Threat Roundup for June 1-15



Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 01 and June 15. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.


The most prevalent threats highlighted in this round up are:

  • Win.Dropper.Johnnie-6567758-0
    Dropper
    Johnnie, also known as Mikey, is a malware family that focuses on persistence, and is known for its plugin architecture.
  • Win.Dropper.Yakes-6563213-0
    Dropper
    This malware family sets up persistence on target systems by adding a registry entry to HKLM\Software\Microsoft\CurrentUser\Run. It also uses netsh.exe to modify Windows Firewall rules to allow a DLL to communicate externally.
  • Win.Dropper.Prepscram-6571863-0
    Dropper
    Prepscram is a software bundler that may install other unwanted software.
  • Win.Dropper.Scar-6563211-0
    Dropper
    Scar is a remote access trojan that will attempt to steal users' login credentials on multiple financial websites.
  • Win.Dropper.Gandcrab-6574655-0
    Dropper
    Gandcrab is ransomware that targets Windows machines and requests payments using "Dash" in order to recover encrypted files. It is under almost constant development, with its creators releasing new versions at an aggressive pace. 

Threats


Win.Dropper.Johnnie-6567758-0



Indicators of Compromise


Registry Keys
  • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\4F8A903B98DDC9436D66B555E49D04A498A2C0E6
    • Value: Blob
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV\INSTANCES\WTBHOV INSTANCE
    • Value: Altitude
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV\INSTANCES\WTBHOV INSTANCE
    • Value: Flags
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV
    • Value: ImagePath
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV
    • Value: DisplayName
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV
    • Value: St
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV
    • Value: Start
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV
    • Value: ErrorControl
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV
    • Value: WOW64
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV
    • Value: Group
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV
    • Value: Type
  • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES
    • Value: 4F8A903B98DDC9436D66B555E49D04A498A2C0E6
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV\INSTANCES
    • Value: DefaultInstance
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS
    • Value: DisabledComponents
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK
    • Value: atimode
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK
    • Value: shield_count
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK
    • Value: set_pt
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK
    • Value: set_bl
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\COMPATIBILITY ASSISTANT\PERSISTED
    • Value: C:\Users\ADMINI~1\AppData\Local\Temp\n1s\nchsetup.exe
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
    • Value: DisableTaskOffload
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\NETWORK\FILESERVICE
    • Value: igfxmtc_time
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\NETWORK\FILESERVICE
    • Value: Liveup
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
    • Value: PnpInstanceID
  • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\4F8A903B98DDC9436D66B555E49D04A498A2C0E6
  • <HKLM>\Software\Microsoft\WBEM\CIMOM
  • <HKCU>\Software\Classes\Local Settings\MuiCache
  • <HKCU>\Software\Classes\Local Settings\MuiCache\3e\52C64B7E
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV\INSTANCES\wtbhov Instance
  • <HKLM>\SOFTWARE\WOW6432NODE\NCH SOFTWARE\ExpressAnimate
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\wtbhov
  • <HKLM>\SOFTWARE\WOW6432NODE\NCH Software
  • <HKLM>\SOFTWARE\Wow6432Node
  • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\Root
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WTBHOV\Instances
  • <HKLM>\Software\Wow6432Node\NCH Software\ExpressAnimate
  • <HKCU>\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
  • <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Network\FileService
  • <HKLM>\SOFTWARE\CLASSES
  • <HKLM>\Software\Microsoft\SystemCertificates\Root
Mutexes
  • N/A
IP Addresses
  • 45[.]77[.]68[.]17
  • 45[.]32[.]78[.]78
  • 45[.]63[.]57[.]87
  • 173[.]192[.]16[.]184
  • 174[.]37[.]56[.]249
Domain Names
  • gpt9[.]com
  • optcdn[.]com
  • www[.]userbest[.]com
  • optitm[.]com
Files and or directories created
  • %WinDir%\TEMP\UDD25E0.tmp
  • %LocalAppData%\Temp\F08B.tmp
  • %LocalAppData%\igfxmtc\igfxmtc.exe
  • %LocalAppData%\Temp\EF04.tmp
  • %LocalAppData%\Temp\EDDB.tmp.exe
  • %LocalAppData%\Temp\F251.tmp
  • %LocalAppData%\igfxmtc
  • %LocalAppData%\Temp\n1s\nchdata.cab
  • %WinDir%\TEMP\UDD1615.tmp
  • %LocalAppData%\Temp\n1s\nchsetup.cab
  • %LocalAppData%\avknwbh\dowmload.tmp
  • %WinDir%\TEMP\UDD359B.tmp
  • %LocalAppData%\Temp\n1s\nchsetup.exe
  • %WinDir%\TEMP\UDD1E02.tmp
  • %WinDir%\TEMP\msidntfs\SSL\cert.db
  • %WinDir%\TEMP\UDD2DBD.tmp
  • %LocalAppData%\Temp\EDDB.tmp
  • %AppData%\NCH Software\ExpressAnimate\Logs
  • %WinDir%\TEMP\UDDF579.tmp
  • %System32%\vsakdwi\cweubpd.exe
  • %System32%\drivers\auswkvge.sys
  • %System32%\vsakdwi\cweubpddrv.sys
  • %LocalAppData%\Temp\F0AB.tmp
  • %AppData%\NCH Software\ExpressAnimate
  • %WinDir%\TEMP\msidntfs\SSL\SecureTrust Network Root CA 2.cer
  • %LocalAppData%\Temp\n1s
  • %WinDir%\SysWOW64\vsakdwi
  • %System32%\vsakdwi\cweubpd.sys
  • %System32%\vsakdwi
  • %LocalAppData%\avknwbh
  • %WinDir%\TEMP\UDDE28.tmp
  • %WinDir%\TEMP\msidntfs
  • %WinDir%\TEMP\msidntfs\SSL
  • %AppData%\NCH Software
  • %LocalAppData%\Temp\n1s\nchdata.dat
  • %LocalAppData%\Temp\EE1B.tmp
  • %LocalAppData%\igfxmtc\dowmload.tmp
File Hashes
  • 9eedaac111db1f28fc90300e2ecf417368595ebca2763a211fe1bb356527f06e
  • 8de212ff8c8364cfce48bf818b245eaf46db049e2fb4f48b4ef839d6160ed245
  • 023789cfc258b2d9bae00e94de0f1ee96f33f20a98415421d63f64be90e4b236
  • 5308ee082f975bd750aefa0c1cad84a517a48a7dcc1e72ad665e2a6ae1a6e73c
  • 6ee5b5dcc0bbf0ea59be2a87d413f31c7775b44fa50787c6fef594f34666e757
  • 6964abdc0a2daed0a51ca023392ac96b809584a8f1e9014f159e670e2b4b12af
  • 9e9b6c508e2d483b6ca8461a9629e9f0f7b452c7463248bc8879b880a5cb40cf
  • cb9be6bbc4bf545cdbfb87585289197202bcd5cfb31aa88813bad0277756a175
  • a14c508538dba4e05fcac66ddcfc1aaf4454507907523ba7d0983380e0a153da
  • 3f78f88330bfd6eaa889ffc2332b91235a4fb8bb364d0b076b6ebfb51f8f02ef
  • 87ee726e7e84443d44cfcaaf2151938d7cbb04b2dbb60669c6a843ecf51588e6
  • c10e952f5ad87ee0685409c2f6855009e069b181ad7e155f118f524e09de621a
  • d89080318573953ea0e0c2654a14252c70daa368ed3c81f6fd1aaeb2b2bcdeeb
  • 2ecf1771778fce31ff2c6004c3601be6d372189166fec6511a0f393fb684bff0
  • 36b5297734e9ca147c71985b649d0f49fcc0324d2b61cefda1135fd9a5ffa0d2
  • 25c14e5ea990fee7091433ea8050caecb60be93c81d54100506ed23bb472bb8e
  • 62e97b12781c36ac029176ce7b10cbfcf6fd58ff4552025aa1d8fc60bcde4bee
  • d7e0958d2eaa5f17e0ffc2ee6a4549401c30b381499df3a52384ef04023e0c80
  • 26e6871828aba6f30916bbcc6d8d60d9320f11d791993fe7fec1c7ecfa1cd733
  • 1ff912cfaf566f4e5a76a8a53f5e423a78df1dc9e187c5485b894665f847e563
  • 0e73d31d6db3dd82988313fe3f463891b24d0e41286d93a89df6a8a56aeccc8c
  • 2c874006199614655a153045793254888ceb0d0aa68c0d40b56351f54b0fab68
  • 6491f8c7234d1a92befb8eb01c8c7ff981b3a51cd5a4eb187e82911a01ae3327
  • 5fbe25ba6c8e8a52932053adaa22028ac2ddc3f14b187884bd40f8a0f3d02cf8
  • 50dcb2e7e9f7443099dc66ea5f0c1c73f25af3425c7365fc8f58ec43b0f28d71

Coverage


Screenshots of Detection

AMP

ThreatGrid





Win.Dropper.Yakes-6563213-0



Indicators of Compromise


Registry Keys
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
    • Value: strght
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\UI
  • <HKLM>\System\CurrentControlSet\Services\NapAgent\Shas
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\Enroll\HcsGroups
  • <HKLM>\System\CurrentControlSet\Services\NapAgent\Qecs
  • <HKLM>\System\CurrentControlSet\Services\NapAgent\LocalConfig
Mutexes
  • N/A
IP Addresses
  • N/A
Domain Names
  • N/A
Files and or directories created
  • N/A
File Hashes
  • 169fe9e796839d98dd0f00264bad976ac2b5c0771d66a66514854c65656f2e54
  • ecac7c8ec814eb19822ce5e93696d766cc991b827c918088866f44bfcebdd710
  • c9edd7a71859740afbc817868f500cc2ed319d8f0127b7d4ecf89e83cc307482
  • c21a3833cad6f3c196ee70d0343939221106b219dde1481fea5ae7a48b32c4a0
  • 53721e54bf9a6e35ec1558c4d3237db12db995f3d89a2cb05e06dcb3b82cb14c
  • fc6fc2eb348727f9dd1a66a69811bc2b1441d46f2eca1eb1d34aa27dc42aca94
  • c2545d675a7d05c41111e7f6196daf51470612f6db65b320e0aea556027d89b7
  • a4a3bec19ffc852d04f8b11edd6713338076802e1335d5939e21231b30d66b31
  • 90d861b3500e776c25e31c1a4f6af656415f6071944ba65efa039e642330403e
  • 9cdd4b4358fb08a04c622e3bf8e825cb87a703249973136279e20045bcfecf00
  • d4bee61d84fa1a7724e2425f8296619575ef7131448708d9939fa69ec574b197
  • c2f06095fab6aee3aa19d6c30dca75e926fc01abcd21a74f2d50fa2a8804ec59
  • 72e5d84c4c66c1b180443d1f54fb6cd874fb4cddd9572f6daba90fba02e9e1ea
  • f835993c01842ca78326ac5816c64a90381e8fe804c0ef38d2329c39340ea16d
  • a8425ab94da9ca3f5dc7e3e7d125ccef26ef1cfbeffa06f9be0992c6402d919e
  • 013e0f21218183e916f5eea20c7d1b2c0d391b19c7b7bcee4a1e5540c0f9048a
  • 5a77aa50590e70924a869a0a74aae5f4172e0d383f1490453553a05e2dac0244
  • e735ccd69bd3f87773641b54a959cdfe660994c192ca768083c7fbc8e43b084d
  • 1658bccda90ea8ecae77dcfa4e62629c269f8497b8bdd3caf53c314ac62e8264
  • 8d5dbba983ff17ba948863dee51cf989ceea7ac9154dfdee77f0e0f3641530b8
  • abc2f0170a32507c0229181a010fbee77af068234da4ffb7573970e190eeb4c4
  • 2a956f95d05aacf75be964cfae884cb2b4a7540e8f5314e41aade641f09a0d22
  • 3909dd2aedae70911ba19b7124e30a74e9c81bb3da4f6f95f8340dbff95dd3c4
  • bd97233242fa610fd53b7d4ce308f55c8c6b0653aca021f7be02c2ca830d30bb
  • d8c8f1f779ed9f089e33405c30c04021b17fa6ee5d1f679e958bd1894db2c692

Coverage


Screenshots of Detection

AMP

ThreatGrid





Win.Dropper.Prepscram-6571863-0



Indicators of Compromise


Registry Keys
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
    • Value: PnpInstanceID
Mutexes
  • N/A
IP Addresses
  • 52[.]85[.]146[.]150
Domain Names
  • bush[.]basinafterthought[.]bid
Files and or directories created
  • N/A
File Hashes
  • 14a27e53d748dd5a180f31283a24c420e0cf201f7deaf77140c9e07954fbc7e1
  • e5946260399e55af6a5e21a696c3790e7aaf6653869b73885ab7b93116dff677
  • 71e6dc866c630348249bad46b5d34036a576a108b8b69f36984f4195882a02e5
  • a1d8ff6306950d4a55402737a42f613a0eccc5fce66c7aa0a60d11c2ca598525
  • f91c4b1034ea7a193aef5ce586a1f6ba84e735b55bef91d9f4559816b40c3321
  • eb732a01f5f2a3fda038a10ce62a0f1d3068aaaed4ee2b44f351007f4c063a7d
  • ed114bd563038ca504de06b1a0629c493d886d6419205da69eb9730f82688050
  • faefcf1da92c7c554dfef22e4f719f73517ae636af0b47b319635239af6657d4
  • e7010999238fd3cc2cc144b4ba09e0affc6362811cd76d27dd55848b266f6388
  • fbc0a54ab9d6e1317867d478f765c4648ee0c3f156a4aaf29d851fa20b48d61f
  • f7d7d01c4812ba9cf1fa71958dd395b120ae9a420437767b4ff9aec2455d0447
  • e47008ae92769ad08f74ef5ff7b6f97b0b018479adff00a5041b02adb71f3bf8
  • d7fe56e6ce270a796adb2d14db0d2d4c7b02845737fa1973c6f790eefc3260ac
  • 5c1d23211ee3e6fe222ad1e017aa56f00cdfb64678f1ffb457489e70dbbfa511
  • bad3de4948f6a8c08555cd0224713fa7dac6c5845548ee4148cc486a6cd49adf
  • afce18cdd76a0e3e36dd2d9639fa1ba4f616952c1cc69e1d06089155d773a947
  • 01b2027c7a7e3888eb84a0e7c3bacf95b9b6e8da7a79bc578464ec9627f7a9e0
  • bc879aed2577aa152064a167e312287d59575d510f7a56eda7aa66e170baae80
  • f4eef29cd1e43843cfc1d0533d2c518dbbb5982093d6d1c6f576e02549e28b60
  • 42691432711dfe36fcb46fbf93395e41bcb7afc7c6b57bf7295471dbf1928e9a
  • 4431eebcb86a10222171eb6b678ae19bd59aef22644a842681469dbd2ab85e4c
  • 3bc6b0ea5ea71bbb67be5d06fb4d6bc7f5398f11bf2802bd381a645033e45922
  • 6ff6df3020263a78db2719e427e037264873559522b49506b7532fb72c8ceec1
  • 6fd913f9e1684e763628aa1faab9b414688f62692db53b3d6edcdb041a598445
  • 98a1804a57bb382d7b68128f282c8186046e8d7ffa71f7a955cdeb16ad1c8239

Coverage


Screenshots of Detection

AMP

ThreatGrid





Win.Dropper.Scar-6563211-0



Indicators of Compromise


Registry Keys
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
    • Value: Shell
  • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY
    • Value: AddToFavoritesInitialSelection
  • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY
    • Value: AddToFeedsInitialSelection
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Mutexes
  • N/A
IP Addresses
  • N/A
Domain Names
  • N/A
Files and or directories created
  • %UserProfile%\kxyk.exe
  • %SystemDrive%\TEMP\papi.dmp
File Hashes
  • 819b64dbecbfaa4274e096740c033bd118391e000124c42028a5dadff6a2b6b2
  • 10f4d71c51b53e87fb855f85cb2066c0611786b4f27bf030a969e2b696e0ac84
  • 55a2c8b5e5528bfd05136b3759ac2ff967145706f88dc331c92bf2e65e3c2053
  • b4e421f1af2fa82aa5c1489dea77cefc69125e16631fe19d6e4d30329186dba3
  • 48464c8b5d71fe2689065e051e16275e8eda04fe502991d84840c662d4ce19da
  • c9a1facd73f2d0d3ef0f86c6069a1deae2e35d2a010ca9a4953e32d749d59936
  • e61ad12a6bc35d1cfe82665168eed4083b13693fe7512826f3740367edbfa52b
  • b76762ebb156f1cceaa5d76c880cded3d8e2ed577ba45aaf1459c2a2b1b6a287
  • ad0500c90ba5cad4e4bad229f8ea18f97bb6e61112b2770804d8d9171fd5e812
  • a8aef06b777086b2de7c77fc1c9c4a41f876116d96141799be4a600e3a6b5881
  • 2e933578bb4d9e9e76617f593ebd51b6e5bc91773da879c7a56a0e982539ad98
  • 604f529ae774f625bdd0a35ecea90256793d70e14dc04c9ca1fb9197122e8cd6
  • 3d49eda19ce2fd612a516b677511b193b43e27f4e21d0d979d3be02db8846fc8
  • 9599162f12785563da8afc8e119a671e0e7c499579c83d6bf8f614328761b282
  • 3bbc0ca58b107ffebc14d3cc8a9dc21583b5d8e9bec257e057c2549dc9b4ab5d
  • 77f20318e906d4347194b2bbb0ac957e375577653aad2b2bab20b40f0c5f0f26
  • 36058bac712a7a5a72aa4b30d5d473cda298c66028d2fa42628a0a44fa0d9775
  • 6d33fb8cc44e1e33b2dfcd4e315c510a47dec57a0835d93504803f8623c0605e
  • a7801a51c772e4768bb745626b7649891eb33b132f8882ae61726a9abf885e55
  • de9d7b3c017d241d4fe483025d2e6c35377384c50bcc01cb8f49ab5a38f9263e
  • 1572f8b9f6e2a23e1e1acec696112271ec3e1516471989a8ff640f40a1c304ff
  • 61ec6a1beec7fb5386f11692f06179960d26e8367b241d9e5609dbe043d30763
  • 718e8a1114f6a6c5e0ba5c52cf2c17fa1ec9486497acb1253ee868beacceb4fc
  • 4772ecd2c9b219dacd5614c5ad9ad5f6c92253bd36e318a61c8ea2b42c9d0421
  • 8047b535f1a3c1eb1cfb02e66746d0d70dabd2a973e0edfd4525305e40b9737a

Coverage


Screenshots of Detection

AMP

ThreatGrid





Win.Dropper.Gandcrab-6574655-0



Indicators of Compromise


Registry Keys
  • <HKU>\.DEFAULT\CONTROL PANEL\DESKTOP\MUICACHED
    • Value: MachinePreferredUILanguages
  • <HKU>\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E\52C64B7E
    • Value: @ieframe.dll,-12512
  • <HKU>\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E\52C64B7E
    • Value: LanguageList
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES\{00021493-0000-0000-C000-000000000046}\ENUM
    • Value: Implementing
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: ProxyServer
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: AutoDetect
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: ProxyOverride
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: ProxyEnable
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: AutoConfigURL
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER
    • Value: CleanShutdown
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: ProxyServer
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: AutoDetect
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: ProxyOverride
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: ProxyEnable
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
    • Value: AutoConfigURL
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
    • Value: SavedLegacySettings
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
    • Value: DefaultConnectionSettings
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
    • Value: DisplayName
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
    • Value: URL
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
    • Value: Deleted
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
    • Value: SuggestionsURL
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
    • Value: TopResultURL
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
    • Value: FaviconURL
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
    • Value: SuggestionsURLFallback
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
    • Value: FaviconURLFallback
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
    • Value: TopResultURLFallback
  • <HKCU>\CONTROL PANEL\KEYBOARD
    • Value: InitialKeyboardIndicators
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\VERSIONMANAGER
    • Value: FirstCheckForUpdateHighDateTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\VERSIONMANAGER
    • Value: FirstCheckForUpdateLowDateTime
  • <HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SUGGESTED SITES
    • Value: DataStreamEnabledState
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SUGGESTED SITES
    • Value: MigrationTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}
    • Value: CompatBlockPromptCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}
    • Value: NewInstallPromptCount
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
    • Value: ShutdownFlags
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
    • Value: Count
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
    • Value: Flags
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
    • Value: Blocked
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
    • Value: Type
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\IEXPLORE
    • Value: Time
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
    • Value: CachePrefix
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES\{00021494-0000-0000-C000-000000000046}\ENUM
    • Value: Implementing
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\HIVELIST
    • Value: \Registry\User\S-1-5-21-2580483871-590521980-3826313501-500
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\HIVELIST
    • Value: \Registry\User\S-1-5-21-2580483871-590521980-3826313501-500_Classes
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: UNCAsIntranet
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: AutoDetect
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: ProxyBypass
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: IntranetName
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RELIABILITY\SHUTDOWN
    • Value: Comment
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RELIABILITY\SHUTDOWN
    • Value: ReasonCode
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\USER PREFERENCES
    • Value: 88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\USER PREFERENCES
    • Value: 2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: UNCAsIntranet
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: AutoDetect
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: ProxyBypass
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: IntranetName
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
    • Value: bxchnkordot
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: ProxyBypass
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: IntranetName
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\0000000000000004
    • Value: ObjectLru
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\0000000000000004
    • Value: ObjectId
  • <HKU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\0000000000000001
    • Value: ObjectLru
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\0000000000000001
    • Value: ObjectId
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2\INDEXES\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}
    • Value: 3000000010875
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
    • Value: SavedLegacySettings
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
    • Value: DefaultConnectionSettings
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\ADMINACTIVE
    • Value: {50743781-67B4-11E8-8419-00501E3AE7B5}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\ADMINACTIVE
    • Value: {00000000-0000-0000-0000-000000000000}
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RELIABILITY
    • Value: LastAliveStamp
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RELIABILITY
    • Value: 6005BT
  • <HKLM>\SOFTWARE\MICROSOFT\WBEM\CIMOM
    • Value: ProcessID
  • <HKLM>\SOFTWARE\MICROSOFT\WBEM\CIMOM
    • Value: LastServiceStart
  • <HKLM>\SOFTWARE\MICROSOFT\WBEM\CIMOM
    • Value: PreviousServiceShutdown
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\RECOVERY\PENDINGRECOVERY
    • Value: AdminActive
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
    • Value: WpadDetectedUrl
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
    • Value: WpadDecisionTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
    • Value: WpadDecision
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
    • Value: WpadNetworkName
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
    • Value: WpadDecisionReason
  • <HKCU>\SOFTWARE\MICROSOFT\CTF\MSUTB
    • Value: Top
  • <HKCU>\SOFTWARE\MICROSOFT\CTF\MSUTB
    • Value: Left
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SETUP
    • Value: UrlHistoryMigrationTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SETUP
    • Value: HaveCreatedQuickLaunchItems
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES64\{00021494-0000-0000-C000-000000000046}\ENUM
    • Value: Implementing
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\WINDOWSSEARCH
    • Value: Version
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
    • Value: CompatBlockPromptCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
    • Value: NewInstallPromptCount
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\10000000067F9
    • Value: 1
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
    • Value: Count
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
    • Value: Flags
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
    • Value: Blocked
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
    • Value: Type
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\IEXPLORE
    • Value: Time
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
    • Value: DhcpNetbiosOptions
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES\TCPIP_{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
    • Value: DhcpNameServerList
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\3000000010875
    • Value: 2
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
    • Value: DhcpDomain
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
    • Value: DhcpNameServer
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
    • Value: SoHRequest
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\0A-64-3C-54-A8-18
    • Value: WpadDetectedUrl
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\0A-64-3C-54-A8-18
    • Value: WpadDecisionTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\0A-64-3C-54-A8-18
    • Value: WpadDecision
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\0A-64-3C-54-A8-18
    • Value: WpadDecisionReason
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\STORAGE
    • Value: HotplugSecurityDescriptor
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\STORAGE
    • Value: Deny_Execute
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINMGMT\PARAMETERS
    • Value: ServiceDllUnloadOnStop
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EUPP\DSP
    • Value: ChangeNotice
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
    • Value: Count
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
    • Value: Flags
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
    • Value: Blocked
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
    • Value: Type
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\IEXPLORE
    • Value: Time
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2580483871-590521980-3826313501-500
    • Value: RunLogonScriptSync
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2580483871-590521980-3826313501-500
    • Value: RefCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES
    • Value: SecuritySafe
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
    • Value: PnpInstanceID
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
    • Value: CachePrefix
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2
    • Value: _FileId_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2
    • Value: _ObjectLru_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2
    • Value: _Usn_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2
    • Value: _ObjectId_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2
    • Value: AeFileID
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2
    • Value: _UsnJournalId_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2
    • Value: AeProgramID
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1
    • Value: _FileId_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1
    • Value: _ObjectLru_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1
    • Value: _Usn_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1
    • Value: _ObjectId_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1
    • Value: AeFileID
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1
    • Value: _UsnJournalId_
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1
    • Value: AeProgramID
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1\INDEXES\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}
    • Value: 10000000067F9
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\AUTHENTICATION\LOGONUI\LOGONSOUNDPLAYED
    • Value: LogonUIChecked
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
    • Value: Collection
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\TABLET PC
    • Value: IsTabletPC
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\TABLET PC
    • Value: DeviceKind
  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\WDI\CONFIG
    • Value: ServerName
  • <HKU>\.DEFAULT\CONTROL PANEL\DESKTOP
    • Value: Wallpaper
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES64\{00021493-0000-0000-C000-000000000046}\ENUM
    • Value: Implementing
  • <HKCR>\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\TRAYNOTIFY
    • Value: PastIconsStream
  • <HKCR>\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\TRAYNOTIFY
    • Value: LastAdvertisement
  • <HKCR>\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\TRAYNOTIFY
    • Value: UserStartTime
  • <HKCR>\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\TRAYNOTIFY
    • Value: IconStreams
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}
    • Value: NewInstallPromptCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}
    • Value: CompatBlockPromptCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}
    • Value: Version
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}
    • Value: Flags
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}
    • Value: VerCache
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE
    • Value: _CurrentObjectId_
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\TABLET PC
    • Value: IsTabletPC
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
    • Value: Count
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
    • Value: Flags
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
    • Value: Blocked
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
    • Value: Type
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\IEXPLORE
    • Value: Time
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
    • Value: DhcpScopeID
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: ProxyBypass
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: IntranetName
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES
    • Value: CachePrefix
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
    • Value: Count
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
    • Value: Flags
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
    • Value: Blocked
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
    • Value: Type
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}\IEXPLORE
    • Value: Time
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
    • Value: NewInstallPromptCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
    • Value: CompatBlockPromptCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
    • Value: Version
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
    • Value: Flags
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
    • Value: VerCache
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
    • Value: CachePrefix
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{DA4DADDD-6AF1-499A-91BB-269032006D4F}
    • Value: SoHRequest
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLBLOCKMANAGER
    • Value: NextCheckForUpdateLowDateTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLBLOCKMANAGER
    • Value: NextCheckForUpdateHighDateTime
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}
    • Value: _IndexName_
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
    • Value: FullScreen
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
    • Value: OperationalData
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
    • Value: CompatibilityFlags
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
    • Value: ImageStoreRandomFolder
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
    • Value: Window_Placement
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\INTRANET
    • Value: {9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
    • Value: CompatBlockPromptCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
    • Value: NewInstallPromptCount
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED
    • Value: {ED50FC29-B964-48A9-AFB3-15EBB9B97F36} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED
    • Value: {17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST
    • Value: CurrentLru
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
    • Value: DhcpDomain
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
    • Value: DhcpDefaultGateway
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
    • Value: DhcpSubnetMaskOpt
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
    • Value: DhcpNameServer
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
    • Value: SoHRequest
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
    • Value: DhcpInterfaceOptions
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT
    • Value: CachePrefix
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: Sort
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: ColInfo
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: ItemPos1024x768x96(1)
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: GroupByDirection
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: LogicalViewMode
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: FFlags
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: GroupView
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: GroupByKey:PID
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: IconSize
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: ItemOrder
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: Mode
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: GroupCollapseState
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
    • Value: GroupByKey:FMTID
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STUCKRECTS2
    • Value: Settings
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STREAMS\DESKTOP
    • Value: TaskbarWinXP
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{DBC80044-A445-435B-BC74-9C25C1C588A9}
    • Value: CompatBlockPromptCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{DBC80044-A445-435B-BC74-9C25C1C588A9}
    • Value: NewInstallPromptCount
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES
    • Value: KnownProvidersUpgradeTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES
    • Value: DownloadRetries
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES
    • Value: DefaultScope
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES
    • Value: DefaultPackCorrection
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY
    • Value: CachePrefix
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1\Indexes
  • <HKLM>\SOFTWARE\WOW6432NODE\Microsoft
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\Setup
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\Settings
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\0a-64-3c-54-a8-18
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\IndexTable
  • <HKU>\.DEFAULT\Software\Microsoft\Feeds
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B4F3A835-0E21-4959-BA22-42B3008E02FF}
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
  • <HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • <HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive
  • <HKLM>\SYSTEM\CurrentControlSet\Services\VSS\Diag\Shadow Copy Optimization Writer
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\UrlBlockManager
  • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\Certificates
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic
  • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\CA
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
  • <HKU>\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch
  • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
  • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
  • <HKLM>\SOFTWARE\CLASSES
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\LruList
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\Component Categories64
  • <HKU>\.DEFAULT\Software\Microsoft\F12
  • <HKU>\.DEFAULT\Software
  • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DBC80044-A445-435B-BC74-9C25C1C588A9}
  • <HKU>\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Zones
  • <HKU>\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore
  • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\0000000000000004
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\0000000000000001
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\Passport
  • <HKU>\.DEFAULT\SOFTWARE\APPDATALOW\SOFTWARE\Microsoft
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2\INDEXES\FileIdIndex-{3f37ba64-ef5c-11e4-bb8d-806e6f6e6963}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}\0a-64-3c-54-a8-18
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES\{00021494-0000-0000-C000-000000000046}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES\{00021493-0000-0000-C000-000000000046}
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
  • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\Windows
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\10000000067F9
  • <HKU>\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry
  • <HKU>\.DEFAULT\SOFTWARE\APPDATALOW\Software
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum
  • <HKLM>\Software\Microsoft\Windows\CurrentVersion\Reliability\shutdown
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
  • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\Root
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FILEIDINDEX-{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963}\3000000010875
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DBC80044-A445-435B-BC74-9C25C1C588A9}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\Component Categories
  • <HKU>\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
  • <HKU>\.DEFAULT\Software\Microsoft\SystemCertificates\My
  • <HKU>\.DEFAULT\Software\AppDataLow
  • <HKLM>\SOFTWARE\Microsoft\ESENT\Process\318730135\DEBUG
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\Main
  • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
  • <HKLM>\System\CurrentControlSet\Control\SecurityProviders\Schannel
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MenuOrder
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}\Enum
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager
  • <HKLM>\Software\Wow6432Node
  • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
  • <HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Reliability
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs
  • <HKCU>\SOFTWARE\Microsoft\CTF\MSUTB\
  • <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\EUPP\DSP
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic
  • <HKLM>\SYSTEM\CurrentControlSet\Services\VSS\Diag\COM+ REGDB Writer
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2\Indexes
  • <HKLM>\SYSTEM\CurrentControlSet\Services\VSS\Diag\ASR Writer
  • <HKLM>\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LogonSoundPlayed
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences
  • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\Root
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\Stats
  • <HKU>\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA
  • <HKU>\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B4F3A835-0E21-4959-BA22-42B3008E02FF}
  • <HKLM>\Software\Microsoft\WBEM\CIMOM
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\2
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES64\{00021494-0000-0000-C000-000000000046}
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\INDEXTABLE\FileIdIndex-{3f37ba64-ef5c-11e4-bb8d-806e6f6e6963}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
  • <HKU>\.DEFAULT\Software\AppDataLow\Software\Microsoft\RepService
  • <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\AuthRoot
  • <HKU>\.DEFAULT\SOFTWARE\Microsoft
  • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
  • <HKU>\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\Explorer
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\GPU
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\Discardable
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CurrentVersion
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\Recovery
  • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\PostSetup
  • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\ObjectTable
  • <A>\{F698CDEA-372F-11E8-8419-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\1\INDEXES\FileIdIndex-{3f37ba64-ef5c-11e4-bb8d-806e6f6e6963}
  • <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\PageSetup
  • <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM
  • <HKCU>\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RELIABILITY\UserDefined
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLs
  • <HKU>\.DEFAULT\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLs
  • <HKU>\.DEFAULT\Software\Microsoft\Internet Explorer\Suggested Sites
  • <HKU>\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore
  • <HKU>\.DEFAULT\Software\AppDataLow\Software\Microsoft\Internet Explorer
  • <HKLM>\SYSTEM\CurrentControlSet\Services\VSS\Diag\Registry Writer
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\Explorer
  • <HKU>\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES64\{00021493-0000-0000-C000-000000000046}
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EUPP
Mutexes
  • \BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=ab8e4b3e3c28b0e4
IP Addresses
  • 95[.]170[.]220[.]66
  • 185[.]242[.]190[.]97
  • 190[.]35[.]242[.]126
  • 13[.]107[.]21[.]200
  • 138[.]201[.]14[.]197
  • 109[.]166[.]237[.]170
  • 81[.]4[.]163[.]122
  • 95[.]43[.]11[.]180
  • 66[.]171[.]248[.]178
  • 154[.]35[.]132[.]71
Domain Names
  • 1[.]0[.]168[.]192[.]in-addr[.]arpa
  • ns1[.]wowservers[.]ru
  • carder[.]bit
  • www[.]torproject[.]org
  • ipv4bot[.]whatismyipaddress[.]com
  • ns2[.]wowservers[.]ru
  • ransomware[.]bit
Files and or directories created
  • %LocalAppData%\Temp\pidor.bmp
  • %AppData%\Microsoft\Document Building Blocks\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\AddIns\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\User\Document Themes\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\UserData\19CDHY5T\CRAB-DECRYPT.txt
  • %UserProfile%\Cookies\CRAB-DECRYPT.txt
  • %SystemDrive%\Recovery\926583e2-ef64-11e4-beed-d6738078ad98\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\User\SmartArt Graphics\1033\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Internet Explorer\imagestore\aa4x2ky\imagestore.dat
  • %AppData%\Microsoft\gktngn.exe
  • %AppData%\Microsoft\Internet Explorer\UserData\N03JH1M1\CRAB-DECRYPT.txt
  • %AppData%\Media Center Programs\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Office\Recent\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\sidenav-arrow[1].gif
  • %AppData%\Microsoft\Templates\LiveContent\User\Document Themes\1033\CRAB-DECRYPT.txt
  • %UserProfile%\Favorites\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500\CRAB-DECRYPT.txt
  • %UserProfile%\Documents\OneNote Notebooks\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\asay[1].htm
  • %LocalAppData%\Temp\~DF9ADF51BEE85B3E02.TMP
  • %AppData%\Macromedia\Flash Player\macromedia.com\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\onion[1].jpg
  • %AppData%\Mozilla\Firefox\Profiles\1lcuq8ab.default\webapps\CRAB-DECRYPT.txt
  • %SystemDrive%\TEMP\CRAB-DECRYPT.txt
  • %LocalAppData%\Temporary Internet Files\CRAB-DECRYPT.txt
  • %AppData%\Mozilla\Firefox\Profiles\1lcuq8ab.default\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Vault\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Proof\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\UserData\Low\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\jquery-migrate-1.0.0.min[1].js
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\download-easy.html[1].htm
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\uipleiss[1].htm
  • %AppData%\Microsoft\Spelling\CRAB-DECRYPT.txt
  • %AppData%\Mozilla\Firefox\Crash Reports\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Word\CRAB-DECRYPT.txt
  • %ProgramFiles% (x86)\Microsoft SQL Server Compact Edition\v3.5\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Access\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\button-downloadpage[1].png
  • %AppData%\Microsoft\Templates\LiveContent\Managed\Document Themes\CRAB-DECRYPT.txt
  • %AppData%\Adobe\Acrobat\9.0\Collab\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\UserData\EUPM6R87\CRAB-DECRYPT.txt
  • %AppData%\Adobe\Flash Player\AssetCache\TRFRW6GU\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\Quick Launch\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\CRAB-DECRYPT.txt
  • %SystemDrive%\MSOCache\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Crypto\RSA\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\User\Word Document Building Blocks\CRAB-DECRYPT.txt
  • %SystemDrive%\System Volume Information\Chkdsk\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\CRAB-DECRYPT.txt
  • %AppData%\Adobe\Acrobat\9.0\Forms\CRAB-DECRYPT.txt
  • %UserProfile%\Saved Games\CRAB-DECRYPT.txt
  • %AppData%\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\shadowAlpha[1].png
  • %AppData%\Microsoft\Templates\LiveContent\User\SmartArt Graphics\CRAB-DECRYPT.txt
  • %AppData%\Mozilla\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\typography.min[1].css
  • %AppData%\Adobe\CRAB-DECRYPT.txt
  • %LocalAppData%\Temp\~DF3DE6857420342E9D.TMP
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\btn_donateCC_LG[1].gif
  • %AppData%\Adobe\Acrobat\9.0\JavaScripts\CRAB-DECRYPT.txt
  • %UserProfile%\Searches\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics\CRAB-DECRYPT.txt
  • %UserProfile%\Favorites\Microsoft Websites\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\jquery.accordion.min[1].js
  • %SystemDrive%\Documents and Settings\CRAB-DECRYPT.txt
  • %SystemDrive%\System Volume Information\SPP\SppGroupCache\CRAB-DECRYPT.txt
  • %UserProfile%\Documents\My Videos\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\master.min[1].css
  • %UserProfile%\Start Menu\CRAB-DECRYPT.txt
  • %AppData%\Mozilla\Firefox\Profiles\1lcuq8ab.default\minidumps\CRAB-DECRYPT.txt
  • %LocalAppData%\History\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\reset.min[1].css
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\warning[1].png
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\jquery.ba-bbq.min[1].js
  • %AppData%\Microsoft\MSDN\8.0\CRAB-DECRYPT.txt
  • %UserProfile%\Favorites\MSN Websites\CRAB-DECRYPT.txt
  • %UserProfile%\NetHood\CRAB-DECRYPT.txt
  • %SystemDrive%\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-1002\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Stationery\CRAB-DECRYPT.txt
  • %AppData%\Adobe\Flash Player\AssetCache\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\OneNote\14.0\CRAB-DECRYPT.txt
  • %UserProfile%\Documents\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Publisher Building Blocks\CRAB-DECRYPT.txt
  • %SystemDrive%\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\CRAB-DECRYPT.txt
  • %System32%\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer
  • %UserProfile%\Desktop\CRAB-DECRYPT.txt
  • \??\Volume{3f37ba64-ef5c-11e4-bb8d-806e6f6e6963}\System Volume Information\tracking.log.tmp
  • %UserProfile%\Templates\CRAB-DECRYPT.txt
  • %UserProfile%\Documents\My Pictures\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\CRAB-DECRYPT.txt
  • %System32%\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services
  • %AppData%\Macromedia\Flash Player\#SharedObjects\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Outlook\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\cta-buttons[1].jpg
  • %AppData%\Macromedia\Flash Player\#SharedObjects\YXTRFETG\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Crypto\CRAB-DECRYPT.txt
  • %AppData%\Macromedia\CRAB-DECRYPT.txt
  • %UserProfile%\PrintHood\CRAB-DECRYPT.txt
  • %System32%\Microsoft\Protect\S-1-5-18\User\61c31507-0d97-4080-aca3-fd44f12c8dbd
  • %AppData%\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Protect\CRAB-DECRYPT.txt
  • %SystemDrive%\System Volume Information\SPP\OnlineMetadataCache\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\layout.min[1].css
  • %AppData%\Microsoft\SystemCertificates\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\CRAB-DECRYPT.txt
  • %AppData%\Mozilla\Firefox\Profiles\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\dlpage01[1].js
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[2].ico
  • %AppData%\Microsoft\Publisher\CRAB-DECRYPT.txt
  • %ProgramFiles% (x86)\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\UserData\M2V73K19\CRAB-DECRYPT.txt
  • %AppData%\Adobe\Acrobat\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\UserData\EXUAAUDV\CRAB-DECRYPT.txt
  • %UserProfile%\Documents\OneNote Notebooks\Personal\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[1].ico
  • %SystemDrive%\PerfLogs\Admin\CRAB-DECRYPT.txt
  • %SystemDrive%\PerfLogs\CRAB-DECRYPT.txt
  • %UserProfile%\Recorded TV\CRAB-DECRYPT.txt
  • %UserProfile%\Documents\Outlook Files\CRAB-DECRYPT.txt
  • %AppData%\Adobe\Acrobat\9.0\CRAB-DECRYPT.txt
  • %SystemDrive%\CRAB-DECRYPT.txt
  • %ProgramFiles% (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\CRAB-DECRYPT.txt
  • \??\E:\$RECYCLE.BIN\S-1-5-21-2580483871-590521980-3826313501-500\CRAB-DECRYPT.txt
  • %AppData%\Macromedia\Flash Player\macromedia.com\support\flashplayer\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Document Building Blocks\1033\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\Managed\CRAB-DECRYPT.txt
  • %UserProfile%\Favorites\Links\CRAB-DECRYPT.txt
  • %AppData%\Mozilla\Firefox\Profiles\1lcuq8ab.default\bookmarkbackups\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Office\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\MMC\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\UserData\MA3SBLRS\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Credentials\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\headerbg[1].jpg
  • %ProgramFiles%\CRAB-DECRYPT.txt
  • %AppData%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\UserData\CRAB-DECRYPT.txt
  • %ProgramFiles% (x86)\Microsoft SQL Server Compact Edition\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Document Building Blocks\1033\14\CRAB-DECRYPT.txt
  • %SystemDrive%\System Volume Information\SPP\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Internet Explorer\Recovery\High\Active\{50743783-67B4-11E8-8419-00501E3AE7B5}.dat
  • %UserProfile%\Contacts\CRAB-DECRYPT.txt
  • %UserProfile%\Links\CRAB-DECRYPT.txt
  • %LocalAppData%\CRAB-DECRYPT.txt
  • %UserProfile%\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\Managed\Document Themes\1033\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\UserData\8HDD5GFC\CRAB-DECRYPT.txt
  • %LocalAppData%\Temp\CRAB-DECRYPT.txt
  • %AppData%\Adobe\Flash Player\NativeCache\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Excel\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\OneNote\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\X3FXG4H3.htm
  • %AppData%\Microsoft\Signatures\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\SystemCertificates\My\Certificates\CRAB-DECRYPT.txt
  • %AppData%\Macromedia\Flash Player\CRAB-DECRYPT.txt
  • %UserProfile%\Downloads\CRAB-DECRYPT.txt
  • %SystemDrive%\Recovery\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[1].png
  • %LocalAppData%\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50743781-67B4-11E8-8419-00501E3AE7B5}.dat
  • %UserProfile%\Music\Sample Music\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\HTML Help\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\InfoPath\CRAB-DECRYPT.txt
  • %AppData%\Mozilla\Firefox\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics\1033\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\User\CRAB-DECRYPT.txt
  • %UserProfile%\Favorites\Windows Live\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\User\Word Document Building Blocks\1033\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\jquery.client.min[1].js
  • %SystemDrive%\$Recycle.Bin\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\jquery.min[1].js
  • %LocalAppData%\Temp\~DF06C80491114E3378.TMP
  • %AppData%\Microsoft\Internet Explorer\UserData\KKRPCQ2X\CRAB-DECRYPT.txt
  • %UserProfile%\Pictures\Sample Pictures\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\LiveContent\CRAB-DECRYPT.txt
  • %SystemDrive%\System Volume Information\SPP\SppCbsHiveStore\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Templates\SmartArt Graphics\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\SystemCertificates\My\CRLs\CRAB-DECRYPT.txt
  • %UserProfile%\Recent\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\UProof\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\CRAB-DECRYPT.txt
  • %UserProfile%\SendTo\CRAB-DECRYPT.txt
  • %UserProfile%\AppData\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\InternetDefenseLeague-footer-badge[1].png
  • %AppData%\Identities\{AD47C9A9-E417-4179-A4CD-95C51371116D}\CRAB-DECRYPT.txt
  • %UserProfile%\Videos\Sample Videos\CRAB-DECRYPT.txt
  • %AppData%\Adobe\Flash Player\CRAB-DECRYPT.txt
  • %WinDir%\ServiceProfiles\LocalService\AppData\Local\~FontCache-S-1-5-18.dat
  • %SystemDrive%\System Volume Information\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\MSDN\CRAB-DECRYPT.txt
  • %AppData%\Adobe\Acrobat\9.0\Security\CRAB-DECRYPT.txt
  • %LocalAppData%\Microsoft\Internet Explorer\imagestore\aa4x2ky
  • %LocalAppData%\Temp\KnoC125.tmp
  • %AppData%\Microsoft\SystemCertificates\My\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Internet Explorer\CRAB-DECRYPT.txt
  • %UserProfile%\Favorites\Links for United States\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\PowerPoint\CRAB-DECRYPT.txt
  • %AppData%\Macromedia\Flash Player\macromedia.com\support\CRAB-DECRYPT.txt
  • %UserProfile%\Documents\My Music\CRAB-DECRYPT.txt
  • %System32%\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
  • %SystemDrive%\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IEQZMGA.cvr.CRAB
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\tor-logo[1].png
  • %UserProfile%\Recorded TV\Sample Media\CRAB-DECRYPT.txt
  • %AppData%\Mozilla\Extensions\CRAB-DECRYPT.txt
  • %UserProfile%\Libraries\CRAB-DECRYPT.txt
  • %AppData%\Identities\CRAB-DECRYPT.txt
  • %AppData%\Microsoft\Protect\S-1-5-21-2580483871-590521980-3826313501-500\CRAB-DECRYPT.txt
  • %UserProfile%\Documents\OneNote Notebooks\Notes\CRAB-DECRYPT.txt
File Hashes
  • 250fca7ed1806645cf34937eeed0f95a377cc5402a32550c304528bff6d4d09b
  • a9dbaade69b8576f6ddac343129cd6e65825a42c5e8626f1c8ec8d1a68657f0e
  • ae0d1591385c573af2ad6b04816a7d6a30c87ccf40e8f02b3c76e66a4c8450e6
  • f3ec4b314acaff57824363c1d584d729cdcba86931c65b6a412d3203a4571afd
  • 15838f0c2b5035d12540b6f9570b7155a62728f44888739c77e29730cfe281e7
  • 7e6abbd10d276f8cc008b42ce57df3cf29c5d645c8fdcc237c85d10e255c2947
  • 044c4a806be94caa778c6658c268f3cbc1d522f13e8fc0d614177dbcd748d711
  • 91a9f37e7d10d6da919ee61e568644acb6f54f4bf962311fdb0cd9f361c4f91f
  • 638b75f6dfaa2b5fecfc212d776ab0b436e3879535d27cd85bfc5a5ce24db50c
  • 6d2bad6444af859bee7ecc062020dfbb2ae6d31bc9e4448200f43a08b9b1245f
  • e5cbd3986d56d6819dadf6ab64ee1c8dc62cb94aa10c335c25c4b699f3a26011
  • 875d7ebb0f9fb095fdd7eef74c62256b7c381f7b82e83f84d46c2c06644eda35
  • 30fd86096586372d7e08a35eb3da2a4671045f0103f805bc30fa8e1decbd39a9
  • 23a618ad2bed8afa8bfe36dcfd5db1de8affe72f4c1819950489a898df068be9
  • cc61f95be51b77ab039b998e5b5dd07ceccb5b5b5a546d76ab1e5e10d24581c8
  • 43978cffbc50878a1407b3df697ca601d02d866c142185787eb00ddd0e0336e5
  • 13b7b1200c9db70c2c85e8155bcb5659036e7854bbcb21586bc96dd26ddc3e34
  • 602bf5202e26057183ef1dbda965d6917930f341b1f12f9e605f34b59ddc8b3a
  • 39bb04bb5e2cfaf0e09755b3d6af1fc25150f9061d36457eea1ec9ec8bfc0568
  • 4ca159d4df61692ea7212c6cea03dea463aa0b89e16fa4f7094a9dd1515e1058

Coverage



Screenshots of Detection

AMP

ThreatGrid

Tags: ,,,,
Share: Email, ReBlog, Twitter, Facebook, Pinterest, Google+
Newer Post: Newer Post
Older Post: Older Post
Date:
Edit this post

Discussion

Powered by Manual Template
Name

.NET 0-day 0day ACDSee Adobe advisory adwind AMP Android Antenna House antivirus apple APT arbitrary code execution Attribution Automation Bahamut BASS beers with talos bitcoin Bitvote Black Hat botnet Brazil BRKSEC-2010 CASC chrome cisco Cisco Live Cisco Security Clam AV ClamAV Cobalt group code injection command injection conferences Coverage cryptocurrency cryptomining CSV CTA CVE-2016-8610 CVE-2017-0199 cve-2017-11882 CVE-2017-5638 CVE-2018-3857 CVE-2018-3858 CVE-2018-3859 CVE-2018-3860 CVE-2018-3870 CVE-2018-3871 CVE-2018-8506 cybercrime dark cloud DDE Decryptor Def Con detection dispute DOC DoS Excel Exploit exploit kits RTF fast flux Flash formbook Foscam Foxit Fuzzing gandcrab google GoScanSSH gozi gplayed GravityRAT Group123 Hangul healthcare HWP Hyland IcedID ICS IDA Pro IMAP incident response India inesap infostealer intel iOS IoT iot malware iPhone IR isfb jRAT JScript kernel mode KevDroid Korea Linux macros MalDoc Malware Malware Analysis Malware Research MDM meltdown meraki Microsoft Microsoft Patch Tuesday Middle East miners mining mobile device management monero Moxa ms tuesday natus NavRAT new router malware NordVPN North Korea nvidia Office office router attack Olympic Destoryer Olympic Destroyer Olympics opsec password stealer patch tuesday PDF phishing PhotoLine PLC podcast pony Powershell privilege escalation ProntoVPN PTEX PubNub PubNubRAT py2exe Pyeongchang pyrebox python Qatar ransomware RAT remcos remote access tool remote code execution research research spotlight reven ReversingLabs Rocke Rockwell Automation ROKRAT rootkit rtf ruby ryptoShuffler samsam samsung Scriptlets security updates sennoma signatures SimpleDirect Media Layer smartthings Smoke Loader Snort Snort Rules Sony South Korea spam spectre spyeye stealer steam struts support Talos TALOS-2017-0507 talosintelligence.com telegrab telegram Tetrane Thanatos ThanatosDecryptor threat intelligence Threat Research Threat Research Summit Threat Round-up Threat Roundup ThreatGrid threats TIFF trickbot trojan TTRS Umbrella ursnif VBScript VMI vpn filter attack VPNFiler VPNFilter VPNFilter malware vuln dev vulndev vulnerabilities Vulnerability vulnerability analysis Vulnerability Report Vulnerability Research vulnerability spotlight vulnerabillity vulnerable routers Whitepaper Windows WindowsCodecs.dll wipers xamarin XSS
false
ltr
item
materialize material: Threat Roundup for June 1-15
Threat Roundup for June 1-15
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnm8VLxkasp8AkmLiw33d0NngRNm0OZAXvEjxORu37CdQMsQgMydS0GXIlm5dlOFbZUroSDdM9Zp9rE-g7GoYlPBy3SFAubVU9EHA7T1wuek6XgyJXyFPG0IBoXoK6WQ6F6_DBG9YGtMw/s640/threat_roundup_logo_v2.png
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnm8VLxkasp8AkmLiw33d0NngRNm0OZAXvEjxORu37CdQMsQgMydS0GXIlm5dlOFbZUroSDdM9Zp9rE-g7GoYlPBy3SFAubVU9EHA7T1wuek6XgyJXyFPG0IBoXoK6WQ6F6_DBG9YGtMw/s72-c/threat_roundup_logo_v2.png
materialize material
https://materialize-material.blogspot.com/2018/06/threat-roundup-for-june-1-15.html
https://materialize-material.blogspot.com/
http://materialize-material.blogspot.com/
http://materialize-material.blogspot.com/2018/06/threat-roundup-for-june-1-15.html
true
1816414542238562206
UTF-8
Not found any posts Not found any related posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU Tag ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Contents See also related Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS CONTENT IS PREMIUM Please share to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy