24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T41d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 17d82c120427… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 17d82c120427…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9","keywords":["malware analysis","sandbox report","threat intelligence","17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9"],"about":{"@type":"SoftwareApplication","name":"17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9","applicationCategory":["pedll","64bits","executable"],"identifier":"17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Td0e,Assembly shows XOR instruction xor rax rsp in Stream UID: 32795-2228-000000018000D3F4 Assembly shows XOR instruction xor eax esp in Stream UID: 32795-2228-000000018000D3F4 Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2228-000000018000D3F4 Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2228-000000018000D3F4 Assembly shows XOR instruction xor rax rsp in Stream UID: 32795-2231-000000018000D858 Assembly shows XOR instruction xor eax esp in Stream UID: 32795-2231-000000018000D858 Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2231-000000018000D858 Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2231-000000018000D858 Assembly shows XOR instruction xor rax rsp in Stream UID: 32795-2237-000000018000DB5C Assembly shows XOR instruction xor eax esp in Stream UID: 32795-2237-000000018000DB5C Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2237-000000018000DB5C Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2237-000000018000DB5C Assembly shows XOR instruction xor rax rsp in Stream UID: 32795-2269-000000018000AEF0 Assembly shows XOR instruction xor eax esp in Stream UID: 32795-2269-000000018000AEF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2269-000000018000AEF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2269-000000018000AEF0 Assembly shows XOR instruction xor rax rsp in Stream UID: 32795-2294-0000000180003464 Assembly shows XOR instruction xor eax esp in Stream UID: 32795-2294-0000000180003464 Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2294-0000000180003464 Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2294-0000000180003464 Assembly shows XOR instruction xor rax rsp in Stream UID: 32795-2321-00000001800112C4 Assembly shows XOR instruction xor eax esp in Stream UID: 32795-2321-00000001800112C4 Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2321-00000001800112C4 Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2321-00000001800112C4 Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2514-000000018000B5A2 Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2514-000000018000B5A2 Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2516-000000018000B7DE Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2516-000000018000B7DE Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2574-0000000180010052 Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2574-0000000180010052 Assembly shows XOR instruction xor rax rsp in Stream UID: 32795-2577-0000000180010207 Assembly shows XOR instruction xor eax esp in Stream UID: 32795-2577-0000000180010207 Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2577-0000000180010207 Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2577-0000000180010207 Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2584-000000018001085F Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2584-000000018001085F Assembly shows XOR instruction xor rcx rsp in Stream UID: 32795-2592-0000000180010D85 Assembly shows XOR instruction xor ecx esp in Stream UID: 32795-2592-0000000180010D8526:T9ae,Found XOR loop in file "sample.bin" at offset 241332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 250548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 258486; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 406590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 435217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 534361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 71192; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 224328; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 224524; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 460568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 460764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 502870; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 535546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 581553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 612431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 652053; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 93094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 116295; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 164314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 165455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 180510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 186202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 252057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 256987; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 389059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 389178; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 389577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 416175; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 495082; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 500465; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 595714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 614184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 644099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 649379; code bytes = 803027:T2d30,Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetCurrentProcessId"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "EnterCriticalSection"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "HeapAlloc"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CreateActCtxW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetLocaleInfoW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "LeaveCriticalSection"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetTickCount"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetNumberFormatW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "Sleep"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "FreeLibrary"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "WaitForSingleObject"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "DelayLoadFailureHook"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetCalendarInfoW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetProcessHeap"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CloseHandle"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "DeactivateActCtx"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CreateEventW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetLastError"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "DeleteCriticalSection"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CreateFileW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "ReleaseActCtx"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "ResetEvent"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CreateThread"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "SetEvent"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetTimeFormatW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "HeapFree"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetCurrentProcess"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetModuleHandleExW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "TerminateProcess"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "ActivateActCtx"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetCurrentThreadId"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CoTaskMemFree"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetDateFormatW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "DebugBreak"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "IsDebuggerPresent"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "OutputDebugStringW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "SetLastError"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "LocalFree"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "LocalAlloc"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetModuleFileNameW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetProcAddress"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "LoadStringW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetModuleHandleW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetModuleFileNameA"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "LoadLibraryExW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "FormatMessageW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RegOpenKeyExW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RegCloseKey"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RegQueryValueExW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CompareStringOrdinal"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CreateMutexExW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "OpenSemaphoreW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "ReleaseSemaphore"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "ReleaseMutex"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RtlGetLastNtStatus"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RtlCaptureContext"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "RtlDllShutdownInProgress"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CoCreateInstance"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CoInitializeEx"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "CoUninitialize"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "DestroyIcon"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "SystemParametersInfoW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "ShellExecuteExW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "GetFocus"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "SetCursor"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "LoadCursorW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "MessageBoxW"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9") Found reference to API (Indicator: "ShellExecute"; File: "17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9")28:T96d,"itStub%\DefaultIcon" %REGEXSZ% "%_SDCPL_MOD_PATH%,-1"HKCR "CLSID\%CLSID_NamespaceInitStub%\%IPS%" %REGEXSZ% "%SystemRoot%\system32\shdocvw.dll"HKCR "CLSID\%CLSID_NamespaceInitStub%\%IPS%" ThreadingModel "Apartment"HKCR "CLSID\%CLSID_NamespaceInitStub%\ShellFolder" Attributes %REGDW% 0xa00001a0HKCR "CLSID\%CLSID_NamespaceInitStub%\ShellFolder" WantsParseDisplayNameHKLM "%SMWCVSEA%" "%CLSID_NamespaceInitStub%" ""HKCR "CLSID\%CLSID_NamespaceInitStub%\Instance" CLSID %CLSID_LayoutFldr%HKCR "CLSID\%CLSID_NamespaceInitStub%\Instance\InitPropertyBag" ResourceDLL %REGEXSZ% "%_SDCPL_MOD_PATH%"HKCR "CLSID\%CLSID_NamespaceInitStub%\Instance\InitPropertyBag" ResourceID %REGDW% 20HKCR "CLSID\%CLSID_BackupCplElementProvider%" ""HKCR "CLSID\%CLSID_BackupCplElementProvider%\%IPS%" %REGEXSZ% "%_SDCPL_MOD_PATH%"HKCR "CLSID\%CLSID_BackupCplElementProvider%\%IPS%" ThreadingModel "Apartment"[Strings]SMWCVSEA="Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved"PATH_EXPLORER="So" in Source: 17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9 "SOFTWARE\Policies\Microsoft\Windows\Backup\Client" in Source: 17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9 "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup" in Source: 17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9 "itStub%\DefaultIcon" %REGEXSZ% "%_SDCPL_MOD_PATH%,-1"HKCR "CLSID\%CLSID_NamespaceInitStub%\%IPS%" %REGEXSZ% "%SystemRoot%\system32\shdocvw.dll"HKCR "CLSID\%CLSID_NamespaceInitStub%\%IPS%" ThreadingModel "Apartment"HKCR "CLSID\%CLSID_NamespaceInitStub%\ShellFolder" Attributes %REGDW% 0xa00001a0HKCR "CLSID\%CLSID_NamespaceInitStub%\ShellFolder" WantsParseDisplayNameHKLM "%SMWCVSEA%" "%CLSID_NamespaceInitStub%" ""HKCR "CLSID\%CLSID_NamespaceInitStub%\Instance" CLSID %CLSID_LayoutFldr%HKCR "CLSID\%CLSID_NamespaceInitStub%\Instance\InitPropertyBag" ResourceDLL %REGEXSZ% "%_SDCPL_MOD_PATH%"HKCR "CLSID\%CLSID_NamespaceInitStub%\Instance\InitPropertyBag" ResourceID %REGDW% 20HKCR "CLSID\%CLSID_BackupCplElementProvider%" ""HKCR "CLSID\%CLSID_BackupCplElementProvider%\%IPS%" %REGEXSZ% "%_SDCPL_MOD_PATH%"HKCR "CLSID\%CLSID_BackupCplElementProvider%\%IPS%" ThreadingModel "Apartment"[Strings]SMWCVSEA="Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved"PATH_EXPLORER="S" in Source: 17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db929:T1b84,Observed system executable string:"ftware\Microsoft\Windows\CurrentVersion\Explorer"IPS="InProcServer32"REGEXSZ=0x00020000REGDW=0x00010001CLSID_NamespaceInitStub="{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}"CLSID_LayoutFldr="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"CLSID_BackupCplElementProvider="{7DB7A939-E5C8-4eaa-B3E0-43CE04CAFFBE}"_SDCPL_MOD_PATH="%SystemRoot%\System32\sdcpl.dll"ERR_NOSETUPAPI="Can not register SDCPL.DLL because SETUPAPI.DLL is missing."" [Source: 17d82c120427263fb7eebb37a14f816479ed7d2758dd20f6497ada1f9b783db9], Observed system executable string:"