General Info

URL

https://www.ur-browser.com/en-US

Full analysis
https://app.any.run/tasks/ad57b11b-5b0d-49d5-b3fe-240574d3dede
Verdict
Malicious activity
Analysis date
4/14/2019, 23:14:54
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:

loader

Indicators:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
180 seconds
Additional time used
120 seconds
Fakenet option
off
Heavy Evaision option
on
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (73.0.3683.75)
  • Google Update Helper (1.3.33.23)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Changes the autorun value in the registry
  • URBrowser.exe (PID: 3696)
Downloads executable files from the Internet
  • URBrowser.exe (PID: 3696)
  • chrome.exe (PID: 1632)
Changes settings of System certificates
  • tapinstall.exe (PID: 2768)
Application was dropped or rewritten from another process
  • ns42CC.tmp (PID: 3896)
  • URBrowser.exe (PID: 3696)
  • UR0.exe (PID: 2572)
  • ns4173.tmp (PID: 2240)
  • tapinstall.exe (PID: 2768)
  • URBrowser.exe (PID: 3696)
  • tapinstall.exe (PID: 2820)
Loads dropped or rewritten executable
  • UR0.exe (PID: 2572)
  • URBrowser.exe (PID: 3696)
Adds / modifies Windows certificates
  • tapinstall.exe (PID: 2768)
Executable content was dropped or overwritten
  • DrvInst.exe (PID: 3080)
  • tapinstall.exe (PID: 2768)
  • DrvInst.exe (PID: 4084)
  • UR0.exe (PID: 2572)
  • URBrowser.exe (PID: 3696)
  • chrome.exe (PID: 1632)
  • chrome.exe (PID: 2848)
Creates files in the Windows directory
  • DrvInst.exe (PID: 4084)
  • DrvInst.exe (PID: 3080)
Uses RUNDLL32.EXE to load library
  • DrvInst.exe (PID: 3080)
Removes files from Windows directory
  • DrvInst.exe (PID: 4084)
  • DrvInst.exe (PID: 3080)
Searches for installed software
  • DrvInst.exe (PID: 3080)
Creates a software uninstall entry
  • UR0.exe (PID: 2572)
Creates files in the driver directory
  • DrvInst.exe (PID: 4084)
  • DrvInst.exe (PID: 3080)
Starts application with an unusual extension
  • UR0.exe (PID: 2572)
Creates files in the program directory
  • UR0.exe (PID: 2572)
Low-level read access rights to disk partition
  • vssvc.exe (PID: 3508)
Application launched itself
  • chrome.exe (PID: 2848)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Screenshots

Processes

Total processes
62
Monitored processes
26
Malicious processes
7
Suspicious processes
2

Behavior graph

+
drop and start drop and start start download and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs urbrowser.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs urbrowser.exe chrome.exe no specs ur0.exe ns4173.tmp no specs tapinstall.exe no specs ns42cc.tmp no specs tapinstall.exe drvinst.exe rundll32.exe no specs vssvc.exe no specs drvinst.exe no specs drvinst.exe
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
2848
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.ur-browser.com/en-US
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
3221225547
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\oleacc.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\hid.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\credui.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\winusb.dll
c:\windows\system32\msi.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\mscms.dll
c:\windows\system32\winsta.dll
c:\windows\system32\wlanapi.dll
c:\windows\system32\wlanutil.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\mmdevapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\wpc.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\samlib.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\firewallapi.dll
c:\windows\system32\kbdus.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\slc.dll
c:\windows\system32\imageres.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\mssprxy.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\rasadhlp.dll
c:\users\admin\downloads\urbrowser.exe
c:\windows\system32\mpr.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\devrtl.dll
c:\program files\winrar\rarext.dll
c:\program files\microsoft office\office14\olkfstub.dll
c:\progra~1\micros~1\office14\mlshext.dll
c:\program files\microsoft office\office14\onfilter.dll
c:\program files\microsoft office\office14\visshe.dll
c:\program files\common files\microsoft shared\office14\msoshext.dll
c:\program files\microsoft office\office14\msohevi.dll
c:\windows\system32\mf.dll
c:\program files\filezilla ftp client\fzshellext.dll
c:\windows\system32\syncui.dll
c:\program files\notepad++\nppshell_06.dll
c:\program files\windows sidebar\sbdrop.dll
c:\windows\system32\stobject.dll
c:\windows\system32\cryptext.dll
c:\windows\system32\colorui.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\winspool.drv
c:\windows\system32\comdlg32.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll

PID
3464
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6f550f18,0x6f550f28,0x6f550f34
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll

PID
2724
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2852 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ole32.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_watcher.dll

PID
3804
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=8380291733244750234 --mojo-platform-channel-handle=976 --ignored=" --type=renderer " /prefetch:2
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\mf.dll
c:\windows\system32\atl.dll
c:\windows\system32\mfplat.dll
c:\windows\system32\avrt.dll
c:\windows\system32\ksuser.dll
c:\windows\system32\msmpeg2vdec.dll
c:\windows\system32\evr.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\slc.dll
c:\windows\system32\sqmapi.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\dxva2.dll
c:\program files\google\chrome\application\73.0.3683.75\d3dcompiler_47.dll
c:\windows\system32\ddraw.dll
c:\windows\system32\dciman32.dll
c:\program files\google\chrome\application\73.0.3683.75\swiftshader\libglesv2.dll
c:\program files\google\chrome\application\73.0.3683.75\swiftshader\libegl.dll

PID
1632
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=13335204396992427922 --mojo-platform-channel-handle=1516 /prefetch:8
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
Parent process
chrome.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wship6.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ntmarta.dll

PID
2540
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --service-pipe-token=11427408582444279516 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11427408582444279516 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll

PID
3100
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --service-pipe-token=16850560471261920050 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16850560471261920050 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll

PID
3952
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --service-pipe-token=5432332868933442938 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5432332868933442938 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll

PID
2652
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=10437556204095854827 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10437556204095854827 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:1
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll

PID
3484
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=12969618676022993591 --mojo-platform-channel-handle=3300 --ignored=" --type=renderer " /prefetch:8
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll

PID
3696
CMD
"C:\Users\admin\Downloads\URBrowser.exe"
Path
C:\Users\admin\Downloads\URBrowser.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
MEDIUM
Exit code
3221226540
Version:
Company
Description
UR Browser Setup
Version
3.0.0.2
Modules
Image
c:\users\admin\downloads\urbrowser.exe
c:\systemroot\system32\ntdll.dll

PID
4068
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=14797321359600660623 --mojo-platform-channel-handle=4116 --ignored=" --type=renderer " /prefetch:8
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll

PID
324
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=999890467872101147 --mojo-platform-channel-handle=4104 --ignored=" --type=renderer " /prefetch:8
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll

PID
2532
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=17399289787547141512 --mojo-platform-channel-handle=4184 --ignored=" --type=renderer " /prefetch:8
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll

PID
3696
CMD
"C:\Users\admin\Downloads\URBrowser.exe"
Path
C:\Users\admin\Downloads\URBrowser.exe
Indicators
Parent process
chrome.exe
User
admin
Integrity Level
HIGH
Version:
Company
Description
UR Browser Setup
Version
3.0.0.2
Modules
Image
c:\users\admin\downloads\urbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\users\admin\appdata\local\temp\nsa24b4.tmp\system.dll
c:\users\admin\appdata\local\temp\nsa24b4.tmp\uractions.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\oleacc.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\winmm.dll
c:\windows\system32\winspool.drv
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\credssp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\schannel.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\urbr\ur0.exe

PID
2992
CMD
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=952,469201226897121004,1963892608864043731,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4457489466169182108 --mojo-platform-channel-handle=4200 --ignored=" --type=renderer " /prefetch:8
Path
C:\Program Files\Google\Chrome\Application\chrome.exe
Indicators
No indicators
Parent process
chrome.exe
User
admin
Integrity Level
LOW
Exit code
0
Version:
Company
Google Inc.
Description
Google Chrome
Version
73.0.3683.75
Modules
Image
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_child.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dbghelp.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll

PID
2572
CMD
"C:\Users\admin\AppData\Local\Temp\UrBr\UR0.exe" /S /SELECT_UTILITIES=1
Path
C:\Users\admin\AppData\Local\Temp\UrBr\UR0.exe
Indicators
Parent process
URBrowser.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\urbr\ur0.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\users\admin\appdata\local\temp\nsl4114.tmp\userinfo.dll
c:\users\admin\appdata\local\temp\nsl4114.tmp\system.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\users\admin\appdata\local\temp\nsl4114.tmp\nsexec.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\nsl4114.tmp\ns4173.tmp
c:\users\admin\appdata\local\temp\nsl4114.tmp\ns42cc.tmp
c:\windows\system32\netutils.dll

PID
2240
CMD
"C:\Users\admin\AppData\Local\Temp\nsl4114.tmp\ns4173.tmp" "C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
Path
C:\Users\admin\AppData\Local\Temp\nsl4114.tmp\ns4173.tmp
Indicators
No indicators
Parent process
UR0.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\nsl4114.tmp\ns4173.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\program files\tap-windows\bin\tapinstall.exe

PID
2820
CMD
"C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
Path
C:\Program Files\TAP-Windows\bin\tapinstall.exe
Indicators
No indicators
Parent process
ns4173.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Windows (R) Win 7 DDK provider
Description
Windows Setup API
Version
6.1.7600.16385 built by: WinDDK
Modules
Image
c:\program files\tap-windows\bin\tapinstall.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\wintrust.dll

PID
3896
CMD
"C:\Users\admin\AppData\Local\Temp\nsl4114.tmp\ns42CC.tmp" "C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
Path
C:\Users\admin\AppData\Local\Temp\nsl4114.tmp\ns42CC.tmp
Indicators
No indicators
Parent process
UR0.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\nsl4114.tmp\ns42cc.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\program files\tap-windows\bin\tapinstall.exe

PID
2768
CMD
"C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
Path
C:\Program Files\TAP-Windows\bin\tapinstall.exe
Indicators
Parent process
ns42CC.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Windows (R) Win 7 DDK provider
Description
Windows Setup API
Version
6.1.7600.16385 built by: WinDDK
Modules
Image
c:\program files\tap-windows\bin\tapinstall.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\spinf.dll
c:\windows\system32\netcfgx.dll
c:\windows\system32\slc.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nci.dll
c:\windows\system32\wlaninst.dll
c:\windows\system32\wwaninst.dll
c:\windows\system32\newdev.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\drvstore.dll

PID
3080
CMD
DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{7fd732dc-58e5-41df-9e7c-08636a8bde57}\oemvista.inf" "0" "6d14a44ff" "000004D8" "WinSta0\Default" "0000057C" "208" "c:\program files\tap-windows\driver"
Path
C:\Windows\system32\DrvInst.exe
Indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Driver Installation Module
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\drvstore.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\spinf.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rundll32.exe
c:\windows\system32\ntmarta.dll
c:\windows\system32\srclient.dll
c:\windows\system32\spp.dll
c:\windows\system32\vssapi.dll
c:\windows\system32\atl.dll
c:\windows\system32\vsstrace.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\vss_ps.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\es.dll
c:\windows\system32\sxs.dll
c:\windows\system32\propsys.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\netutils.dll

PID
3916
CMD
rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{44f4e71f-c761-2971-67d0-a47e8cbfc726} Global\{18f5730d-c798-4897-69a8-b72d8e71ce14} C:\Windows\System32\DriverStore\Temp\{4916285b-5c86-3520-d457-8d61514b2d5b}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{4916285b-5c86-3520-d457-8d61514b2d5b}\tap0901.cat
Path
C:\Windows\system32\rundll32.exe
Indicators
No indicators
Parent process
DrvInst.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows host process (Rundll32)
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\pnpui.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\dui70.dll
c:\windows\system32\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\spinf.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\propsys.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\slc.dll
c:\windows\system32\imageres.dll
c:\windows\system32\duser.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\xmllite.dll
c:\windows\system32\netutils.dll

PID
3508
CMD
C:\Windows\system32\vssvc.exe
Path
C:\Windows\system32\vssvc.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
Microsoft Corporation
Description
Microsoft® Volume Shadow Copy Service
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\atl.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\vssapi.dll
c:\windows\system32\vsstrace.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\clusapi.dll
c:\windows\system32\cryptdll.dll
c:\windows\system32\xolehlp.dll
c:\windows\system32\version.dll
c:\windows\system32\resutils.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\authz.dll
c:\windows\system32\virtdisk.dll
c:\windows\system32\fltlib.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\vss_ps.dll
c:\windows\system32\samlib.dll
c:\windows\system32\es.dll
c:\windows\system32\propsys.dll
c:\windows\system32\catsrvut.dll
c:\windows\system32\mfcsubs.dll
c:\windows\system32\sxs.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll

PID
1476
CMD
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000005E8" "000005E4"
Path
C:\Windows\system32\DrvInst.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Driver Installation Module
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\spinf.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\spfileq.dll

PID
4084
CMD
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oemvista.inf:tap0901:tap0901.ndi:9.0.0.21:tap0901" "6d14a44ff" "000004D8" "000005CC" "000005E8"
Path
C:\Windows\system32\DrvInst.exe
Indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Driver Installation Module
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\spinf.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\netcfgx.dll
c:\windows\system32\slc.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nci.dll
c:\windows\system32\wlaninst.dll
c:\windows\system32\wwaninst.dll
c:\windows\system32\spfileq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ndiscapcfg.dll
c:\windows\system32\rascfg.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\mprapi.dll
c:\windows\system32\mprmsg.dll
c:\windows\system32\tcpipcfg.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\wshnetbs.dll

Registry activity

Total events
2050
Read events
1394
Write events
604
Delete events
52

Modification events

PID
Process
Operation
Key
Name
Value
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\Interfaces
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin\enum
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MAC
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus\enum
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ip
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ipv6
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ip
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ipv6
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ip
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ipv6
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\00000017
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration\Providers\NetBIOS
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\00000018
4084
DrvInst.exe
delete key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NetCfgLockHolder
4084
DrvInst.exe
write
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi
Service
tap0901
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\Interfaces
UpperRange
ndis5
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\Interfaces
LowerRange
ethernet
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey
Manufacturer
TAP-Windows Provider V9
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey
ProductName
TAP-Windows Adapter V9
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
ParamDesc
MTU
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Type
int
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Default
1500
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Optional
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Min
100
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Max
1500
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MTU
Step
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
ParamDesc
Media Status
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
Type
enum
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
Default
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus
Optional
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus\enum
0
Application Controlled
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MediaStatus\enum
1
Always Connected
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MAC
ParamDesc
MAC Address
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MAC
Type
edit
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\MAC
Optional
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
ParamDesc
Non-Admin Access
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
Type
enum
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
Default
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin
Optional
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin\enum
0
Not Allowed
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NDISTempKey\Ndi\params\AllowNonAdmin\enum
1
Allowed
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles
%SystemPath%\system32\DRIVERS\tap0901.sys
5
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
NewDeviceInstall
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
NetCfgInstanceId
{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
*IfType
6
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
Characteristics
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
*MediaType
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
*PhysicalMediaType
14
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{F1E561B4-C49E-465A-BCD4-CBA151503617}\Connection
DefaultNameResourceId
1803
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{F1E561B4-C49E-465A-BCD4-CBA151503617}\Connection
DefaultNameIndex
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{F1E561B4-C49E-465A-BCD4-CBA151503617}\Connection
Name
Local Area Connection
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
NetLuidIndex
9
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
DeviceInstanceID
ROOT\NET\0000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
InstallTimeStamp
E307040000000E0015000F0033004801
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi
Service
tap0901
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\Interfaces
UpperRange
ndis5
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\Interfaces
LowerRange
ethernet
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
Manufacturer
TAP-Windows Provider V9
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
ProductName
TAP-Windows Adapter V9
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
ParamDesc
MTU
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Type
int
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Default
1500
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Optional
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Min
100
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Max
1500
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MTU
Step
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus
ParamDesc
Media Status
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus
Type
enum
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus
Default
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus
Optional
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus\enum
0
Application Controlled
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MediaStatus\enum
1
Always Connected
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MAC
ParamDesc
MAC Address
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MAC
Type
edit
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\MAC
Optional
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin
ParamDesc
Non-Admin Access
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin
Type
enum
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin
Default
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin
Optional
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin\enum
0
Not Allowed
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Ndi\params\AllowNonAdmin\enum
1
Allowed
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
ComponentId
tap0901
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions
TAP-Windows Adapter V9
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\NET\0000\Device Parameters
InstanceIndex
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
AllowNonAdmin
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
MediaStatus
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011
MTU
1500
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\GroupOrderList
NDIS
170000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F0000001000000011000000120000001300000014000000150000001600000017000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\NetCfgLockHolder
INetCfg Installer Interface
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Linkage
Bind
\Device\Smb_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Linkage
Route
"Smb" "Tcpip" "{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Linkage
Export
\Device\LanmanServer_Smb_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Linkage
LanaMap
01030100010401010102
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Parameters
MaxLana
4
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Linkage
Bind
\Device\NetBT_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Linkage
Route
"NetBT" "Tcpip" "{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS\Linkage
Export
\Device\NetBIOS_NetBT_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Linkage
Bind
\Device\Smb_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Linkage
Route
"Smb" "Tcpip" "{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Linkage
Export
\Device\LanmanWorkstation_Smb_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio\Linkage
Bind
\Device\{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio\Linkage
Route
"{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio\Linkage
Export
\Device\Ndisuio_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe\Linkage
Bind
\Device\{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe\Linkage
Route
"{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe\Linkage
Export
\Device\RasPppoe_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr\Linkage
Bind
\Device\{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr\Linkage
Route
"{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr\Linkage
Export
\Device\rspndr_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio\Linkage
Bind
\Device\{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio\Linkage
Route
"{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio\Linkage
Export
\Device\lltdio_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Linkage
Bind
\Device\{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Linkage
Route
"{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Linkage
Export
\Device\Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb\Linkage
Bind
\Device\Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb\Linkage
Route
"Tcpip" "{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb\Linkage
Export
\Device\Smb_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Linkage
Bind
\Device\Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Linkage
Route
"Tcpip" "{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Linkage
Export
\Device\NetBT_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Linkage
Bind
\Device\{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Linkage
Route
"{F1E561B4-C49E-465A-BCD4-CBA151503617}"
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Linkage
Export
\Device\Tcpip6_{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Linkage
RootDevice
{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Linkage
UpperBind
Ndisuio
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Linkage
Export
\Device\{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces
Stamp
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
InterfaceName
Loopback
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
Type
5
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
Enabled
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\RouterManagers
Stamp
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0
Stamp
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ip
ProtocolId
33
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ip
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
InterfaceName
Internal
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
Type
4
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
Enabled
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1
Stamp
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ip
ProtocolId
33
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ip
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ipv6
ProtocolId
87
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ipv6
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ipv6
ProtocolId
87
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ipv6
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
InterfaceName
{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
Type
3
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
Enabled
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2
Stamp
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ip
ProtocolId
33
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ip
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ipv6
ProtocolId
87
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ipv6
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3
InterfaceName
{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3
Type
3
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3
Enabled
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3
Stamp
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3\Ip
ProtocolId
33
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3\Ip
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3\Ipv6
ProtocolId
87
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3\Ipv6
InterfaceInfo
0100000068000000030000000500FFFF4800000000000000400000000400FFFF0400000001000000400000000700FFFF1000000001000000480000000000000001000000000000005802C20108070000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0004
MaxWanEndpoints
3
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0003
MaxWanEndpoints
3
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0002
MaxWanEndpoints
3
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0000
MaxWanEndpoints
3
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0001
MaxWanEndpoints
3
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0003
WanEndpoints
2
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0002
WanEndpoints
2
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0000
WanEndpoints
2
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0001
WanEndpoints
2
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
SearchList
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
UseDomainNameDevolution
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
IPEnableRouter
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
EnableICMPRedirect
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
DeadGWDetectDefault
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters
DontAddDefaultGatewayDefault
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Adapters\{F1E561B4-C49E-465A-BCD4-CBA151503617}
LLInterface
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Adapters\{F1E561B4-C49E-465A-BCD4-CBA151503617}
IpConfig
Tcpip\Parameters\Interfaces\{F1E561B4-C49E-465A-BCD4-CBA151503617}
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
EnableDHCP
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
NameServer
192.168.100.2
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Domain
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
RegistrationEnabled
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
RegisterAdapterName
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}\Parameters\Tcpip
EnableDHCP
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}\Parameters\Tcpip
IPAddress
192.168.100.24
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}\Parameters\Tcpip
SubnetMask
255.255.255.0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{4040CF00-1B3E-486A-B407-FA14C56B6FC0}\Parameters\Tcpip
DefaultGateway
192.168.100.2
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dhcp\Configurations
Options
32000000000000000400000000000000FFFFFF7F0000000001000000000000000400000000000000FFFFFF7F00000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{F1E561B4-C49E-465A-BCD4-CBA151503617}
UseZeroBroadcast
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{F1E561B4-C49E-465A-BCD4-CBA151503617}
EnableDeadGWDetect
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{F1E561B4-C49E-465A-BCD4-CBA151503617}
EnableDHCP
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{F1E561B4-C49E-465A-BCD4-CBA151503617}
NameServer
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{F1E561B4-C49E-465A-BCD4-CBA151503617}
Domain
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{F1E561B4-C49E-465A-BCD4-CBA151503617}
RegistrationEnabled
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{F1E561B4-C49E-465A-BCD4-CBA151503617}
RegisterAdapterName
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{F1E561B4-C49E-465A-BCD4-CBA151503617}\Parameters\Tcpip
EnableDHCP
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters
EnableLMHOSTS
1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
NameServerList
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
NetbiosOptions
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
NameServerList
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}
NetbiosOptions
0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041006600020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192E90300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
ProtocolName
@%SystemRoot%\System32\wshtcpip.dll,-60100
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041000906020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192EA0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
ProtocolName
@%SystemRoot%\System32\wshtcpip.dll,-60101
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D0046004100090602000000000000000000000000000C000000A01A0FE78BABCF118CA300805F48A192EB0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000300000000000000FF0000000000000000000000008000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300032000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
ProtocolName
@%SystemRoot%\System32\wshtcpip.dll,-60102
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041006600020000000000000000000000000008000000C0B0EAF9D426D011BBBF00AA006C34E4EC030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
ProtocolName
@%SystemRoot%\System32\wship6.dll,-60100
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041000906020000000000000000000000000008000000C0B0EAF9D426D011BBBF00AA006C34E4ED030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
ProtocolName
@%SystemRoot%\System32\wship6.dll,-60101
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D0046004100090602000000000000000000000000000C000000C0B0EAF9D426D011BBBF00AA006C34E4EE030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000300000000000000FF0000000000000000000000008000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
ProtocolName
@%SystemRoot%\System32\wship6.dll,-60102
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041006620020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF3030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
ProtocolName
@%SystemRoot%\System32\wshqos.dll,-100
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041006620020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF40300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
ProtocolName
@%SystemRoot%\System32\wshqos.dll,-101
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041000926020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF5030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
ProtocolName
@%SystemRoot%\System32\wshqos.dll,-102
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000800000030185F8D73C2CF1195C800805F48A1921B040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D00460041000926020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF60300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
ProtocolName
@%SystemRoot%\System32\wshqos.dll,-103
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Num_Catalog_Entries
10
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Next_Catalog_Entry_ID
1057
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Serial_Access_Num
24
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration\Providers\NetBIOS
WinSock 1.1 Provider Data
0E10000011000000140000001400000005000000FDFFFFFF00FA0000720500000912000011000000140000001400000002000000FDFFFFFF00FA0000FC0400000E100000110000001400000014000000050000000000008000FA00008604000009120000110000001400000014000000020000000000008000FA0000100400000E10000011000000140000001400000005000000FCFFFFFF00FA0000980300000912000011000000140000001400000002000000FCFFFFFF00FA0000200300000E10000011000000140000001400000005000000FFFFFFFF00FA0000A80200000912000011000000140000001400000002000000FFFFFFFF00FA0000300200000E10000011000000140000001400000005000000FEFFFFFF00FA0000B80100000912000011000000140000001400000002000000FEFFFFFF00FA0000400100005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00370031003400410032004600420031002D0031003100300046002D0034003800450039002D0038004600460036002D004200460032003600380045003600450045004400300036007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00370031003400410032004600420031002D0031003100300046002D0034003800450039002D0038004600460036002D004200460032003600380045003600450045004400300036007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00460031004500350036003100420034002D0043003400390045002D0034003600350041002D0042004300440034002D004300420041003100350031003500300033003600310037007D0000005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00460031004500350036003100420034002D0043003400390045002D0034003600350041002D0042004300440034002D004300420041003100350031003500300033003600310037007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00460031004500350036003100420034002D0043003400390045002D0034003600350041002D0042004300440034002D004300420041003100350031003500300033003600310037007D0000005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00460031004500350036003100420034002D0043003400390045002D0034003600350041002D0042004300440034002D004300420041003100350031003500300033003600310037007D000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration\Providers\NetBIOS
WinSock 2.0 Provider ID
30185F8D73C2CF1195C800805F48A192
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006600020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192E90300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000906020000000000000000000000000008000000A01A0FE78BABCF118CA300805F48A192EA0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090602000000000000000000000000000C000000A01A0FE78BABCF118CA300805F48A192EB0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000300000000000000FF0000000000000000000000008000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C00770073006800740063007000690070002E0064006C006C002C002D00360030003100300032000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006600020000000000000000000000000008000000C0B0EAF9D426D011BBBF00AA006C34E4EC030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000906020000000000000000000000000008000000C0B0EAF9D426D011BBBF00AA006C34E4ED030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090602000000000000000000000000000C000000C0B0EAF9D426D011BBBF00AA006C34E4EE030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000300000000000000FF0000000000000000000000008000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C007700730068006900700036002E0064006C006C002C002D0036003000310030003200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006620020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF3030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006620020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF40300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000100000006000000000000000000000000000000000000000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000926020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF5030000010000000000000000000000000000000000000000000000000000000000000002000000170000001C0000001C0000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000926020000000000000000000000000008000000E0A9609D7A33D011BD880000C082E69AF60300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000F7FF00000000000040002500530079007300740065006D0052006F006F00740025005C00530079007300740065006D00330032005C0077007300680071006F0073002E0064006C006C002C002D0031003000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922104000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FDFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00460031004500350036003100420034002D0043003400390045002D0034003600350041002D0042004300440034002D004300420041003100350031003500300033003600310037007D005D0020005300450051005000410043004B00450054002000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}] SEQPACKET 3
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922204000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FDFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00460031004500350036003100420034002D0043003400390045002D0034003600350041002D0042004300440034002D004300420041003100350031003500300033003600310037007D005D00200044004100540041004700520041004D0020003300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip_{F1E561B4-C49E-465A-BCD4-CBA151503617}] DATAGRAM 3
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000800000030185F8D73C2CF1195C800805F48A19223040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000050000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D005D0020005300450051005000410043004B00450054002000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}] SEQPACKET 0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000800000030185F8D73C2CF1195C800805F48A19224040000010000000000000000000000000000000000000000000000000000000000000002000000110000001400000014000000020000000000008000000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F00540063007000690070005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D005D00200044004100540041004700520041004D0020003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}] DATAGRAM 0
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922504000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FCFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00460031004500350036003100420034002D0043003400390045002D0034003600350041002D0042004300440034002D004300420041003100350031003500300033003600310037007D005D0020005300450051005000410043004B0045005400200034000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F1E561B4-C49E-465A-BCD4-CBA151503617}] SEQPACKET 4
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922604000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FCFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00460031004500350036003100420034002D0043003400390045002D0034003600350041002D0042004300440034002D004300420041003100350031003500300033003600310037007D005D00200044004100540041004700520041004D002000340000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F1E561B4-C49E-465A-BCD4-CBA151503617}] DATAGRAM 4
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922704000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FFFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00370031003400410032004600420031002D0031003100300046002D0034003800450039002D0038004600460036002D004200460032003600380045003600450045004400300036007D005D0020005300450051005000410043004B0045005400200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{714A2FB1-110F-48E9-8FF6-BF268E6EED06}] SEQPACKET 1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922804000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FFFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00370031003400410032004600420031002D0031003100300046002D0034003800450039002D0038004600460036002D004200460032003600380045003600450045004400300036007D005D00200044004100540041004700520041004D002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{714A2FB1-110F-48E9-8FF6-BF268E6EED06}] DATAGRAM 1
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E0002000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922904000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000005000000FEFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D005D0020005300450051005000410043004B0045005400200032000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}] SEQPACKET 2
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020
PackedCatalogItem
2553797374656D526F6F74255C73797374656D33325C6D7377736F636B2E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090202000000000000000000000000000000000030185F8D73C2CF1195C800805F48A1922A04000001000000000000000000000000000000000000000000000000000000000000000200000011000000140000001400000002000000FEFFFFFF00000000000000000000000000FA0000000000004D00530041004600440020004E0065007400420049004F00530020005B005C004400650076006900630065005C004E0065007400420054005F005400630070006900700036005F007B00340030003400300043004600300030002D0031004200330045002D0034003800360041002D0042003400300037002D004600410031003400430035003600420036004600430030007D005D00200044004100540041004700520041004D002000320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020
ProtocolName
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{4040CF00-1B3E-486A-B407-FA14C56B6FC0}] DATAGRAM 2
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Num_Catalog_Entries
20
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Next_Catalog_Entry_ID
1067
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Serial_Access_Num
25
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock\Setup Migration
Provider List
Tcpip6
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0011\Linkage
FilterList
{F1E561B4-C49E-465A-BCD4-CBA151503617}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007\Linkage
FilterList
{4040CF00-1B3E-486A-B407-FA14C56B6FC0}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0008\Linkage
FilterList
{7C5653F0-144A-4534-9E34-28AC99CBA85E}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0006\Linkage
FilterList
{72DD97A9-E544-4915-88D8-44E829C34F68}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
4084
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0005\Linkage
FilterList
{F3229805-869E-479E-BA76-DD643F1D1B80}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000
2724
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
2848-13199750110013000
259
2724
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
2848-13199750110013000
0
1632
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
failed_count
0
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
2
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
01000000
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
1
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
dr
1
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome
UsageStatsInSample
0
2848
chrome.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
usagestats
0
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
metricsid
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
metricsid_installdate
0
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
metricsid_enableddate
0
2848
chrome.exe
delete key
HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
2848
chrome.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_NumAccounts
aggregate
sum()
2848
chrome.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_NumAccounts
S-1-5-21-1302019708-1500728564-335382590-1000
1
2848
chrome.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_NumSignedIn
aggregate
sum()
2848
chrome.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\_NumSignedIn
S-1-5-21-1302019708-1500728564-335382590-1000
0
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
0
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
13199750111231750
2848
chrome.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
460000006E000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Implementing
1C00000001000000E307040000000E0015000F0011006E0200000000
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Implementing
1C00000001000000E307040000000E0015000F001100730200000000
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
1
2848
chrome.exe
delete key
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
aapocclcgogkmnckokdopfmhonfmgoek
24C117258554734D4D0029C718F10AD6DA3142986DC79092C474C80AAA7B287D
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ahfgeienlihckogmohjhadlkjgocpleb
15B1C3FE35F29528448F36A72A4DFBC58A8083C7190559D25865779166D220A2
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
aohghmighlieiainnegkcijnfilokake
A5ED3BFAB7BB63B99FE012923C4978915A378B30F84D0BE1A13AE74095DA1A19
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
apdfllckaahabafndbhieahigkjlhalf
C7AE9AFC9314378B6ADFF644530620A3ECFD8155740068EECD25A5A6D287199B
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
blpcfgokakmgnkcojhhkbfbldkacnbeo
D3B3C931FFFEA60BB581DCECF7828117F6391EAF3B9515F03B48D16144493EA7
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
felcaaldnbdncclmgdcncolpebgiejap
0B69FB121CB5A846FB44AF87ADCAB01BCF9E30450E78C53673BBB8BA48C3A1D3
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gfdkimpbcpahaombhbimeihdjnejgicl
D6B079666F209503A09486C70AC09307652A0F7F783166A999B27C99D0DA79E2
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ghbmnnjooekpmoecnnnilnnbdlolhkhi
E06887B5B64A20FF960747BCCB7C142A773E6EC870ED0147A0111BF86AF6B8C3
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
00175B8120231631976CA8B862A3416996C9373BA3D289F0619DDA992973DDFA
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mfehgcgbbipciphmccgaenjidiccnmng
63355C14E8C7DF9A075F2EDDEA6F2807DC8166B83F96F4C975B9B6554C6324D7
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai
0E265BFED6F1C7D5F0A9BD790C50BB30E78E959631D51EEBB8BB0DE73E65763C
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
04A45240BDA55E8777FA04357712CA6DD942253A21323E4C7D3CCF769B34BFED
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
EFA63CBF982B82CF44E63E567FF3BB95FE3F51570D9A0CED8846E77B13199169
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
5B14DE306F9AB1F7EC49B672B377593CB49FA943819178E02CF97C158E23256C
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
pjkljhegncpnkpknbcohdijeoejaedia
F2D15FEA4E7C52107DB648314EF7E863470F9261BC1E5DC1BF3A260DF30B6A0F
2848
chrome.exe
write
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
pkedcjkdefgpdelpbcmbmeomcjbeemfm
49D056EBBA678889BA3ED931E2A2B41998BE3B226366C3C1A002E466D210DB70
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\abee
tempappinstanceuid
abe5526a-fecc-4186-ba03-5ee3dcef0421
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser
AppInstanceUid
abe5526a-fecc-4186-ba03-5ee3dcef0421
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser
Lang
en-US
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
AppInstanceUid
abe5526a-fecc-4186-ba03-5ee3dcef0421
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
Birthdate
1555276527
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
ConfigurationFields
22
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
CountryCode
PL
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
Lang
en-US
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
Mydistributionoption
0
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
Distribution
11
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
Refid
2329
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
Channelprofilename
BETA
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
Addvpn
1
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\URBrowser\InitPrefs
SData
eyJyZWZpZCI6IDIwMjksInRpbWVzdGFtcCI6IDE1NTI0ODQyMTIsIm9wZXJhdGlvbnMiOiB7InJlbW92ZSI6IFtdLCJhZGQiOiBbXSwidXBkYXRlIjogW119fQ==
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\abee
URBrowser
abe5526a-fecc-4186-ba03-5ee3dcef0421
3696
URBrowser.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
abee_URBrowser
"C:\Users\admin\AppData\Local\URBrowser\Application\URBrowser.exe" --location=0
3696
URBrowser.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\URBrowser
C:\Users\admin\AppData\Local\URBrowser\Application
2572
UR0.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\TAP-Windows
C:\Program Files\TAP-Windows
2572
UR0.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TAP-Windows
DisplayName
TAP-Windows 9.21.2
2572
UR0.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TAP-Windows
UninstallString
C:\Program Files\TAP-Windows\Uninstall.exe
2572
UR0.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TAP-Windows
DisplayIcon
C:\Program Files\TAP-Windows\icon.ico
2572
UR0.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TAP-Windows
DisplayVersion
9.21.2
2768
tapinstall.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
setupapi.app.log
4096
2768
tapinstall.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
setupapi.dev.log
4096
2768
tapinstall.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US
2768
tapinstall.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
Blob
0F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE09000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C01400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB5748501D00000001000000100000005B3B67000EEB80022E42605B6B3B72400B000000010000000E000000740068006100770074006500000003000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B812000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68
2768
tapinstall.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
Blob
190000000100000010000000DC73F9B71E16D51D26527D32B11A6A3D03000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B810B000000010000000E00000074006800610077007400650000001D00000001000000100000005B3B67000EEB80022E42605B6B3B72401400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB57485053000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C009000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B060105050703030F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE2000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68
3080
DrvInst.exe
write
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
SrCreateRp (Enter)
4000000000000000D181963307F3D401080C0000740F0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppCreate (Enter)
4000000000000000D181963307F3D401080C0000740F0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
LastIndex
20
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppGatherWriterMetadata (Enter)
4000000000000000C591E73307F3D401080C0000740F0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
IDENTIFY (Enter)
4000000000000000C591E73307F3D401080C00008C0F0000E803000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
IDENTIFY (Leave)
4000000000000000AFE8E13407F3D401080C00008C0F0000E803000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppGatherWriterMetadata (Leave)
4000000000000000831D6A3A07F3D401080C0000740F0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppAddInterestingComponents (Enter)
4000000000000000831D6A3A07F3D401080C0000740F0000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppAddInterestingComponents (Leave)
4000000000000000F9CD7A3A07F3D401080C0000740F0000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
PREPAREBACKUP (Enter)
4000000000000000C9E08D3A07F3D401080C000024080000E903000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
PREPAREBACKUP (Leave)
40000000000000005BDFAC3A07F3D401080C000024080000E903000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
GETSTATE (Enter)
40000000000000005BDFAC3A07F3D401080C000070010000F903000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
GETSTATE (Leave)
40000000000000001DCBB83A07F3D401080C000070010000F903000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
DOSNAPSHOT (Enter)
4000000000000000D18FBD3A07F3D401080C0000740F00000A04000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
DOSNAPSHOT (Leave)
400000000000000029E8983B07F3D401080C0000D40600000A04000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppCreate (Leave)
400000000000000029E8983B07F3D401080C0000740F0000D0070000010000000000000000000000000000000000000000000000000000000000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
SrCreateRp (Leave)
400000000000000029E8983B07F3D401080C0000740F0000D5070000010000000000000000000000000000000000000000000000000000000000000000000000
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
FirstRun
0
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
LastIndex
20
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
NestingLevel
1
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
StartNesting
D181963307F3D401
3080
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
NestingLevel
0
3916
rundll32.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
IDENTIFY (Enter)
400000000000000095A4FA3307F3D401B40D0000800F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
IDENTIFY (Enter)
400000000000000095A4FA3307F3D401B40D0000E8010000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
IDENTIFY (Enter)
400000000000000095A4FA3307F3D401B40D0000380B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
IDENTIFY (Enter)
400000000000000095A4FA3307F3D401B40D00004C080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
IDENTIFY (Leave)
40000000000000004969FF3307F3D401B40D0000380B0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
IDENTIFY (Leave)
40000000000000004969FF3307F3D401B40D0000E8010000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
IDENTIFY (Leave)
4000000000000000FD2D043407F3D401B40D00004C080000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
IDENTIFY (Leave)
40000000000000005790063407F3D401B40D0000800F0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_BEGINPREPARE (Enter)
4000000000000000C9E08D3A07F3D401B40D0000800F00000104000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_BEGINPREPARE (Leave)
4000000000000000C9E08D3A07F3D401B40D0000800F00000104000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPAREBACKUP (Enter)
4000000000000000316A973A07F3D401B40D0000E8010000E903000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPAREBACKUP (Enter)
4000000000000000316A973A07F3D401B40D00004C080000E903000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPAREBACKUP (Enter)
4000000000000000316A973A07F3D401B40D0000800F0000E903000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPAREBACKUP (Leave)
4000000000000000E52E9C3A07F3D401B40D0000E8010000E903000000000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_STABLE (SetCurrentState)
4000000000000000E52E9C3A07F3D401B40D0000E80100000100000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPAREBACKUP (Leave)
4000000000000000E52E9C3A07F3D401B40D00004C080000E903000000000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_STABLE (SetCurrentState)
4000000000000000E52E9C3A07F3D401B40D00004C0800000100000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPAREBACKUP (Leave)
40000000000000003F919E3A07F3D401B40D0000800F0000E903000000000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_STABLE (SetCurrentState)
40000000000000003F919E3A07F3D401B40D0000800F00000100000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
GETSTATE (Enter)
4000000000000000C368B63A07F3D401B40D0000800F0000F903000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
GETSTATE (Enter)
4000000000000000C368B63A07F3D401B40D0000E8010000F903000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
GETSTATE (Enter)
4000000000000000C368B63A07F3D401B40D00004C080000F903000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
GETSTATE (Leave)
4000000000000000C368B63A07F3D401B40D00004C080000F903000000000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
GETSTATE (Leave)
4000000000000000C368B63A07F3D401B40D0000E8010000F903000000000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
GETSTATE (Leave)
40000000000000001DCBB83A07F3D401B40D0000800F0000F903000000000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_ENDPREPARE (Enter)
40000000000000002BF2BF3A07F3D401B40D0000A00800000204000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_ENDPREPARE (Leave)
40000000000000004977263B07F3D401B40D0000A00800000204000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
PREPARESNAPSHOT (Enter)
40000000000000004977263B07F3D401B40D0000A0080000EA03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPARESNAPSHOT (Enter)
4000000000000000B100303B07F3D401B40D0000000C0000EA03000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPARESNAPSHOT (Enter)
4000000000000000B100303B07F3D401B40D0000EC0C0000EA03000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPARESNAPSHOT (Enter)
4000000000000000B100303B07F3D401B40D0000F40D0000EA03000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPARESNAPSHOT (Leave)
400000000000000035D8473B07F3D401B40D0000EC0C0000EA03000000000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
400000000000000035D8473B07F3D401B40D0000EC0C00000200000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPARESNAPSHOT (Leave)
400000000000000035D8473B07F3D401B40D0000F40D0000EA03000000000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
400000000000000035D8473B07F3D401B40D0000F40D00000200000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPARESNAPSHOT (Leave)
400000000000000035D8473B07F3D401B40D0000000C0000EA03000000000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
400000000000000035D8473B07F3D401B40D0000000C00000200000001000000010000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
PREPARESNAPSHOT (Leave)
40000000000000002139693B07F3D401B40D0000A0080000EA03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE (Enter)
40000000000000002139693B07F3D401B40D0000A0080000EB03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_FRONT (Enter)
40000000000000002139693B07F3D401B40D0000A0080000EC03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
FREEZE (Enter)
40000000000000007B9B6B3B07F3D401B40D0000E80B0000EB03000001000000020000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
FREEZE (Leave)
40000000000000007B9B6B3B07F3D401B40D0000E80B0000EB03000000000000020000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
40000000000000007B9B6B3B07F3D401B40D0000E80B00000300000001000000020000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BKGND_FREEZE_THREAD (Enter)
40000000000000007B9B6B3B07F3D401B40D00003C090000FC03000001000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_FRONT (Leave)
40000000000000007B9B6B3B07F3D401B40D0000A0080000EC03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_BACK (Enter)
40000000000000007B9B6B3B07F3D401B40D0000A0080000ED03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_BACK (Leave)
40000000000000002F60703B07F3D401B40D0000A0080000ED03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_SYSTEM (Enter)
40000000000000002F60703B07F3D401B40D0000A0080000EE03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
FREEZE (Enter)
400000000000000089C2723B07F3D401B40D0000240B0000EB03000001000000020000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
FREEZE (Leave)
400000000000000089C2723B07F3D401B40D0000240B0000EB03000000000000020000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
400000000000000089C2723B07F3D401B40D0000240B00000300000001000000020000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BKGND_FREEZE_THREAD (Enter)
400000000000000089C2723B07F3D401B40D000074090000FC03000001000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_SYSTEM (Leave)
4000000000000000E324753B07F3D401B40D0000A0080000EE03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_KTM (Enter)
4000000000000000E324753B07F3D401B40D0000A0080000F003000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_KTM (Leave)
4000000000000000E324753B07F3D401B40D0000A0080000F003000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_RM (Enter)
4000000000000000E324753B07F3D401B40D0000A0080000EF03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
FREEZE (Enter)
400000000000000097E9793B07F3D401B40D0000EC0C0000EB03000001000000020000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
FREEZE (Leave)
4000000000000000A510813B07F3D401B40D0000EC0C0000EB03000000000000020000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
4000000000000000A510813B07F3D401B40D0000EC0C00000300000001000000020000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BKGND_FREEZE_THREAD (Enter)
4000000000000000A510813B07F3D401B40D0000600B0000FC03000001000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_RM (Leave)
4000000000000000A510813B07F3D401B40D0000A0080000EF03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE (Leave)
4000000000000000A510813B07F3D401B40D0000A0080000EB03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PRECOMMIT (Enter)
4000000000000000A510813B07F3D401B40D0000A00800000304000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PRECOMMIT (Leave)
4000000000000000A510813B07F3D401B40D0000A00800000304000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
OPEN_VOLUME_HANDLE (Enter)
4000000000000000A510813B07F3D401B40D0000A0080000FD03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
OPEN_VOLUME_HANDLE (Enter)
4000000000000000A510813B07F3D401B40D0000340D0000FD03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
OPEN_VOLUME_HANDLE (Leave)
4000000000000000C15E8F3B07F3D401B40D0000340D0000FD03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
OPEN_VOLUME_HANDLE (Leave)
4000000000000000C15E8F3B07F3D401B40D0000A0080000FD03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_FLUSH_AND_HOLD (Enter)
4000000000000000C15E8F3B07F3D401B40D0000340D0000FE03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_FLUSH_AND_HOLD (Leave)
4000000000000000CF85963B07F3D401B40D0000340D0000FE03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_RELEASE (Enter)
4000000000000000CF85963B07F3D401B40D0000340D0000FF03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_RELEASE (Leave)
4000000000000000CF85963B07F3D401B40D0000340D0000FF03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_FLUSH_AND_HOLD (Enter)
4000000000000000C15E8F3B07F3D401B40D0000A0080000FE03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_FLUSH_AND_HOLD (Leave)
4000000000000000CF85963B07F3D401B40D0000A0080000FE03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_RELEASE (Enter)
4000000000000000CF85963B07F3D401B40D0000A0080000FF030000010000000000000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_RELEASE (Leave)
4000000000000000CF85963B07F3D401B40D0000A0080000FF030000000000000000000000000000000000000000000000000000000000000000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_COMMIT (Enter)
4000000000000000CF85963B07F3D401B40D0000E40A00000404000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_COMMIT (Leave)
4000000000000000CF85963B07F3D401B40D0000E40A00000404000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTCOMMIT (Enter)
4000000000000000CF85963B07F3D401B40D0000A00800000504000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTCOMMIT (Leave)
400000000000000029E8983B07F3D401B40D0000A00800000504000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW_KTM (Enter)
400000000000000029E8983B07F3D401B40D0000A0080000F403000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW_KTM (Leave)
400000000000000029E8983B07F3D401B40D0000A0080000F403000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW (Enter)
400000000000000029E8983B07F3D401B40D0000A0080000F203000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
THAW (Enter)
4000000000000000370FA03B07F3D401B40D0000F40D0000F203000001000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
THAW (Enter)
4000000000000000370FA03B07F3D401B40D0000900E0000F203000001000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
THAW (Enter)
4000000000000000370FA03B07F3D401B40D0000EC0C0000F203000001000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BKGND_FREEZE_THREAD (Leave)
4000000000000000370FA03B07F3D401B40D000074090000FC03000000000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BKGND_FREEZE_THREAD (Leave)
4000000000000000370FA03B07F3D401B40D0000600B0000FC03000000000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BKGND_FREEZE_THREAD (Leave)
4000000000000000370FA03B07F3D401B40D00003C090000FC03000000000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
THAW (Leave)
4000000000000000370FA03B07F3D401B40D0000F40D0000F203000000000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
THAW (Leave)
4000000000000000370FA03B07F3D401B40D0000EC0C0000F203000000000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
THAW (Leave)
4000000000000000370FA03B07F3D401B40D0000900E0000F203000000000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
4000000000000000370FA03B07F3D401B40D0000F40D00000400000001000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
4000000000000000370FA03B07F3D401B40D0000EC0C00000400000001000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
4000000000000000370FA03B07F3D401B40D0000900E00000400000001000000030000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW (Leave)
4000000000000000370FA03B07F3D401B40D0000A0080000F203000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PREFINALCOMMIT (Enter)
4000000000000000370FA03B07F3D401B40D0000A00800000604000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PREFINALCOMMIT (Leave)
40000000000000004DE5D63B07F3D401B40D0000A00800000604000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
POSTSNAPSHOT (Enter)
40000000000000004DE5D63B07F3D401B40D0000A0080000F503000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
POSTSNAPSHOT (Enter)
40000000000000006933E53B07F3D401B40D0000000C0000F503000001000000040000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
POSTSNAPSHOT (Enter)
40000000000000006933E53B07F3D401B40D0000EC0C0000F503000001000000040000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
POSTSNAPSHOT (Leave)
40000000000000006933E53B07F3D401B40D0000000C0000F503000000000000040000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
40000000000000006933E53B07F3D401B40D0000000C00000500000001000000040000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
POSTSNAPSHOT (Enter)
40000000000000006933E53B07F3D401B40D0000240B0000F503000001000000040000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
POSTSNAPSHOT (Leave)
40000000000000006933E53B07F3D401B40D0000EC0C0000F503000000000000040000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
40000000000000006933E53B07F3D401B40D0000EC0C00000500000001000000040000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
POSTSNAPSHOT (Leave)
4000000000000000D52A9F3C07F3D401B40D0000240B0000F503000000000000040000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
4000000000000000D52A9F3C07F3D401B40D0000240B00000500000001000000040000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
POSTSNAPSHOT (Leave)
4000000000000000D52A9F3C07F3D401B40D0000A0080000F503000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTFINALCOMMIT (Enter)
4000000000000000D52A9F3C07F3D401B40D0000A00800000704000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTFINALCOMMIT (Leave)
40000000000000001BEEC23C07F3D401B40D0000A00800000704000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
BACKUPSHUTDOWN (Enter)
4000000000000000919ED33C07F3D401B40D0000A0080000FB03000001000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BACKUPSHUTDOWN (Enter)
40000000000000009FC5DA3C07F3D401B40D0000E80B0000FB03000001000000050000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BACKUPSHUTDOWN (Enter)
40000000000000009FC5DA3C07F3D401B40D0000EC0C0000FB03000001000000050000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BACKUPSHUTDOWN (Enter)
40000000000000009FC5DA3C07F3D401B40D0000F40D0000FB03000001000000050000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BACKUPSHUTDOWN (Leave)
40000000000000009FC5DA3C07F3D401B40D0000E80B0000FB03000000000000050000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BACKUPSHUTDOWN (Leave)
40000000000000009FC5DA3C07F3D401B40D0000EC0C0000FB03000000000000050000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BACKUPSHUTDOWN (Leave)
40000000000000009FC5DA3C07F3D401B40D0000F40D0000FB03000000000000050000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
3508
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
BACKUPSHUTDOWN (Leave)
40000000000000009FC5DA3C07F3D401B40D0000A0080000FB03000000000000000000000000000048752AD792BC3549AFE7315FBF9549890000000000000000
1476
DrvInst.exe
write
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US

Files activity

Executable files
19
Suspicious files
68
Text files
494
Unknown types
27

Dropped files

PID
Process
Filename
Type
2848
chrome.exe
C:\Users\admin\Downloads\Unconfirmed 11832.crdownload
executable
MD5: 2fc5714ca2e13353727d38dc81d8f82c
SHA256: e7bbd1a3687146e796e3f633b3cc023e23434877da58163ed6576a261e5a3331
3696
URBrowser.exe
C:\Users\admin\AppData\Local\Temp\UrBr\UR0.exe
executable
MD5: 47fa5f0670cf191d066e5dfbf4f4ee70
SHA256: 645bee92ba4e9f32ddfdd9f8519dc1b9f9ff0b0a8e87e342f08d39da77e499a9
2572
UR0.exe
C:\Program Files\TAP-Windows\Uninstall.exe
executable
MD5: 7a39c7e83f8dbb5835c354a30f4c47d9
SHA256: d858454b7ca0629f84a0ba95b8257b00d4fbab318882d9882b6c5a15e67e2e34
3696
URBrowser.exe
C:\Users\admin\AppData\Local\Temp\nsa24B4.tmp\URActions.dll
executable
MD5: a3ddf636a465080eae188723674d7ab7
SHA256: 342c7c6c7b22deb7aa659f057702e71f83c44a00a3220b6f3d49a0f783a049b3
3696
URBrowser.exe
C:\Users\admin\AppData\Local\Temp\nsa24B4.tmp\System.dll
executable
MD5: bf712f32249029466fa86756f5546950
SHA256: 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
3696
URBrowser.exe
C:\Users\admin\AppData\Local\URBrowser\VPN\tap-windows.exe
executable
MD5: 47fa5f0670cf191d066e5dfbf4f4ee70
SHA256: 645bee92ba4e9f32ddfdd9f8519dc1b9f9ff0b0a8e87e342f08d39da77e499a9
2848
chrome.exe
C:\Users\admin\Downloads\URBrowser.exe
executable
MD5: a06457ef634e308815eaa0d98a1abeb4
SHA256: 2808543d20563983dd3d3a53a3367cd9af06528727fabe09024f938ad6267d9a
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\{7fd732dc-58e5-41df-9e7c-08636a8bde57}\tap0901.sys
executable
MD5: f49967c396969b71c3a72537db03a68b
SHA256: 3b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
2848
chrome.exe
C:\Users\admin\Downloads\Unconfirmed 11832.crdownload
executable
MD5: a06457ef634e308815eaa0d98a1abeb4
SHA256: 2808543d20563983dd3d3a53a3367cd9af06528727fabe09024f938ad6267d9a
3080
DrvInst.exe
C:\Windows\System32\DriverStore\Temp\{4916285b-5c86-3520-d457-8d61514b2d5b}\tap0901.sys
executable
MD5: f49967c396969b71c3a72537db03a68b
SHA256: 3b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
1632
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000011
executable
MD5: a06457ef634e308815eaa0d98a1abeb4
SHA256: 2808543d20563983dd3d3a53a3367cd9af06528727fabe09024f938ad6267d9a
2572
UR0.exe
C:\Users\admin\AppData\Local\Temp\nsl4114.tmp\nsExec.dll
executable
MD5: acc2b699edfea5bf5aae45aba3a41e96
SHA256: 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
4084
DrvInst.exe
C:\Windows\system32\DRIVERS\tap0901.sys
executable
MD5: f49967c396969b71c3a72537db03a68b
SHA256: 3b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
2572
UR0.exe
C:\Users\admin\AppData\Local\Temp\nsl4114.tmp\System.dll
executable
MD5: c17103ae9072a06da581dec998343fc1
SHA256: dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
2572
UR0.exe
C:\Users\admin\AppData\Local\Temp\nsl4114.tmp\UserInfo.dll
executable
MD5: 7579ade7ae1747a31960a228ce02e666
SHA256: 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
2572
UR0.exe
C:\Program Files\TAP-Windows\bin\tapinstall.exe
executable
MD5: bc2eb9be84d65e600bb4baebfc0d6c74
SHA256: 5c6aae8c345e5eda7185cabafcf9270ef3d73f198290842654d8916f8321b150
2572
UR0.exe
C:\Program Files\TAP-Windows\driver\tap0901.sys
executable
MD5: f49967c396969b71c3a72537db03a68b
SHA256: 3b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
2572
UR0.exe
C:\Users\admin\AppData\Local\Temp\nsl4114.tmp\ns42CC.tmp
executable
MD5: f132fdbbc0a040f07e10ea944ff57fef
SHA256: 47f8b16ad9a20c23c6104777687afa580f8f3ac11ae1499aedd04880bb28b2f3
2848
chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Login Data
sqlite
MD5: 89c00a8e4f5230432acea5e752ed1170
SHA256: 23550ad3798aff7c3fa2b3b06f807ff63af264f257945a8525ccaa6c07ac4bfe
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 01d5461d6f064df3220316e45fb58c17
SHA256: f1afa99d16302a25ec97c0782c7642ea37605bd35cfd9b57a89376291e4b34a2
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 8c7b8d7b73450300cd96665444bb62a4
SHA256: de4347a0302225d093ad82824064c7de8a6938a1c3c294ac7c1e061fc089662d
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 3b5d8a6b5f6a30956f04409feca59452
SHA256: b6c0423645dc2b29e99196c0bc71f5f834ff868d47a1a48e77673539eb414e76
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: a0254e39605c60bed01c05e96409a489
SHA256: e77f204f435dee25cc022a261693d6e5da0c2fd50d8d579c060ec7c582066d61
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: d37141306a246ca77aaf712d12aff54d
SHA256: ead357070a37c2b750c81078511ac9d0aaa2e6076bf8fdfff0e77eb0bfba6f18
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: e1982ecdaef19564f9d9ee716638a324
SHA256: b19842e427355c3714d9d5506e77c00c5f177a0b160c0ab9da81bd82e6326ddf
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: a2f90cb67b68ba60e37f01bd0769bc9c
SHA256: 5914bc4c28776e8ae24adb6dd6185abce28bd5d72a3c34c8bbd225912b70c37f
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 406fb904f86970fcb3af34efc98209ee
SHA256: fa509732c1680aae492f5db9edf91d53702326b255325fffcb765c1d09bd708b
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 9e7339252176b927ca6ef18c54202781
SHA256: 339dd823353959372146614740d03196c4af198da87d79563180dbc67ebd4f8a
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 955ddeb5afa4d2d29d07cd400fa2dc74
SHA256: 67501ed766b86e1728a2b5988869b17b05e5a5fc8350da2fb1cf678d9fbf9618
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 4c19d2bc61309f3d7ba11d1606380ffb
SHA256: 78cb9e274d6af97273474a1cd94fe628314ff4584ba1f5ef596903b8ff2d5b4f
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 33211f33af6d9849cd8fdd899a2b3d64
SHA256: 3dc185d6203fe76ba13f4bf3ad6c362dc23af93102cd49610df2c4051b9e281b
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 34b5b677a11238b6f0150698f572d0c6
SHA256: 1be4bd3a2301931542d3bdb4f4ae78f0999ecd2d8917324828e8bc07c813e658
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: faf45f32fbcd8a43cd3bcac9546d1a97
SHA256: a04085526d3cb42d730b955dce866ba3a6fab2eaf4fa37550f60296c3dd604c8
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 9326c96a95ed3d317b892614cf4b960d
SHA256: 7a6d69c1b33a1970995e7110d45c2ccda28e4d5889a0e71b4468b1b5f1c72a7c
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 0086076cc938046be10fa5e885eecaa7
SHA256: a6f69b91e2867d6c0f61d8c43c8c57b31ddd7c1c4afb7910636f814ad9ee4e10
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: fc13ed13d3f0e1bde64afaee5525823d
SHA256: e78ff9c8faad2be8b50543abdf4a0971c33895f8378740e73720338929a02852
4084
DrvInst.exe
C:\Windows\System32\DriverStore\infstrng.dat
binary
MD5: 4f52b0603df72173dc3d7fa212efae1d
SHA256: 4c29ed540766f9c53f4eb091e2ba586e8d4a8bb06b9eb2c2c58b1115f59f7602
4084
DrvInst.exe
C:\Windows\System32\DriverStore\infpub.dat
binary
MD5: e335b35fb3544b1db18288886e4d3216
SHA256: 53219d24efc45c05520feaab7d81671b64a0728455818b6ea5e33e444ee82acb
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 84b5e11d3fd3477c0a05c7184d5132f0
SHA256: 86a6365b1a25b0c2e591485b33759713f6bbf6f27d6f991c8b3395d9a31f46b4
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 982af13d3d733aaaf133846f5964d23c
SHA256: 70e2b0370619b8d4d5a5bb87e15da3e10cb3f49f3aa408a1c58dc1a3c74eefdb
3696
URBrowser.exe
C:\Users\admin\AppData\Local\Temp\UrBr\UR1.exe
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Tar9A7F.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Cab9A7E.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Tar9A3F.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Cab9A3E.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\system32\DRIVERS\SET99B3.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\INF\setupapi.ev3
binary
MD5: cb8bdcb65a0f53e6b3ce74cf7516ced9
SHA256: 8a308283fb47682b81097581598583de6dffa2675d52cbb9240a934cd7ca58f2
4084
DrvInst.exe
C:\Windows\INF\setupapi.ev2
binary
MD5: 777715825fbbddf886a1f723a65a03ea
SHA256: 5f35dde819a03b29a52de6e8f8ed3e70dcab1b5ff37c6aa8e06bfd49b68ca654
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 8a163234e232bb9b52c0528fb802f54e
SHA256: 5b46c4df112aecb64cab4aa590e3720e381c44b61b22a7a8feeb97a29da237e3
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 3e8b5a6cd9dfcab86027e8f0cf5e94a5
SHA256: 710fcca14d5f7a32269797d7fe998cc84ae1747f099d144a08779c3122782bc8
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 7523619b3f7d2ddc8e98a9946bc9f29b
SHA256: a80a45c970d763971f31b62f64e7d678a54f704baf1b22bc4624ea573a5def73
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: a94fd8fe263ef08bf44eb23572bf7b1d
SHA256: d595094fd8c09a7accc308e5e477f8193d8a8d059cd9910be278d615ee0018a4
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 8ea91435312781f3f7118f3fad5f4330
SHA256: c7b4365fe4a0736eb2fd4c5cdc9c27cd3422040c8d49371b08ad7296af5c203d
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 7e752f33b281d7f7b831bb0f43fb135b
SHA256: b69829cfa7c4597cc10f6a1968828ffe971c8d53e0ae00e658e0df4a8f442f81
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: fde1969a60cabccb6749e6bdb34dd7b9
SHA256: ceb694cc603574f472622fbb07a718024493e2ea8f66b8e200ac9df9c0bb3ee0
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: e69c196cd4f488a23a4127d90b2aa12e
SHA256: 445ddac4efdf26d1ef12a7e2544f5522ef6e9a84447764e8ffa3bf1871f72101
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: a0568e02590768adf12216f6ffb4161b
SHA256: 46d78bb7bcc2217eae6d8ecaa4df38fffb541dac094dc17c2329a4b9706aa3a5
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 1b5a6826034130958847f731be702ce6
SHA256: e8bf6a211813c845049e7b2b971764aac58c7dc97fb3bd53184f59c9de689cb6
4084
DrvInst.exe
C:\Windows\INF\oem4.PNF
pnf
MD5: fc66d3714cd53a13be3c10c69c777fec
SHA256: dbae3e468ec719adf848ee1284034663a20702094089833bc3843956ff8243ed
4084
DrvInst.exe
C:\Windows\TEMP\Tar98C6.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Cab98C5.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Tar9895.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Cab9894.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Tar9845.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Cab9834.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Tar97F5.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Cab97F4.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 1680c35611d106529f1d258f9edb857e
SHA256: 64060e3ca5ffc9e24355a3166d76cee1a868fa28e13b87aaee8403d7db53dcb5
4084
DrvInst.exe
C:\Windows\TEMP\Tar9795.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Cab9794.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Tar9764.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Cab9763.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Tar9752.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\TEMP\Cab9751.tmp
––
MD5:  ––
SHA256:  ––
4084
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: e26492d95b0b7707ce605fded6986717
SHA256: f77f0588709d6cce72b922c644b9c105846fd1698c14c04d59f9ef9c8237a751
4084
DrvInst.exe
C:\Windows\INF\setupapi.ev1
binary
MD5: 619a223008b1b04799f72caa16ad066b
SHA256: 1c55aeff1adbe5e5dc35a0ed2f5ffb01866fbdaebe7f4dbdc7c55de32ef37527
2768
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: e26492d95b0b7707ce605fded6986717
SHA256: f77f0588709d6cce72b922c644b9c105846fd1698c14c04d59f9ef9c8237a751
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar9632.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab9631.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar95F1.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab95F0.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar95C1.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab95C0.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar959F.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab959E.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar956E.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab956D.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Tar953E.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Users\admin\AppData\Local\Temp\Cab953D.tmp
––
MD5:  ––
SHA256:  ––
2768
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 3ba465c52128762a1afca01beba9419d
SHA256: df4e456d9e1f54fa1d4c9ff2f0b581b59034d7f00a20833bea9eeb6be532b6d6
2768
tapinstall.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 7c73db865cc6734b1d74975234338ecc
SHA256: 453b86be8ede30302d3353ae23ae221e57ddb3beb6d8ffc3e1e180f70326b0d1
2768
tapinstall.exe
C:\Windows\System32\DriverStore\infpub.dat
binary
MD5: 49c633a10f91b938d04f9662e623d82e
SHA256: 9e03423e34a4dfabb6f4e0abad0e70c6dfdd0964b203bd215f5aa6480f0dc4a6
2768
tapinstall.exe
C:\Windows\System32\CatRoot2\dberr.txt
text
MD5: cde2e359fbcb083a6f322c3323b7830d
SHA256: 3e80f6ae5c95b337ac7576c6074877bd4406b5f9ff35c46373cef1a45f1a6e66
2768
tapinstall.exe
C:\Windows\System32\DriverStore\infstrng.dat
binary
MD5: 2d95e34af90a740d0a01f159dfcb06c9
SHA256: ae5841f65a3e2b00989d9eba5e27be941e0ab976608ec656ae5b202e9b43e918
3080
DrvInst.exe
C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_x86_neutral_7b2f8786a9ddb778\oemvista.PNF
pnf
MD5: d213f65ee41d9c6a6015cdd311065c1d
SHA256: 297984b2e7f3f4549da18a0d2fe0ff818c7585c80d91571d9c47f0d1181d7893
3080
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 7c73db865cc6734b1d74975234338ecc
SHA256: 453b86be8ede30302d3353ae23ae221e57ddb3beb6d8ffc3e1e180f70326b0d1
3080
DrvInst.exe
C:\Windows\System32\DriverStore\INFCACHE.0
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\System32\DriverStore\OLDCACHE.000
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\System32\DriverStore\infpub.dat
binary
MD5: 1e72f7343481d157247f029b93d95323
SHA256: c9071ec1f5c450749790596aa5261940231656d949e07a5f81cb00c69ca02e3d
3080
DrvInst.exe
C:\Windows\System32\DriverStore\INFCACHE.2
binary
MD5: 14b4a1061a595acc71ffdf178218683c
SHA256: c404d68d6fb2b0a729c605828f5d450b4ee75595bfa308662cd1e690d8a3d674
3080
DrvInst.exe
C:\Windows\System32\DriverStore\INFCACHE.1
binary
MD5: 14b4a1061a595acc71ffdf178218683c
SHA256: c404d68d6fb2b0a729c605828f5d450b4ee75595bfa308662cd1e690d8a3d674
3080
DrvInst.exe
C:\Windows\System32\DriverStore\infstor.dat
binary
MD5: 7f208b0dbf231e505d6abd300e4c5714
SHA256: 4d31b0b3e6d0fdb13f08d513491e5f7b3f5bd73d77969ea833571368b4b4cb05
3080
DrvInst.exe
C:\Windows\System32\DriverStore\infstrng.dat
binary
MD5: df7de3f4589efeaf1e777524246460a0
SHA256: 2e54a38892115ef72de98d05ed7676bf4d4c91bb1187ad5cee6304ebaa585cbb
3080
DrvInst.exe
C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_x86_neutral_7b2f8786a9ddb778\oemvista.PNF
pnf
MD5: a2ca31b7bdae7e1a88487b46ade94d14
SHA256: 491c6fc6841cff322cff11a007fd4d2318c5ed7082a6efb9fc3568c0cd0c5867
3080
DrvInst.exe
C:\Windows\INF\oem4.inf
binary
MD5: 41884571579f88540326252b81d0a9f8
SHA256: a461b764e248d3e59a1a730ff94af7e61121f5a02004e02b3b866ac8fd1689be
3080
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 4b80ccbd2dcc44d29e8d462f5a1c82a6
SHA256: 33ed702f2176518d0fa60090cf3df01a9da81cd6ca5cf5c6cd7b4d0eb1c97573
1476
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: fc87f14b7b0581d770441bc41bfc4c3e
SHA256: af92f193a0f6cc1a1a3cfb2b344ef1cc651606d1cfd5a1b17f47286477b9debd
1476
DrvInst.exe
C:\Windows\INF\setupapi.ev1
binary
MD5: 33d1925a03bdbd2f12dd6739a21198c0
SHA256: 33b501af88849ea8fcbbe8773adb8066288f9d92eef12eee02e56b491dfa515f
1476
DrvInst.exe
C:\Windows\INF\setupapi.ev3
binary
MD5: 76dcc60f78b3dff1ae3627619074f465
SHA256: 18541ac1875315c4f9eff75050c574faff83717c029dae6b366f9c6c3f0c19e0
3080
DrvInst.exe
C:\System Volume Information\SPP\metadata-2
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\System Volume Information\SPP\snapshot-2
binary
MD5: 5b3053f586a0e36ba3ab8b76ace4548c
SHA256: f42252f3327bea2f88b75db77a4a7210fd4e5ede0a5b2da73e89f2864f4e7c7e
3080
DrvInst.exe
C:\System Volume Information\SPP\OnlineMetadataCache\{d72a7548-bc92-4935-afe7-315fbf954989}_OnDiskSnapshotProp
binary
MD5: 5b3053f586a0e36ba3ab8b76ace4548c
SHA256: f42252f3327bea2f88b75db77a4a7210fd4e5ede0a5b2da73e89f2864f4e7c7e
3080
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 1b96aeea09a6d52fc40d048b6fd534b0
SHA256: 143bd05c9d9a8f64eac329042e1276ce5aa135abbafc28bd8bb55a8edf064a40
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar4AE0.tmp
––
MD5:  ––
SHA256:  ––
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab4ADF.tmp
––
MD5:  ––
SHA256:  ––
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar4ACF.tmp
––
MD5:  ––
SHA256:  ––
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab4ACE.tmp
––
MD5:  ––
SHA256:  ––
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab4ABC.tmp
––
MD5:  ––
SHA256:  ––
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar4ABD.tmp
––
MD5:  ––
SHA256:  ––
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab4AAA.tmp
––
MD5:  ––
SHA256:  ––
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar4AAB.tmp
––
MD5:  ––
SHA256:  ––
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Cab4A99.tmp
––
MD5:  ––
SHA256:  ––
3916
rundll32.exe
C:\Users\admin\AppData\Local\Temp\Tar4A9A.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: a3ced3e9c5c176a5b36498d8d91c873e
SHA256: a2f4dca3c7907136203cb120dda95242619459c1455fd5c845a83b4d603e9a55
3080
DrvInst.exe
C:\Windows\TEMP\Tar49AC.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Cab49AB.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Tar495C.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Cab495B.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Tar493A.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Cab4939.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Tar4919.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Cab4918.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 548845d772b2bcd441fefe26fce35ded
SHA256: bb0d7e2bddc7cd9609e690479c980a146d2f478f7b9e2198ea6a4f15c52069a1
3080
DrvInst.exe
C:\Windows\TEMP\Cab48F7.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Tar48F8.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Cab48E5.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Tar48E6.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Tar48C5.tmp
––
MD5:  ––
SHA256:  ––
3080
DrvInst.exe
C:\Windows\TEMP\Cab48C4.tmp
––
MD5: