File: 6540cd682209509ac596a58fdf4d9fa2
Metadata
| Server.exe | |
| PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows | 29696 bytes |
| 2016-12-01 14:11:11 | |
| 6540cd682209509ac596a58fdf4d9fa2 | |
| 766ff48877356e771f01beca658b340dec368673 | |
| 0d5b553f01414501eabe8183a9ece812b0b202efe49a6da50ff3a8dd96b786e6 | |
| 880e0a8d07e91b4891f1fc96a2e8114bd567a9f4ec92f481c0e4965baf91f4b64e7af76815f0a9bbfcd182cc18930aef5a68db52c13b3f5873095785302254c5 | |
| 384:XaFCtl7Dh+oqIqEXV5HEQTGumqDgN3eH6GBsbh0w4wlAokw9OhgOL1vYRGOZzZZ:p74oqIjlLTAqM3eFBKh0p29SgRjY | |
| f34d5f2d4577ed6d9ceec516c1f5a744 | |
| N/A | |
APTNotes
Cyber threat intelligence reports associated with 6540cd682209509ac596a58fdf4d9fa2.
Cyber threat intelligence reports associated with 6540cd682209509ac596a58fdf4d9fa2.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
| Domain | IP |
|---|---|
| djamb55.ddns.net | N/A |
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
Mutants
Mutants created by the malware sample.
Mutants created by the malware sample.
Registry keys
Registry keys created by the malware sample.
Registry keys created by the malware sample.
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework |
| HKEY_CURRENT_USER\Software\Microsoft\.NETFramework\Policy\Standards |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\Standards |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\Standards\v2.0.50727 |
| HKEY_CURRENT_USER\Software\Microsoft\.NETFramework |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion |
| HKEY_CURRENT_USER\Software\Microsoft\Fusion |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1547161642-507921405-839522115-1004 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index12 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9\1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\319545b3\1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\37b8106e\7738c853 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\1d498232 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\1d498232\8 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\67e63d5c\6 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\291a02d0\7 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6e9ac653\8 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\52628d2e |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\69db6748 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\69db6748\11 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2995e574\9 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\3914f670\25 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4426ac2f\21 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\7f729234\e |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\268e923b\24 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\31de29a4\b |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\3fcdfaca\10 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName |
| ActiveComputerName |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\Server.exe |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D} |
| HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 |
| HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions |
| HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe |
| HKEY_CLASSES_ROOT\.exe |
| HKEY_CLASSES_ROOT\exefile |
| HKEY_CLASSES_ROOT\exefile\CurVer |
| HKEY_CLASSES_ROOT\exefile\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced |
| HKEY_CLASSES_ROOT\exefile\\ShellEx\IconHandler |
| HKEY_CLASSES_ROOT\SystemFileAssociations\.exe |
| HKEY_CLASSES_ROOT\SystemFileAssociations\application |
| HKEY_CLASSES_ROOT\exefile\\Clsid |
| HKEY_CLASSES_ROOT\* |
| HKEY_CLASSES_ROOT\*\Clsid |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{475c7950-e3d2-11e0-8d7a-806d6172696f}\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{475c7952-e3d2-11e0-8d7a-806d6172696f}\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{475c7952-e3d2-11e0-8d7a-806d6172696f}\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{475c7950-e3d2-11e0-8d7a-806d6172696f}\ |
| HKEY_CLASSES_ROOT\Directory |
| HKEY_CLASSES_ROOT\Directory\CurVer |
| HKEY_CLASSES_ROOT\Directory\ |
| HKEY_CLASSES_ROOT\Directory\\ShellEx\IconHandler |
| HKEY_CLASSES_ROOT\Directory\\Clsid |
| HKEY_CLASSES_ROOT\Folder |
| HKEY_CLASSES_ROOT\Folder\Clsid |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks |
| HKEY_CLASSES_ROOT\CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32 |
| HKEY_CLASSES_ROOT\CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\InProcServer32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers |
| HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004_Classes |
| HKEY_LOCAL_MACHINE\Software\Classes |
| \REGISTRY\USER |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID |
| CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD} |
| CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\TreatAs |
| \CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD} |
| \CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\InprocServer32 |
| \CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\InprocServerX86 |
| \CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\LocalServer32 |
| \CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\InprocHandler32 |
| \CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\InprocHandlerX86 |
| \CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD} |
| HKEY_CLASSES_ROOT\CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\TreatAs |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{B5A7F190-DDA6-4420-B3BA-52453494E6CD} |
| HKEY_CLASSES_ROOT\exefile\\shell |
| HKEY_CLASSES_ROOT\exefile\\shell\open |
| HKEY_CLASSES_ROOT\exefile\\ |
| HKEY_CLASSES_ROOT\exefile\\\shell |
| CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC} |
| CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC}\TreatAs |
| \CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC} |
| \CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC}\InprocServer32 |
| \CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC}\InprocServerX86 |
| \CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC}\LocalServer32 |
| \CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC}\InprocHandler32 |
| \CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC}\InprocHandlerX86 |
| \CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC} |
| HKEY_CLASSES_ROOT\CLSID\{FA2FAAC1-9316-48F3-A294-121FEEA80CEC}\TreatAs |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Groove |
| HKEY_CURRENT_USER\SOFTWARE\Groove Networks, Inc.\Groove |
| HKEY_LOCAL_MACHINE\SOFTWARE\Groove Networks, Inc.\Groove |
| HKEY_LOCAL_MACHINE\SOFTWARE\Groove.OldData |
| HKEY_CURRENT_USER\SOFTWARE\Groove.OldData |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Office\12.0\Groove\InstallRoot |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Groove |
| CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458} |
| CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458}\TreatAs |
| \CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458} |
| \CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458}\InprocServer32 |
| \CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458}\InprocServerX86 |
| \CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458}\LocalServer32 |
| \CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458}\InprocHandler32 |
| \CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458}\InprocHandlerX86 |
| \CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458} |
| HKEY_CLASSES_ROOT\CLSID\{71C3BF7F-682F-4B5E-9E47-5C25D3AC9458}\TreatAs |
| CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221} |
| CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\TreatAs |
| \CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221} |
| \CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\InprocServer32 |
| \CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\InprocServerX86 |
| \CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\LocalServer32 |
| \CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\InprocHandler32 |
| \CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\InprocHandlerX86 |
| \CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221} |
| HKEY_CLASSES_ROOT\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\TreatAs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
| HKEY_CLASSES_ROOT\.ade |
| HKEY_CLASSES_ROOT\.adp |
| HKEY_CLASSES_ROOT\.app |
| HKEY_CLASSES_ROOT\.asp |
| HKEY_CLASSES_ROOT\.bas |
| HKEY_CLASSES_ROOT\.bat |
| HKEY_CLASSES_ROOT\.cer |
| HKEY_CLASSES_ROOT\.chm |
| HKEY_CLASSES_ROOT\.cmd |
| HKEY_CLASSES_ROOT\.com |
| HKEY_CLASSES_ROOT\.cpl |
| HKEY_CLASSES_ROOT\.crt |
| HKEY_CLASSES_ROOT\.csh |
| CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
| CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServerX86 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer32 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandler32 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandlerX86 |
| \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
| HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs |
| HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InProcServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\Ranges\ |
| HKEY_LOCAL_MACHINE\System\Setup |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\0 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\1 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\2 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\3 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\4 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
| HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\ |
| HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\C\ |
| HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\ |
| HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Handler\C |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\C |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
| HKEY_CLASSES_ROOT\exefile\\shell\open\command |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\Trojan.exe |
| HKEY_CLASSES_ROOT\exefile\\shell\open\ddeexec |
| HKEY_CLASSES_ROOT\Applications\Trojan.exe |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\ |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Ole |
| HKEY_CLASSES_ROOT\AppID\Server.exe |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\b1a55bd |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\7d04a1bb |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\7d04a1bb\18 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\19057a88\23 |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh |
| \REGISTRY\MACHINE |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion |
| CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24} |
| CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TreatAs |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24} |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServerX86 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LocalServer32 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocHandler32 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocHandlerX86 |
| \CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24} |
| HKEY_CLASSES_ROOT\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TreatAs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\FWCFG |
| HKEY_LOCAL_MACHINE\Software\Microsoft\COM3\Microsoft\NAP\Netsh |
| HKEY_LOCAL_MACHINE\Software\Microsoft\COM3\Microsoft\NAP\Netsh\Napmontr |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Gemplus GemSAFE Card CSP v1.0 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Infineon SICRYPT Base Smart Card CSP |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Base Cryptographic Provider v1.0 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Base DSS and Diffie-Hellman Cryptographic Provider |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Base DSS Cryptographic Provider |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft DH SChannel Cryptographic Provider |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced Cryptographic Provider v1.0 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype) |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Exchange Cryptographic Provider v1.0 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft RSA SChannel Cryptographic Provider |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Schlumberger Cryptographic Service Provider |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo |
| CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C} |
| CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}\TreatAs |
| \CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C} |
| \CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}\InprocServer32 |
| \CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}\InprocServerX86 |
| \CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}\LocalServer32 |
| \CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}\InprocHandler32 |
| \CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}\InprocHandlerX86 |
| \CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C} |
| HKEY_CLASSES_ROOT\CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}\TreatAs |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\Enroll\HcsGroups |
| CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F} |
| CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}\TreatAs |
| \CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F} |
| \CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}\InprocServer32 |
| \CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}\InprocServerX86 |
| \CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}\LocalServer32 |
| \CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}\InprocHandler32 |
| \CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}\InprocHandlerX86 |
| \CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F} |
| HKEY_CLASSES_ROOT\CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}\TreatAs |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NapAgent\Shas |
| HKEY_USERS\79618 |
| HKEY_USERS\79619 |
| HKEY_USERS\79620 |
| HKEY_USERS\79621 |
| HKEY_USERS\79623 |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\Qecs\79617 |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\Qecs\79618 |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\Qecs\79619 |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\Qecs\79620 |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\Qecs\79621 |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\Qecs\79623 |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\UI |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NapAgent\Qecs |
| HKEY_CLASSES_ROOT\AppID\netsh.exe |
| HKEY_LOCAL_MACHINE\Software\Microsoft\HCS |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient |
| CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} |
| CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TreatAs |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocServer32 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocServerX86 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalServer32 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocHandler32 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocHandlerX86 |
| \CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalServer |
| \AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} |
| HKEY_CLASSES_ROOT\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820} |
| CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} |
| CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServerX86 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\LocalServer32 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServer32 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler32 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandlerX86 |
| \CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} |
| HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs |
| HKEY_CLASSES_ROOT\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887} |
| HKEY_CLASSES_ROOT\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32 |
| HKEY_CLASSES_ROOT\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7} |
| HKEY_CLASSES_ROOT\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32 |
| CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA} |
| CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA} |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServerX86 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LocalServer32 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler32 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandlerX86 |
| \CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA} |
| HKEY_CLASSES_ROOT\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs |
| HKEY_CLASSES_ROOT\Interface\{027947E1-D731-11CE-A357-000000000001} |
| HKEY_CLASSES_ROOT\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32 |
| CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD} |
| CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD} |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServerX86 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\LocalServer32 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandlerX86 |
| \CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD} |
| HKEY_CLASSES_ROOT\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs |
| HKEY_CLASSES_ROOT\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD} |
| HKEY_CLASSES_ROOT\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32 |
| HKEY_CLASSES_ROOT\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD} |
| HKEY_CLASSES_ROOT\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32 |
| CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4} |
| CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\TreatAs |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4} |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServerX86 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\LocalServer32 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocHandler32 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocHandlerX86 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4} |
| HKEY_CLASSES_ROOT\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\TreatAs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\SecurityService |
| CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2} |
| CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\TreatAs |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2} |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\InprocServer32 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\InprocServerX86 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\LocalServer32 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\InprocHandler32 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\InprocHandlerX86 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2} |
| HKEY_CLASSES_ROOT\CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\TreatAs |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List |
Comments
User comments about 6540cd682209509ac596a58fdf4d9fa2.
User comments about 6540cd682209509ac596a58fdf4d9fa2.
