEnabled
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
RegisterAdapterName
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}\Parameters\Tcpip
EnableDHCP
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}\Parameters\Tcpip
IPAddress
192.168.100.237
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}\Parameters\Tcpip
SubnetMask
255.255.255.0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}\Parameters\Tcpip
DefaultGateway
192.168.100.2
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dhcp\Configurations
Options
32000000000000000400000000000000FFFFFF7F0000000001000000000000000400000000000000FFFFFF7F00000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{66531E34-9D48-4A63-9ABB-208388FC56BD}
UseZeroBroadcast
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{66531E34-9D48-4A63-9ABB-208388FC56BD}
EnableDeadGWDetect
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{66531E34-9D48-4A63-9ABB-208388FC56BD}
EnableDHCP
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{66531E34-9D48-4A63-9ABB-208388FC56BD}
NameServer
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{66531E34-9D48-4A63-9ABB-208388FC56BD}
Domain
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{66531E34-9D48-4A63-9ABB-208388FC56BD}
RegistrationEnabled
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{66531E34-9D48-4A63-9ABB-208388FC56BD}
RegisterAdapterName
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{66531E34-9D48-4A63-9ABB-208388FC56BD}\Parameters\Tcpip
EnableDHCP
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters
EnableLMHOSTS
1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
NameServerList
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
NetbiosOptions
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
NameServerList
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}
NetbiosOptions
0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041006600020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192E90300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
ProtocolName
@%SystemRoot%\System32\wshtcpip.dll,-60100
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041000906020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192EA0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
ProtocolName
@%SystemRoot%\System32\wshtcpip.dll,-60101
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D0046004100090602000000000000000000000000000C000000A01A0FE78BABCF118CA300805F48A192EB0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000300000000000000FF0000000000000000000000008000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300032000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
ProtocolName
@%SystemRoot%\System32\wshtcpip.dll,-60102
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041006600020000000000000000000000000008000000C0B0EAF9D426D011BBBF00AA006C34E4EC030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
ProtocolName
@%SystemRoot%\System32\wship6.dll,-60100
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041000906020000000000000000000000000008000000C0B0EAF9D426D011BBBF00AA006C34E4ED030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
ProtocolName
@%SystemRoot%\System32\wship6.dll,-60101
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D0046004100090602000000000000000000000000000C000000C0B0EAF9D426D011BBBF00AA006C34E4EE030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000300000000000000FF0000000000000000000000008000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
ProtocolName
@%SystemRoot%\System32\wship6.dll,-60102
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041006620020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF3030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
ProtocolName
@%SystemRoot%\System32\wshqos.dll,-100
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041006620020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF40300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
ProtocolName
@%SystemRoot%\System32\wshqos.dll,-101
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041000926020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF5030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
ProtocolName
@%SystemRoot%\System32\wshqos.dll,-102
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041000926020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF60300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
ProtocolName
@%SystemRoot%\System32\wshqos.dll,-103
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Num_Catalog_Entries
10
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Next_Catalog_Entry_ID
1057
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Serial_Access_Num
24
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration\Providers\NetBIOS
WinSock 1.1 Provider Data
0E10000011000000140000001400000005000000FDFFFFFF00FA0000720500000912000011000000140000001400000002000000FDFFFFFF00FA0000FC0400000E100000110000001400000014000000050000000000008000FA00008604000009120000110000001400000014000000020000000000008000FA0000100400000E10000011000000140000001400000005000000FCFFFFFF00FA0000980300000912000011000000140000001400000002000000FCFFFFFF00FA0000200300000E10000011000000140000001400000005000000FFFFFFFF00FA0000A80200000912000011000000140000001400000002000000FFFFFFFF00FA0000300200000E10000011000000140000001400000005000000FEFFFFFF00FA0000B80100000912000011000000140000001400000002000000FEFFFFFF00FA0000400100005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00370031003400410032004600420031002D0031003100300046002D0034003800450039002D0038004600460036002D004200460032003600380045003600450045004400300036007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00370031003400410032004600420031002D0031003100300046002D0034003800450039002D0038004600460036002D004200460032003600380045003600450045004400300036007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00360036003500330031004500330034002D0039004400340038002D0034004100360033002D0039004100420042002D003200300038003300380038004600430035003600420044007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00360036003500330031004500330034002D0039004400340038002D0034004100360033002D0039004100420042002D003200300038003300380038004600430035003600420044007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00360036003500330031004500330034002D0039004400340038002D0034004100360033002D0039004100420042002D003200300038003300380038004600430035003600420044007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00360036003500330031004500330034002D0039004400340038002D0034004100360033002D0039004100420042002D003200300038003300380038004600430035003600420044007D000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration\Providers\NetBIOS
WinSock 2.0 Provider ID
30185F8D73C2CF1195C800805F48A192
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006600020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192E90300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000906020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192EA0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090602000000000000000000000000000C000000A01A0FE78BABCF118CA300805F48A192EB0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000300000000000000FF0000000000000000000000008000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300032000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006600020000000000000000000000000008000000C0B0EAF9D426D011BBBF00AA006C34E4EC030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000906020000000000000000000000000008000000C0B0EAF9D426D011BBBF00AA006C34E4ED030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090602000000000000000000000000000C000000C0B0EAF9D426D011BBBF00AA006C34E4EE030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000300000000000000FF0000000000000000000000008000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006620020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF3030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006620020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF40300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000926020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF5030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000926020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF60300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922104000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FDFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00360036003500330031004500330034002D0039004400340038002D0034004100360033002D0039004100420042002D003200300038003300380038004600430035003600420044007D005D0020005300450051005000410043004B00450054002000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}] SEQPACKET 3
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922204000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FDFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00360036003500330031004500330034002D0039004400340038002D0034004100360033002D0039004100420042002D003200300038003300380038004600430035003600420044007D005D00200044004100540041004700520041004D0020003300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip_{66531E34-9D48-4A63-9ABB-208388FC56BD}] DATAGRAM 3
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000800000030185F8D73C2CF1195C800805F48A19223040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D005D0020005300450051005000410043004B00450054002000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}] SEQPACKET 0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000800000030185F8D73C2CF1195C800805F48A19224040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000020000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D005D00200044004100540041004700520041004D0020003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}] DATAGRAM 0
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922504000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FCFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00360036003500330031004500330034002D0039004400340038002D0034004100360033002D0039004100420042002D003200300038003300380038004600430035003600420044007D005D0020005300450051005000410043004B0045005400200034000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{66531E34-9D48-4A63-9ABB-208388FC56BD}] SEQPACKET 4
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922604000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FCFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00360036003500330031004500330034002D0039004400340038002D0034004100360033002D0039004100420042002D003200300038003300380038004600430035003600420044007D005D00200044004100540041004700520041004D002000340000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{66531E34-9D48-4A63-9ABB-208388FC56BD}] DATAGRAM 4
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922704000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FFFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00370031003400410032004600420031002D0031003100300046002D0034003800450039002D0038004600460036002D004200460032003600380045003600450045004400300036007D005D0020005300450051005000410043004B0045005400200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{714A2FB1-110F-48E9-8FF6-BF268E6EED06}] SEQPACKET 1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922804000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FFFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00370031003400410032004600420031002D0031003100300046002D0034003800450039002D0038004600460036002D004200460032003600380045003600450045004400300036007D005D00200044004100540041004700520041004D002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{714A2FB1-110F-48E9-8FF6-BF268E6EED06}] DATAGRAM 1
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922904000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FEFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D005D0020005300450051005000410043004B0045005400200032000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}] SEQPACKET 2
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922A04000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FEFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D005D00200044004100540041004700520041004D002000320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}] DATAGRAM 2
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Num_Catalog_Entries
20
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Next_Catalog_Entry_ID
1067
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Serial_Access_Num
25
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration
Provider List
Tcpip6
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Linkage
FilterList
{66531E34-9D48-4A63-9ABB-208388FC56BD}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage
FilterList
{4040CF00-1B3E-486A-B407-FA14C56B6FC0}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0008\Linkage
FilterList
{7C5653F0-144A-4534-9E34-28AC99CBA85E}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0006\Linkage
FilterList
{72DD97A9-E544-4915-88D8-44E829C34F68}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
3092
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0005\Linkage
FilterList
{F3229805-869E-479E-BA76-DD643F1D1B80}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000

Files activity

Executable files
30
Suspicious files
21
Text files
359
Unknown types
20

Dropped files

PID
Process
Filename
Type
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\DotNetChecker.dll
executable
MD5: e02ed575cffbc793af912c5541c7ffb3
SHA256: 45e15d319084e019d4db5a3081533ba8c032308cf35384abf8b65ddbac6c5f9d
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\nsProcess.dll
executable
MD5: 05450face243b3a7472407b999b03a72
SHA256: 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
2628
tap-windows.exe
C:\Program Files\TAP-Windows\driver\tap0901.sys
executable
MD5: f49967c396969b71c3a72537db03a68b
SHA256: 3b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\SimpleSC.dll
executable
MD5: d63975ce28f801f236c4aca5af726961
SHA256: e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
2628
tap-windows.exe
C:\Users\admin\AppData\Local\Temp\nsn4D36.tmp\ns4D75.tmp
executable
MD5: f132fdbbc0a040f07e10ea944ff57fef
SHA256: 47f8b16ad9a20c23c6104777687afa580f8f3ac11ae1499aedd04880bb28b2f3
2628
tap-windows.exe
C:\Program Files\TAP-Windows\bin\tapinstall.exe
executable
MD5: bc2eb9be84d65e600bb4baebfc0d6c74
SHA256: 5c6aae8c345e5eda7185cabafcf9270ef3d73f198290842654d8916f8321b150
2628
tap-windows.exe
C:\Users\admin\AppData\Local\Temp\nsn4D36.tmp\nsExec.dll
executable
MD5: acc2b699edfea5bf5aae45aba3a41e96
SHA256: 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\bin\libcrypto-1_1.dll
executable
MD5: 75e28bcf1257d6847d5f8234823107d5
SHA256: f6d38ae3c9eac04f4280b600235805ad5d869b957d4a329e8395c15881a92831
2628
tap-windows.exe
C:\Users\admin\AppData\Local\Temp\nsn4D36.tmp\ns4E61.tmp
executable
MD5: f132fdbbc0a040f07e10ea944ff57fef
SHA256: 47f8b16ad9a20c23c6104777687afa580f8f3ac11ae1499aedd04880bb28b2f3
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\nsDialogs.dll
executable
MD5: 79a0bde19e949a8d90df271ca6e79cd2
SHA256: 8353f495064aaf30b32b02f5d935c21f86758f5a99d8ee5e8bf8077b907fad90
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\{3502f335-5614-43cb-98fc-407179cd7253}\tap0901.sys
executable
MD5: f49967c396969b71c3a72537db03a68b
SHA256: 3b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\bin\openvpn.exe
executable
MD5: de76066903427c91eec491a269505828
SHA256: fb263a21e7537d57e75b7ffe27cfe6a364c20ca81709b2980ca54d9d5d263553
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\UserInfo.dll
executable
MD5: 7ad48200db380bc3d93ef9f42a3b2883
SHA256: ead0e902d39a54331c2ead31dd9cc556460f05122ae267d78cf792a85407eb47
2628
tap-windows.exe
C:\Users\admin\AppData\Local\Temp\nsn4D36.tmp\System.dll
executable
MD5: c17103ae9072a06da581dec998343fc1
SHA256: dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
3476
DrvInst.exe
C:\Windows\System32\DriverStore\Temp\{1c0b2307-c612-761b-fd51-a07f75371e1a}\tap0901.sys
executable
MD5: f49967c396969b71c3a72537db03a68b
SHA256: 3b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
2628
tap-windows.exe
C:\Users\admin\AppData\Local\Temp\nsn4D36.tmp\UserInfo.dll
executable
MD5: 7579ade7ae1747a31960a228ce02e666
SHA256: 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll
executable
MD5: a0794c6528f2cc26a235381c4fb9a0cf
SHA256: 3002ca47200bbff761e7c892d972a9ebb273f5ae37dc58db1a7453135de24cc5
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\ns4BF0.tmp
executable
MD5: 0ea836e6e221bae96af1372478d12cdb
SHA256: 60e7852df47c0e87c6a61bac0f6773311da835bbdaca0296cd89a0f09bad7246
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\Uninstall.exe
executable
MD5: 756db2dc4e11cd649f8e93dffecf178c
SHA256: b13ceee97aca95c7d0c90fa4b38ac9c006da348cc54f3d3c2e43b18aee941bf5
2628
tap-windows.exe
C:\Program Files\TAP-Windows\Uninstall.exe
executable
MD5: 7a39c7e83f8dbb5835c354a30f4c47d9
SHA256: d858454b7ca0629f84a0ba95b8257b00d4fbab318882d9882b6c5a15e67e2e34
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\bin\liblzo2-2.dll
executable
MD5: 039a65ca6e19e7e90e6ce30670aaead0
SHA256: 641ea16ab43a7a8bd5aa82072f89c965f5c01da080245d056c2bf41440d387d9
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\tap-windows.exe
executable
MD5: 47fa5f0670cf191d066e5dfbf4f4ee70
SHA256: 645bee92ba4e9f32ddfdd9f8519dc1b9f9ff0b0a8e87e342f08d39da77e499a9
3092
DrvInst.exe
C:\Windows\system32\DRIVERS\tap0901.sys
executable
MD5: f49967c396969b71c3a72537db03a68b
SHA256: 3b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\bin\openvpnserv.exe
executable
MD5: 9d4ef1b1b715ae08a867ea3e23e39c0b
SHA256: ad57a22f2cac238f72981088be1b52c45417f699dff688aa2ff1b79305f8f782
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\bin\openvpn-gui.exe
executable
MD5: dbd78ad80d4767d3bb91809d50723310
SHA256: 7e9178c219a72f1ee38b916202078ee36d6fa58fd1a590949f3917f32e6d0824
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\nsExec.dll
executable
MD5: 82b0a7c6a0eeecce2d36e6149a94a88c
SHA256: 60f0b2bbca51892d82b3f7e7fe3483655f5962452e7affab6434dbbfb1acf4f7
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\System.dll
executable
MD5: 8643641707ff1e4a3e1dfda207b2db72
SHA256: d1b94797529c414b9d058c17dbd10c989eef59b1fa14eea7f61790d7cfa7fd25
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\bin\openssl.exe
executable
MD5: 52c30a96d7a7ae807aa17a06421af37d
SHA256: 588757226bc76bb1627fc5b3bba2bb7a2375a523a2397b3049acd6ea1aff8e07
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\bin\openvpnserv2.exe
executable
MD5: 861d9afe99dcfbdef816ecf59d0266c0
SHA256: e9d7e26dc91c06d50d13071cd85ac922fb3438e57796b18b467a629a1be75320
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\bin\libssl-1_1.dll
executable
MD5: faf676dd11b0c563c1599f5413a8724a
SHA256: a4f32a4f7d16ccf0b395889542453336b73d5639eeab737d84b9d063a4310547
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar5615.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\System32\DriverStore\infpub.dat
binary
MD5: e335b35fb3544b1db18288886e4d3216
SHA256: 53219d24efc45c05520feaab7d81671b64a0728455818b6ea5e33e444ee82acb
3092
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: e538ace08305bd07ad067fb87359f573
SHA256: 2ddbf506b0ce8988f63051e2bebf6d360fa4effd4bd9bfabe2128c613b5ae610
3892
vssvc.exe
C:
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 8ae55341207fe912e6fb0b0d6ec1fba5
SHA256: f2eae500d2fd1535dde066dd54fd9d43e83af7f7083279edd3cf5fcd8da2d2fa
3092
DrvInst.exe
C:\Windows\TEMP\Tar9E25.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Cab9E24.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Tar9DF4.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Cab9DF3.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\system32\DRIVERS\SET9DC6.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\INF\setupapi.ev3
binary
MD5: cb8bdcb65a0f53e6b3ce74cf7516ced9
SHA256: 8a308283fb47682b81097581598583de6dffa2675d52cbb9240a934cd7ca58f2
3092
DrvInst.exe
C:\Windows\INF\setupapi.ev2
binary
MD5: 19f8808fc7897a48497a5e65362b354f
SHA256: 9181334c187f5732417a46c641ae28a4192e932de597089a5a749a1d32e28e23
3092
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: d696c9ea1bf6b9159a245277d574d4b9
SHA256: 34851714f1fe43de1e2344d5657d9722e8d124fac7c25a01326c13c8c42ee28f
3092
DrvInst.exe
C:\Windows\INF\oem4.PNF
pnf
MD5: eb7217ad2c0b64e6271aa6e656faccfa
SHA256: 3c51f8a3a08c534c271ab98b7c2b5879951593181c45b9d5eddcb7f0b5e5a2da
3092
DrvInst.exe
C:\Windows\TEMP\Tar9C5C.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Cab9C5B.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 6a76c6745b79143210f2c892f8cf3b9f
SHA256: 6c50aeadbc2a0a39671e2f22b507f629968ec021c4cb7aeb7ccbdb4540df66e7
3092
DrvInst.exe
C:\Windows\TEMP\Cab9C1A.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Tar9C1B.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Tar9BCB.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Cab9BCA.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Tar9B9A.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Cab9B99.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Tar9B69.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Cab9B68.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Tar9B29.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Cab9B28.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Tar9B17.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\TEMP\Cab9B16.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\INF\setupapi.ev1
binary
MD5: f21243c47cf21adf682686e47a0b3dac
SHA256: 6681a3369796d9f5fcce0ab7a13f4f543aff06d0420c91c72102a50db0f68226
3092
DrvInst.exe
C:\Windows\INF\setupapi.ev3
binary
MD5: 071b6a8060ead46e91017040c57562f1
SHA256: 52ee6382af8e38eab3456c99873f590a4171b95c032abfe9fbb65b714fa679e6
3872
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 263731ab08ad1c22e40399d6195c0d4f
SHA256: eb9b024d7a74add688c5557e2f63c7387b51a64234fe37fd4864e59c5da79cde
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab99E6.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar99E7.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar9997.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab9996.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab9975.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar9976.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab9944.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar9945.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 8deb9e8a130525fdfe1043288d041215
SHA256: 47f36209bd111a78cc90cf26095d9eb4963b65e7f3d7489658f682199e4dfbe4
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar9914.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab9903.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar98E3.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab98E2.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Windows\System32\DriverStore\infpub.dat
binary
MD5: 49c633a10f91b938d04f9662e623d82e
SHA256: 9e03423e34a4dfabb6f4e0abad0e70c6dfdd0964b203bd215f5aa6480f0dc4a6
3872
tapinstall.exe
C:\Windows\System32\DriverStore\infstrng.dat
binary
MD5: 2d95e34af90a740d0a01f159dfcb06c9
SHA256: ae5841f65a3e2b00989d9eba5e27be941e0ab976608ec656ae5b202e9b43e918
3872
tapinstall.exe
C:\Windows\System32\CatRoot2\dberr.txt
text
MD5: 18d5456ce563a5aa6c09e24c83552a36
SHA256: 1278290b8223da289aac96ff7456b89580441b66e6776796278e424cdea9a904
3872
tapinstall.exe
C:\Windows\System32\CatRoot2\dberr.txt
text
MD5: a4aee98a5e3f6f0e30a6f4dee242fc98
SHA256: 178d9505523758296946c0a7cc603d94f67ce546aedc1e125d9d929d7a68e364
3872
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: f0cb90ef4be85ee0b4df4fe7eafdfc22
SHA256: acbf8d2cd3a110a213b5862ad27ab1dc9cb0ef6f81565ad888e64df870991147
3476
DrvInst.exe
C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_x86_neutral_7b2f8786a9ddb778\oemvista.PNF
pnf
MD5: a24f2fedaf618bfaa2b628dc08631943
SHA256: a385732c4f10d46f6ae9d8006eed39d05978714925b3ae61d0cddcd95b0792d9
3476
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: f0cb90ef4be85ee0b4df4fe7eafdfc22
SHA256: acbf8d2cd3a110a213b5862ad27ab1dc9cb0ef6f81565ad888e64df870991147
3476
DrvInst.exe
C:\Windows\System32\DriverStore\INFCACHE.0
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\System32\DriverStore\OLDCACHE.000
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\System32\DriverStore\INFCACHE.1
binary
MD5: 19e1913048eb3e46486ef904cd9dcbca
SHA256: 9099b01592846ed5c5750180a698cc5c9337dfb75154e257bbbaec84f85130e9
3476
DrvInst.exe
C:\Windows\System32\DriverStore\INFCACHE.2
binary
MD5: 19e1913048eb3e46486ef904cd9dcbca
SHA256: 9099b01592846ed5c5750180a698cc5c9337dfb75154e257bbbaec84f85130e9
3476
DrvInst.exe
C:\Windows\System32\DriverStore\infpub.dat
binary
MD5: 1e72f7343481d157247f029b93d95323
SHA256: c9071ec1f5c450749790596aa5261940231656d949e07a5f81cb00c69ca02e3d
3476
DrvInst.exe
C:\Windows\System32\DriverStore\infstor.dat
binary
MD5: 7f208b0dbf231e505d6abd300e4c5714
SHA256: 4d31b0b3e6d0fdb13f08d513491e5f7b3f5bd73d77969ea833571368b4b4cb05
3476
DrvInst.exe
C:\Windows\System32\DriverStore\infstrng.dat
binary
MD5: df7de3f4589efeaf1e777524246460a0
SHA256: 2e54a38892115ef72de98d05ed7676bf4d4c91bb1187ad5cee6304ebaa585cbb
3476
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 0418e8ecb17e23e942b78abcf7d000ab
SHA256: c13791d2df6cd5885189117852de73b0bff9524b219be75dea4b37860dba1b0b
3476
DrvInst.exe
C:\Windows\INF\oem4.inf
binary
MD5: 41884571579f88540326252b81d0a9f8
SHA256: a461b764e248d3e59a1a730ff94af7e61121f5a02004e02b3b866ac8fd1689be
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 8c25b65f6fc60fe1403732a76ab25345
SHA256: 56c700165b47b2de375fb1b3d87bf5a2a5277ba39f0d53e96fc706b966b972aa
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 40bce22c20fd9ac74aaa1f67df00f77b
SHA256: 9f19eb1b9203a7a234e9b08d99148430c6b1680d23663edcbabada3514842be7
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 3c86d480a4ce5ce47a80df6ff0e89772
SHA256: 3655a6a8125ac030b24d78f48037012bb5c92db08727e22a81d1f9c5c2c42956
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: af560b804bac257d535f8e65ff4eea67
SHA256: 26f155fdbb64060359742176e4f809a423e0a7e5a8fbde6ea242bcc6ec480f74
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 44ac77622bd8a8b6169f1f0b297a237c
SHA256: 2fe8fba0f9a02a1ef7fcfcef8fdec1bc74a8772b1e20b8a74beaf82dae5ef12e
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 35e81cb6d7806113d6c738ea5ee45ca8
SHA256: d3e1569d0cd4eabc101c53bb894b7bb62349d53a7207d6ffd54f63513fa78701
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: c181800fd6f8702ffb23a9d7a8a2f519
SHA256: 06e8220374dca9988cc64eb2f63c4f4f34e36f01ea406c12b19cb1c6ae6450bc
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: aa83a7e6e708d9da83b64989b34cc440
SHA256: b7772e2699b73321a014c6165fd884fdd5dc673149b2eebdc3ee52eedc180a58
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 96fcb5cddae04344685ec0be24660511
SHA256: 4392ebb6250c86983653692689764777b48b7f6a98df0802dd313e544dfbf6c9
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 91699db25466ea9d909eead849e962bf
SHA256: 44a84d40e1fcb812fb6ddb9cc9e69ed8e854847a282598564cdcbed3331299cb
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 91f5e3820d706920e3e034e19c7a7419
SHA256: d1c7e516e18871a410c1d6d4be507c5098839182d3e6461c413453d0e1789171
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: bdcad1a16ad4049f0d7d9e73cd0384f9
SHA256: 4f7ba63f68692bf7bae007f42337e0a0ddd1d502913e3dc99cae4c30e7275981
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 6f504062a7f09d2d7bc228a53d76e4e3
SHA256: 0c8d9b195b1cedeb956d1e27d3e452944df465e8d7c59ce892a431048a31a830
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: d4bfa2282c619464e3f8d16927d67c5e
SHA256: 4f853ad61995231daf5dd0769d6111b2568f30d7f1b23b2c7bf35f212f76285c
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: d3d360882c4473f31983c748a80ba9d1
SHA256: 3af59b28e561d88341761ef949b0393df88656c4482ea67595e873293a5aed97
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: ad7ab0ba9637c7ed3c23ca209985606d
SHA256: 97279bed3598a545a9cadb89f4359ea897debb68c87244c7dd6cad39d3c5f931
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 4d7ed65cf55e0529981c1549e0504268
SHA256: b1829000500d3163e7bade52e495a01ec7d6289244c6eadc8d6734b99d00e3b6
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 59417f113a34416446d1226ef9adbf26
SHA256: 9fcafbfc4e6ff92b264dfb973d83d5c23141e2c46962bd35d8e6656021ff3eb6
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: c52458e77c5f7758a9a0498703030b6b
SHA256: f68327333ed6478872a0263c365fa811c4710efe1f65a55916eeb641c25663dc
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 54454ac35d5b4ea0784b7e32335d1613
SHA256: ca5bcb5600b1523783055e0ce02b22a24742903ddb3882a4a323dbc56456df72
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: bbed52e453acd9df8406066fe6b4c8a9
SHA256: 48060a66eacf9bfb153c42d36164f99385e550981113ad104127fb03c5871a7f
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 151c261b903a6dddc38a698b5cfe70c3
SHA256: b19052479a325efbd1e8fd0b3d3be550d6c3e4571cf7d934c150b57963ea3bc2
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 5b9981014c94bb2ba92e0ad4a37d989a
SHA256: 1d29f049ae74267b7838769820f32c9aed53641a5780d146a2beb90411794e73
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 62273f6a0ddd2692b563a106d2b6f0bf
SHA256: 2fa3de03a3464663245869128b1096c17edcc9f360e9193931371b9659669001
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: f0eed17378df8dc7bdb3ef9699ad4100
SHA256: 3880540eedc6773c1ae5120b745f8291c58bb99f287b96a6391a2158f40da70c
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 420c9f3a94141640883488ed8a513639
SHA256: 0cde5a6bad191d3a64ddee21aace88f2941c176925fbd161edc551b315199991
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 51b9997c8e8193281a322a20c082dbe0
SHA256: 2e51263a2edcd06d5a516ea90d55b11fa3ecc1f999d96607622b4e81b4539869
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 22a8336d5af2c472e3b585330f71d62f
SHA256: c4a7ef9aa66b5f2bc3f3e34786d5849a89fe6bbfea270585092a745435e86096
3340
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: d713c757606257a6320ce015e9df8d39
SHA256: 7d325eb9eaaf7a18858db1253d061ddc5e4011921bf06854355d750a01de8c2f
3340
DrvInst.exe
C:\Windows\INF\setupapi.ev3
binary
MD5: 76dcc60f78b3dff1ae3627619074f465
SHA256: 18541ac1875315c4f9eff75050c574faff83717c029dae6b366f9c6c3f0c19e0
3340
DrvInst.exe
C:\Windows\INF\setupapi.ev1
binary
MD5: 9cece67b99389477ef21ccd522a3b092
SHA256: 7c62808eb516a63f5de9079597dbf1286d21a06e4dc2c692a7e03dfb91219784
3476
DrvInst.exe
C:\System Volume Information\SPP\metadata-2
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\System Volume Information\SPP\OnlineMetadataCache\{7d581d32-a8f0-43a2-a967-834d74b740f1}_OnDiskSnapshotProp
binary
MD5: b449fa456b882a3b64da6cfdb2b895df
SHA256: daedb8079a56b4a8ebcbb50874c1b8e7b3f6b583fa0683660e35d60803ce6858
3476
DrvInst.exe
C:\System Volume Information\SPP\snapshot-2
binary
MD5: b449fa456b882a3b64da6cfdb2b895df
SHA256: daedb8079a56b4a8ebcbb50874c1b8e7b3f6b583fa0683660e35d60803ce6858
3476
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 8a52a222186c3afbdb1101ef4d670763
SHA256: 4f2d153ccc808ffb4db399263ba222bee71614648ca5601dec760a3ef9d4f25e
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar5637.tmp
––
MD5:  ––
SHA256:  ––
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab5636.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\System32\DriverStore\infstrng.dat
binary
MD5: 4f52b0603df72173dc3d7fa212efae1d
SHA256: 4c29ed540766f9c53f4eb091e2ba586e8d4a8bb06b9eb2c2c58b1115f59f7602
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab5614.tmp
––
MD5:  ––
SHA256:  ––
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab5603.tmp
––
MD5:  ––
SHA256:  ––
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar5604.tmp
––
MD5:  ––
SHA256:  ––
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar55F2.tmp
––
MD5:  ––
SHA256:  ––
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar55E0.tmp
––
MD5:  ––
SHA256:  ––
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab55F1.tmp
––
MD5:  ––
SHA256:  ––
2416
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab55DF.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 77f42edf2a7aaf33218a529d59244767
SHA256: 77bc7a59e0e15ea54279b58001ae42427bfabc895154a0f4b82f928b2367141a
3476
DrvInst.exe
C:\Windows\TEMP\Tar5521.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Cab5520.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Tar54C2.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Cab54B1.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Tar5423.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Cab5422.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 73a20f3f757327863b7039a854595bf9
SHA256: b904495edb3c87d763e7661e1deef248678db5bc9b50ecbd12002e11934ffe48
3476
DrvInst.exe
C:\Windows\TEMP\Tar53D3.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Cab53D2.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Tar5364.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Cab5363.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Tar52E5.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Cab52D4.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Tar52B4.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\TEMP\Cab52B3.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 4a2b3b4bd02cd6c0c16ff9bdb88b8eb6
SHA256: 5c4dc1bc87060dc3d5734323633f45a5cd2abae28df161c2a470a3b9d4dfdb7c
3092
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: bdbd50167c134ad2173be7b5f9e76405
SHA256: b49e10c9ea7e55d30de692b594fb79874090200f7b78a72f9727138d7c354b3b
3476
DrvInst.exe
C:\Windows\System32\DriverStore\Temp\{1c0b2307-c612-761b-fd51-a07f75371e1a}\SET515D.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\System32\DriverStore\Temp\{1c0b2307-c612-761b-fd51-a07f75371e1a}\oemvista.inf
binary
MD5: 41884571579f88540326252b81d0a9f8
SHA256: a461b764e248d3e59a1a730ff94af7e61121f5a02004e02b3b866ac8fd1689be
3476
DrvInst.exe
C:\Windows\System32\DriverStore\Temp\{1c0b2307-c612-761b-fd51-a07f75371e1a}\tap0901.cat
cat
MD5: ad8a5cbec4f83ae4f850c793713ee770
SHA256: 878c1b205887b61906f6f4f8da5783d2bb8756d0a39359288d09f65f983b27c2
3476
DrvInst.exe
C:\Windows\System32\DriverStore\Temp\{1c0b2307-c612-761b-fd51-a07f75371e1a}\SET514D.tmp
––
MD5:  ––
SHA256:  ––
3476
DrvInst.exe
C:\Windows\System32\DriverStore\Temp\{1c0b2307-c612-761b-fd51-a07f75371e1a}\SET513C.tmp
––
MD5:  ––
SHA256:  ––
3092
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 07d12d0bda7fb8cabe8d9de72f3b7c7f
SHA256: bed278d2d12f01154f023a741cf10935025b6f4c4a3308ff2330f096dcf42523
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\{3502f335-5614-43cb-98fc-407179cd7253}\SET50E0.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\{3502f335-5614-43cb-98fc-407179cd7253}\tap0901.cat
cat
MD5: ad8a5cbec4f83ae4f850c793713ee770
SHA256: 878c1b205887b61906f6f4f8da5783d2bb8756d0a39359288d09f65f983b27c2
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\{3502f335-5614-43cb-98fc-407179cd7253}\oemvista.inf
binary
MD5: 41884571579f88540326252b81d0a9f8
SHA256: a461b764e248d3e59a1a730ff94af7e61121f5a02004e02b3b866ac8fd1689be
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\{3502f335-5614-43cb-98fc-407179cd7253}\SET50CF.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\{3502f335-5614-43cb-98fc-407179cd7253}\SET50D0.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 4a2b3b4bd02cd6c0c16ff9bdb88b8eb6
SHA256: 5c4dc1bc87060dc3d5734323633f45a5cd2abae28df161c2a470a3b9d4dfdb7c
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar505F.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab505E.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar504D.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab504C.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar503B.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab503A.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar501A.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: c5d04c7949a451c4421cc41233bb80ae
SHA256: f82c33625d89efae14a3fab0e7842f5d2ef13c2f7e0730f4708e82227584d0d5
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab5019.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar5008.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab5007.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab4FF6.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar4FF7.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar4FD6.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab4FD5.tmp
––
MD5:  ––
SHA256:  ––
3872
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 49a3b97afc13568db895fb353f2f74bc
SHA256: 93e0502f93e739f443e409905cd8a63d58a74461ab5b5fd8b69d873fc6146784
3872
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 35df4d27efbae1ff35061bf9668f8a5b
SHA256: 5c0c36d3fa2d49869c4facdacd518965fd21dd21431ea17487f7656caf33c353
3872
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: f79298e40de082ff8883235d35392617
SHA256: 51736eb19ea973eb73c75c663a20af7d653d25aa3a5f44d4cbf77d2d4769ce9c
3872
tapinstall.exe
C:\Windows\INF\setupapi.app.log
text
MD5: e738968a0076831d5c5862d672ccf5ab
SHA256: 9c0491b2fe98db8970ecad0a1f9c516e8811475c38d5c6299fe637f5df146c2d
3092
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 7932864d124f043b0a3e578461c2d417
SHA256: dccf3d2d8d025249ce0419f4cc1413b6846b0cd0ca4002193c6c5b82ea15a54d
3092
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
text
MD5: 912580d68808788d2f459c0ef63d3535
SHA256: af5baf5e48df05cf91b1957c808f6f74c6d546a305ba8dfd1e31d316f45c0aa4
2628
tap-windows.exe
C:\Program Files\TAP-Windows\icon.ico
image
MD5: 66df0c802ac1e0ddeb1f7ed1b2564065
SHA256: c557260b9edcf7f74f1f489aaf21b4d4e7747b584640138e72887268395f248b
3872
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
text
MD5: 912580d68808788d2f459c0ef63d3535
SHA256: af5baf5e48df05cf91b1957c808f6f74c6d546a305ba8dfd1e31d316f45c0aa4
2628
tap-windows.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TAP-Windows\Utilities\Delete ALL TAP virtual ethernet adapters.lnk
lnk
MD5: c3d9a61bc50b8d08ed471ab74b073f8c
SHA256: e34afb0f46a6f7846d02146644ea6f5d546c30aee7eb6583d55d77e80b2ea3e7
2628
tap-windows.exe
C:\Program Files\TAP-Windows\license.txt
text
MD5: 1a83b2d4cc5ae675793d22d4e2a3da4c
SHA256: 90fd7dce0ccaf384d5d968456cf89907745c4bfbad9ce097bb4214bbf6d82c7f
2628
tap-windows.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TAP-Windows\Utilities\Add a new TAP virtual ethernet adapter.lnk
lnk
MD5: fd4029fce226e5c353a2af8b293964cb
SHA256: 1d3f637d5b9e38665515deb1a0d2b59595279803dc4fd5b2692f7a37bebe9eba
2628
tap-windows.exe
C:\Program Files\TAP-Windows\driver\tap0901.cat
cat
MD5: ad8a5cbec4f83ae4f850c793713ee770
SHA256: 878c1b205887b61906f6f4f8da5783d2bb8756d0a39359288d09f65f983b27c2
2628
tap-windows.exe
C:\Program Files\TAP-Windows\bin\addtap.bat
text
MD5: 19119c8c004d7848d00a86fc0530cd92
SHA256: 0af33c790900ae49cfccbbdbfd9770b37e8d7b2f864517335b467b81159a6966
2628
tap-windows.exe
C:\Program Files\TAP-Windows\bin\deltapall.bat
text
MD5: 81433cec4b6dd4648f0fc75c8b5945f4
SHA256: 494aa9a140a562fe76a11b8487984d69580ce8ebee79445f094017963c0ea98b
3872
tapinstall.exe
C:\Windows\INF\setupapi.app.log
text
MD5: aa0a3b3e6a125445f2c1cbc8186d735a
SHA256: 053a4e264eea8828a437cd829da41446102c29207e156501537d4898f49f80d3
3872
tapinstall.exe
C:\Users\Administrator\NTUSER.DAT
hiv
MD5: e766483fb1c6ad75938a9f358b50dec6
SHA256: 9c64cd445979f5a79b310735bb125ef3e330bb5237e6231e0c567b4c808082b5
2628
tap-windows.exe
C:\Program Files\TAP-Windows\driver\OemVista.inf
binary
MD5: 41884571579f88540326252b81d0a9f8
SHA256: a461b764e248d3e59a1a730ff94af7e61121f5a02004e02b3b866ac8fd1689be
3872
tapinstall.exe
C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
log
MD5: 57f7a79615bb8cf865ea101ec1e7e85a
SHA256: e4b03b0be133676420b61bac0df3f85a10395b79e9ac3fc1fd7f5ddacad3f8ba
3872
tapinstall.exe
C:\Users\Administrator\NTUSER.DAT.LOG1
log
MD5: e1bb6ae4c6a2f76a356d46d04c2cdf28
SHA256: e0dd88d9121f0d8c515b79850f2ef3e2dabcb7726ad195e93fb61b8a8dd807a6
3872
tapinstall.exe
C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat
hiv
MD5: 5cdd69d8d622bad4e7ab5445d17714c6
SHA256: acab3a2f8b6e1a04619904994ebe1e15674bdb6a4972f21f7147463215a2f1cd
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\OpenVPN GUI.lnk
lnk
MD5: 1f3e2128f8abdcf4240149277fe24fba
SHA256: d6710e9fbd591e10242df7e7acde194ba57fb3315942e8265f5bd250411c5c50
3952
openvpn-install-2.4.7-I603.exe
C:\Users\Public\Desktop\OpenVPN GUI.lnk
lnk
MD5: 3da1d1b8e4cab4fe57d86f941c290475
SHA256: 0611671d4101ad218988e04fc11191331784e9551220eda915fee3fefcfe0223
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Documentation\OpenVPN Web Site.url
text
MD5: 523e4468e192ec0c4a23bcaabf9ec745
SHA256: 188ffac1e9977d08c66b750eddc24d45b68f1ba782643a62cc789dbe5277d8dd
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Shortcuts\OpenVPN configuration file directory.lnk
lnk
MD5: 4ce6e7c1a191434cc4c191e36e2a1b83
SHA256: e3ae48f0f29e6aa48cd216acad5eb827ef87e48a5488019b503022053406a0ce
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Shortcuts\OpenVPN Sample Configuration Files.lnk
lnk
MD5: b36b992d24cb4c516b71688349809090
SHA256: 500d6188d306b1c85195ed1137759c872ac713c12a90fe2d1eae9aec9c38b018
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Shortcuts\OpenVPN log file directory.lnk
lnk
MD5: 201fb6d9b9e3ff975138ad09e1896ec8
SHA256: 497cac501c5497230aafb1ab2cae2b67cb2b8b22795c9cdaa1d220223e25404b
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Utilities\Generate a static OpenVPN key.lnk
lnk
MD5: 353e851faffb1eb6c01f8d0da6848742
SHA256: 10f68409eee134df8292c807601d51e98f669b148aa78f01cde862ca5be0440c
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\sample-config\sample.ovpn
text
MD5: 67f657eed08ce365508f739dcb94ade1
SHA256: 07be2bc7ca10e502485daddd31785b5c18ea27c017118ee82b1411d7722e4ea5
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\sample-config\client.ovpn
text
MD5: 0e0c51874ef9c53e4a4dcec263644536
SHA256: a7dc6b3fb75ee3d2ba9244d9302bc0dd9a7f6ff621ffb9e6d1a4d88e436f5617
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\config\README.txt
text
MD5: 0b36c15757f458123dc271da6c802c20
SHA256: ee88da16216aaf4bc760c9732b5c99b46e7f9528811aed06483b2a5737736839
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\sample-config\server.ovpn
text
MD5: 49428a33236e255f7dff5593d7e0db39
SHA256: 50f1ec0fb45538137160e0e1704551723e5ad2a02dbeb25cb6a7b8c1c5012ba8
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\log\README.txt
text
MD5: 2db001fdfadd88c4338377086af3b2ec
SHA256: 9c25b8403ac2fcc378ed26b8ec3f377b678b060745cf51f74b828b3d5ba41b86
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Documentation\OpenVPN Support.url
text
MD5: d8d8772e17d4cd0dd163baf950fc4375
SHA256: 90641b380d7b3d97352fe99f9b964aca7733c16cea39b87a5d8885ce00a5d28a
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Documentation\OpenVPN Windows Notes.lnk
lnk
MD5: a72033304b40ecb4167ae183268fdd21
SHA256: a826438c5a0b7b37393ce8dd397ee640c7daeb0552d2df6e9c742853aff53ab6
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Documentation\OpenVPN Manual Page.lnk
lnk
MD5: 8bfab7f8ff12c805661a1552916cf9a4
SHA256: 0d194c78ea2080c58162320d0f75ccfd456ce4d8f18827266d5b04c857f8810a
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\doc\openvpn.8.html
text
MD5: 2d3145da4e8b92290f3f177a0e97c29c
SHA256: 6532899539398c1db287c3af7149cdd4f09547020704a672f7dea2aedc1135a6
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\doc\INSTALL-win32.txt
text
MD5: cf269c66e1d4770a39f8cebb41e2f8c2
SHA256: 7e1ce7743c427b5050fb150de633162969d651fdb991c023bf0c90e06cf83291
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Uninstall OpenVPN.lnk
lnk
MD5: eed8ed54b66855b1d077f5044da7a429
SHA256: f1aa6d270743859e844915310b065c11755632556afc0059980f7c4c37db9106
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Documentation\OpenVPN Wiki.url
text
MD5: d4f5e99ad396dc8c3975550daac8ddcc
SHA256: e95e253f09269c0ed4af077d5f26ab408a98c4a9494f598a2b9399c86942b14a
3952
openvpn-install-2.4.7-I603.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN\Documentation\OpenVPN HOWTO.url
text
MD5: df49f7a44ad28f9506964afc93cae264
SHA256: b093d531ad430911c1d95602e8c1b5c13fd0c79cd4abaa2dd292c6dd88063055
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\modern-wizard.bmp
image
MD5: cbe40fd2b1ec96daedc65da172d90022
SHA256: 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\icon.ico
image
MD5: 66df0c802ac1e0ddeb1f7ed1b2564065
SHA256: c557260b9edcf7f74f1f489aaf21b4d4e7747b584640138e72887268395f248b
3952
openvpn-install-2.4.7-I603.exe
C:\Program Files\OpenVPN\doc\license.txt
text
MD5: d5565772d27ec901160011ea9b1c10b2
SHA256: d4847a21e75ecb2642effff199dafe36c9e8b70e57b5f23aeb12fa9a17eccdfb
3952
openvpn-install-2.4.7-I603.exe
C:\Users\admin\AppData\Local\Temp\nsvEE2F.tmp\modern-header.bmp
image
MD5: cd8bc7b987fa89e7fd5acded7148cf66
SHA256: 127fc8103d7d1daacfb0abb422c9b2aa8ed14fa095e06a997e43445d5d963352
3092
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 91f1bb0e97e132e793bbb4be5926d1de
SHA256: 181f8feb7fe3122cfa479834c020221a50dd05dd43b46408c9838e517d1e21db

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

No network activity.

Debug output strings

No debug info.