"HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\*(1)" in Source: sample.bin, "HKLM\Software\Microsoft\Internet Explorer\Main" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\\*" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER\\PENDINGFILERENAMEOPERATIONS" in Source: sample.bin, "Registry\Machine\SYSTEM\CurrentControlSet\Hardware Profiles\Current" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICESONCE\\*" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\*(1)" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FINDEXTENSIONS\STATIC" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\\DBGMANAGEDDEBUGGER" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM\\SHELL" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\TERMINAL SERVER\WDS\RDPWD\\STARTUPPROGRAMS" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\*(1)\\QUIETUNINSTALLSTRING" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\USERINIT" in Source: sample.bin, "HKCU\Software\Microsoft\Internet Explorer\Download\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER\INSTALL\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN" in Source: sample.bin, "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXPLORER BARS" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY\SCRIPTS\LOGON\*(2)\\SCRIPT" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLSERVICEOBJECTDELAYLOAD" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\TYPELIB\*(1)\*(2)\WIN64\\" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT" in Source: sample.bin, " HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Power\User\PowerSchemes\$\f15576e8-98b7-4186-b944-eafa664402d9\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Power\User\Default\PowerSchemes\$\f15576e8-98b7-4186-b944-eafa664402d9\* [*]

HKLM\System\CurrentControlSet\Control\NetworkProvider\Notifyees [*] HKLM\System\CurrentControlSet\Services\Mup [ProviderCacheTimeoutInMinutes] HKLM\System\CurrentControlSet\Services\Mup [PrefixCacheSizeInKB] HKLM\System\CurrentControlSet\Services\Mup\Parameters [IrpStackSize] HKLM\System\CurrentControlSet\Control\NetworkProvider\ProviderOrder [LanmanWorkstation] HKLM\System\CurrentControlSet\Control\NetworkProvider\ProviderOrder [nfsnp] HKLM\System\CurrentControlSet\Control\NetworkProvider\ProviderOrder [RDRNP] HKLM\SYSTEM\CurrentControlSet\Control\Power [IgnoreCsComplianceCheck] HKLM\SYSTEM\CurrentControlSet\Control\Power [EnforceConsoleLockScreenTimeout] HKLM\SYSTEM\CurrentControlSet\Control\Power [LidNotifyReliable] HKLM\SYSTEM\CurrentControlSet\Control\Power [HiberFileType] HKLM\SYSTEM\CurrentControlSet\Control\Power [HighPerfDurationBoot] HKLM\SYSTEM\CurrentControlSet\Control\Power [ManualDimTimeout] HKLM\SYSTEM\CurrentControlSet\Control\Power [AllowSystemRequiredPowerRequests] HKLM\SYSTEM\CurrentControlSet\Control\Power [SourceSettingsVersion] " in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\%ws" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\USERINIT" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER\INSTALL\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\*(1)\\*" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\TYPELIB\*(1)\*(2)\WIN16\\" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\" in Source: sample.bin, "HKLM\SYSTEM\*(1)\SERVICES\WINSOCK2\PARAMETERS\NameSpace_catalog5\Catalog_Entries\*(1)\\LibraryPath" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\\*" in Source: sample.bin, "HKLM\%ws\%ws" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\CLSID\*(1)\InProcServer\Codebase\\" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\*(1)" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\CLSID\*(1)\LocalServer32\\" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS\\*" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY\SCRIPTS\SHUTDOWN" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\*(1)" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER\KNOWNDLLS" in Source: sample.bin, "wer\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\f8861c27-95e7-475c-865b-13c0cb3f9d6b\$ [SettingValue] HKLM\SYSTEM\CurrentControlSet\Control\Power\User\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Power\SecurityDescriptors\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerRequestOverride\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Power [HibernateEnabled] HKLM\SYSTEM\CurrentControlSet\Control\Power [HiberFileSizePercent] HKLM\SYSTEM\CurrentControlSet\Control\Power [CustomizeDuringSetup] HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power [AwayModeEnabled] HKLM\SYSTEM\CurrentControlSet\Control\Power " in Source: sample.bin, "HKLM\SYSTEM\*(1)\SERVICES\*(1)\\ImagePath" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\\*" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS\\APPINIT_DLLS" in Source: sample.bin, "HKLM\SYSTEM" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\*(1)\\MODIFYPATH" in Source: sample.bin, "Registry","HKLM\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v3.5 [Install]") %windir%\Microsoft.NET\Framework\v3.5 %windir%\Microsoft.NET\Framework64\v3.5 %NetFx35Install% [AddInProcess.exe.config] %NetFx35Install% [AddInProcess32.exe.config] %NetFx35Install% [AddInUtil.exe.config] %NetFx35Install% [csc.exe.config] %NetFx35Install% [msbuild.exe.config] %NetFx35Install% [vbc.exe.config] " in Source: sample.bin, "System\CurrentControlSet\Control" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\*(1)\\STUBPATH" in Source: sample.bin, "MSDRM\* [*] HKCU\Software\Policies\Microsoft\MSDRM\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\DRM\* [EUL*] %CSIDL_LOCAL_APPDATA%\Microsoft\DRM\* [RL*] %CSIDL_LOCAL_APPDATA%\Microsoft\DRM\* [TMP*] HKCU\Software\Microsoft\MSDRM\* [*] HKCU\Software\Policies\Microsoft\MSDRM\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\DRM\* [EUL*] %CSIDL_LOCAL_APPDATA%\Microsoft\DRM\* [RL*] %CSIDL_LOCAL_APPDATA%\Microsoft\DRM\* [TMP*] HKLM\SOFTWARE\Microsoft\MSDRM\* [*] HKLM\SOFTWARE\Microsoft\uDRM [Hierarchy] HKLM\SOFTWARE\Wow6432Node\Microsoft\MSDRM\* [*] HKLM\SOFTWARE\Wow6432Node\Microsoft\uDRM [Hierarchy] %CSIDL_COMMON_APPDATA%\Microsoft\DRM\Server\* [EUL*] %CSIDL_COMMON_APPDATA%\Microsoft\DRM\Server\* [RL*] %CSIDL_COMMON_APPDATA%\Microsoft\DRM\Server\* [TMP*] HKLM\SOFTWARE\Microsoft\MSDRM\* [*] HKLM\SOFTWARE\Microsoft\uDRM [Hierarchy] " in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\*(1)\\APPPATH" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\CLSID\*(1)\AutoTreatAs\\" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\*(infinite)\shellex\contextmenuhandlers\*(1)\\" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\*" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVE\*(1)" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\*" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SAFEBOOT\NETWORK" in Source: sample.bin, "gnedInt" wcm:changeImpact="noImpact" wcm:description="$(resourceString.description8)" wcm:displayName="$(resourceString.displayName7)" wcm:handler="regkey('HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\uDRM')" wcm:legacyType="REG_DWORD" wcm:migrate="yes" wcm:scope="allUsers" /> visuaMZ" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS" in Source: sample.bin, "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\*(1)\\DISPLAYICON" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\*(1)\\SCRIPT" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED\\*" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS\\LOAD" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\\*" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\hivelist" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\COMMAND PROCESSOR\\AUTORUN" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES\\*" in Source: sample.bin, "HKLM\SYSTEM\*(1)\CONTROL\LSA\\SECURITY PACKAGES" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\TYPELIB\*(1)\*(2)\WIN32\\" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS\\RUN" in Source: sample.bin, "SOFTWARE\MICROSOFT\Cryptography" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER\INSTALL\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\\*" in Source: sample.bin, "System\CurrentControlSet\Control\MpShutdown" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER\\SETUPEXECUTE" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\INTERFACE\*(1)\BASEINTERFACE\\" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Session Manager\SFC" in Source: sample.bin, "HKCU\CONTROL PANEL\DESKTOP\\Wallpaper" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PLUGINS\EXTENSION" in Source: sample.bin, "System\CurrentControlSet\Services\Winsock2\Parameters\Namespace_Catalog5" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\CLSID\*(1)\InProcServer32\\" in Source: sample.bin, "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM\SCRIPTS\LOGON" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\CLSID\*(1)\LocalServer\\" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\CODE STORE DATABASE\DISTRIBUTION UNITS" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS" in Source: sample.bin, " type="File">%NetFx35Install% [Microsoft.CompactFramework.VisualBasic.targets] %NetFx35Install% [SqlServer.targets] %NetFx35Install64% [Microsoft.Common.targets] %NetFx35Install64% [Microsoft.CSharp.targets] %NetFx35Install64% [Microsoft.VisualBasic.targets] %NetFx35Install64% [Microsoft.WinFx.targets] HKLM\SOFTWARE\Microsoft\MSBuild\* [*] HKLM\SOFTWARE\Wow6432Node\Microsoft\MSBuild\* [*] visuaMZ" in Source: sample.bin, "HKLM\SOFTWARE\Clients\StartMenuInternet" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\*(infinite)\shellex\contextmenuhandlers\*(1)" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\\SECURITY PACKAGES" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SAFEBOOT\\AlternateShell" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\GINADLL" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\efaidnbmnnnibpcajpcglclefindmkaj" in Source: sample.bin, "HKCU\CONTROL PANEL\DESKTOP\\SCRNSAVE.EXE" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\\AUTHENTICATION PACKAGES" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER\\BOOTEXECUTE" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\DRAGDROP\*(1)\\APPPATH" in Source: sample.bin, "HKLM\SYSTEM\*(1)\CONTROL\BOOTVERIFICATIONPROGRAM\\IMAGEPATH" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER\INSTALL\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\WOW\\KNOWNDLLS" in Source: sample.bin, "HKCU\CONTROL PANEL\DESKTOP\\OriginalWallpaper" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\INTERFACE\*(1)" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\*(1)\\" in Source: sample.bin, "HKLM\System" in Source: sample.bin, "\SOFTWARE\Microsoft\Office\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DESKTOP\GENERAL\\Wallpaper" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\PROTOCOLS\NAME-SPACE HANDLER" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\CLSID\*(1)\InProcHandler\\" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\TASKMAN" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE" in Source: sample.bin, "leMappingSize] HKLM\SYSTEM\CurrentControlSet\Services\SMSvcHost 3.0.0.0\Performance [FileMappingSize] HKLM\System\CurrentControlSet\Services\NetTcpPortSharing [Start] HKLM\System\CurrentControlSet\Services\NetTcpPortSharing [FailureActions] HKLM\System\CurrentControlSet\Services\idsvc [Start] HKLM\System\CurrentControlSet\Services\idsvc [FailureActions] %windir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation [SMSvcHost.exe.config] %windir%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation [SMSvcHost.exe.config] %NetFx35Install% [Microsoft.Common.targets] %NetFx35Install% [Microsoft.CSharp.targets] %NetFx35Install% [Microsoft.VisualBasic.targets] %NetFx35Install% [Microsoft.WinFx.targets] %NetFx35Install% [Microsoft.CompactFramework.Common.targets] %NetFx35Install% [Microsoft.CompactFramework.CSharp.targets] %NetFx35Install% [Microsoft.CompactFramework.VisualBasic.targets] %NetFx35Install% [SqlServer.targets] %NetFx35Install64% [Microsoft.Common.targets] %NetFx35Install% [Microsoft.CompactFramework.VisualBasic.targets] %NetFx35Install% [SqlServer.targets] %NetFx35Install64% [Microsoft.Common.targets] %NetFx35Install64% [Microsoft.CSharp.targets] %NetFx35Install64% [Microsoft.VisualBasic.targets] %NetFx35Install64% [Microsoft.WinFx.targets] HKLM\SOFTWARE\Microsoft\MSBuild\* [*] HKLM\SOFTWARE\Wow6432Node\Microsoft\MSBuild\* [*] %NetFx35Install% [AddInProcess.exe.config] HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths [*] HKLM\System\CurrentControlSet\Control\NetworkProvider\ProviderOrder [*] HKLM\System\CurrentControlSet\Control\Ne" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\PROTOCOLS\FILTER" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\DRAGDROP" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\DRAGDROP\*(1)\\CLSID" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM\\SHELL" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\\*" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\*(infinite)\CLSID\\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion" in Source: sample.bin, "HKLM\System\" in Source: sample.bin, "HKCU\Software\Classes\VirtualStore\Machine\" in Source: sample.bin, "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWSFIREWALL\DOMAINPROFILE\AUTHORIZEDAPPLICATIONS\LIST" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS" in Source: sample.bin, "\SOFTWARE\Adobe\Adobe Acrobat\DC\Privileged" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN" in Source: sample.bin, "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWSFIREWALL\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST" in Source: sample.bin, "HKEY_LOCAL_MACHINE\Software\Adobe\Adobe Acrobat\DC\WebResource" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\CLSID\*(1)\AUTOCONVERTTO\\" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY\SCRIPTS\LOGOFF\*(2)\\SCRIPT" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY\SCRIPTS\LOGON\*(1)\\FileSysPath" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLICONOVERLAYIDENTIFIERS\*(1)\\" in Source: sample.bin, "System\CurrentControlSet\Services\Winsock2\Parameters\Namespace_Catalog5\Catalog_Entries64" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\SYSTEM" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\INTERFACE" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32" in Source: sample.bin, "HKLM\SYSTEM\*(1)\CONTROL\SAFEBOOT\\AlternateShell" in Source: sample.bin, " %systemdrive%\System Volume Information [*.{7cc467ef-6865-4831-853f-2a4817fd1bca}ALT] HKLM\SYSTEM\CurrentControlSet\Services\VSS\* [*] %systemdrive%\System Volume Information [*.{7cc467ef-6865-4831-853f-2a4817fd1bca}DB] %systemdrive%\System Volume Information [*.{7cc467ef-6865-4831-853f-2a4817fd1bca}ALT] HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot [*] HKLM\SOFTWARE\Wow6432Node\Microsoft\MSDRM\* [*] HKLM\SOFTWARE\Wow6432Node\Microsoft\uDRM [Hierarchy] %CSIDL_COMMON_APPDATA%\Microsoft\DRM\Server\* [EUL*] %CSIDL_COMMON_APPDATA%\Microsoft\DRM\Server\* [RL*] %CSIDL_COMMON_APPDATA%\Microsoft\DRM\Server\* [TMP*] HKLM\SYSTEM\CurrentControlSet\Services\VSS\* [*] %systemdrive%\System Volume Information [*.{7cc467ef-6865-4831-853f-2a4817fd1bca}DB] %systemdrive%\System Volume Information [*.{7cc467ef-6865-4831-853f-2a4817fd1bca}ALT] HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot [*] " in Source: sample.bin, "visua HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\* [ProvAcSettingIndex] HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\* [ProvDcSettingIndex] HKLM\SYSTEM\CurrentControlSet\Control\Po" in Source: sample.bin, "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM\SCRIPTS\LOGOFF\*(2)\\SCRIPT" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\*(infinite)\shell\*(infinite)\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\*(1)\\BANDCLSID" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\*(1)\\STUBPATH" in Source: sample.bin, "\SOFTWARE\Adobe\Adobe Acrobat\DC\Workflows\cServices\cServiceConfiguration" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\*(1)\\" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\TYPELIB\*(1)\*(2)\WIN16\\" in Source: sample.bin, "\Software\Adobe\Acrobat Reader\DC\AVGeneral" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\*(1)\\EXEC" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER\\PENDINGFILERENAMEOPERATIONS2" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES" in Source: sample.bin, "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLICONOVERLAYIDENTIFIERS" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY\SCRIPTS\SHUTDOWN\*(1)\\FileSysPath" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\*(1)" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM\\USERINIT" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS\\RUN" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\*(infinite)\shellex\*(infinite)\\*" in Source: sample.bin, "tern type="Registry">HKLM\Software\Microsoft\WSAT\3.0\* [*] HKLM\SYSTEM\CurrentControlSet\Services\MSDTC Bridge 3.0.0.0\Performance [FileMappingSize] HKLM\SYSTEM\CurrentControlSet\Services\ServiceModelEndpoint 3.0.0.0\Performance [FileMappingSize] HKLM\SYSTEM\CurrentControlSet\Services\ServiceModelOperation 3.0.0.0\Performance [FileMappingSize] HKLM\SYSTEM\CurrentControlSet\Services\ServiceModelService 3.0.0.0\Performance [FileMappingSize] HKLM\SYSTEM\CurrentControlSet\Services\SMSvcHost 3.0.0.0\Performance [FileMappingSize] HKLM\System\CurrentControlSet\Services\NetTcpPortSharing [Start] HKLM\System\CurrentControlSet\Services\NetTcpPortSharing [FailureActions] " in Source: sample.bin, "SOFTWARE\Wow6432Node\Microsoft\Softgrid\4.5\Client\AppFS" in Source: sample.bin, "\Software\Adobe\Adobe Acrobat\DC\AVGeneral" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\*(1)\\CLSID" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FINDEXTENSIONS\*(1)\\" in Source: sample.bin, "> visuavisua MigXmlHelper.DoesOSMatch("NT", "6.0.*") HKCU\Software\Microsoft\" in Source: sample.bin, "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\*(1)" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\*(infinite)\shellex\contextmenuhandlers\*(1)" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER\INSTALL\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\*" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\*(1)" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY\SCRIPTS\SHUTDOWN\*(2)\\SCRIPT" in Source: sample.bin, "e="File">%NetFx35Install% [AddInProcess32.exe.config] %NetFx35Install% [AddInUtil.exe.config] %NetFx35Install% [csc.exe.config] %NetFx35Install% [msbuild.exe.config] %NetFx35Install% [vbc.exe.config] %NetFx35Install64% [AddInProcess.exe.config] %NetFx35Install64% [AddInProcess32.exe.config] %NetFx35Install64% [AddInUtil.exe.config] %NetFx35Install64% [csc.exe.config] %NetFx35Install64% [msbuild.exe.config] %NetFx35Install64% [vbc.exe.config] HKLM\SOFTWARE\Microsoft\MSBuild\* [*] HKLM" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\CLSID\*(1)\LocalServer\\" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\SHELL" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLSERVICEOBJECTDELAYLOAD" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DESKTOP\COMPONENTS" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: sample.bin, "System\CurrentControlSet\Services\Winsock2\Parameters\Namespace_Catalog5\Catalog_Entries" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS" in Source: sample.bin, "visua MigXmlHelper.DoesObjectExist("Registry", "HKLM\SOFTWARE\Microsoft\DRMS") MigXmlHelper.IsOSEarlierThan("NT", "6.2") " in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\INTERFACE\*(1)\PROXYSTUBCLSID32\\" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\TYPELIB" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FINDEXTENSIONS\STATIC\*(1)\\" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\SHELL" in Source: sample.bin, "\Software\Wow6432Node" in Source: sample.bin, "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler" in Source: sample.bin, "ttern type="Registry">HKLM\System\CurrentControlSet\Control\NetworkProvider\ProviderOrder [webclient] visua" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\CLSID\*(1)\LocalServer32\\" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\SHELLBROWSER\*(1)" in Source: sample.bin, "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\AEDEBUG\\DEBUGGER" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\Products\{291AA914-A987-4CE9-BD63-0C0A92D435E5}" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\*(infinite)" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\Products\{291AA914-A987-4CE9-BD63-AC0A92D435E5}" in Source: sample.bin, "migration> %windir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation [SMSvcHost.exe.config] %windir%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation [SMSvcHost.exe.config] HKLM\Software\Microsoft\WSAT\3.0\* [*] HKLM\SYSTEM\CurrentControlSet\Services\MSDTC Bridge 3.0.0.0\Performance [FileMappingSize] HKLM\SYSTEM\CurrentControlSet\Services\ServiceModelEndpoint 3.0.0.0\Performance [FileMappingSize] HKLM\SYSTEM\CurrentControlSet\Services\ServiceModelOperation 3.0.0.0\Performance [FileMappingSize] HKLM\SYSTEM\CurrentControlSet\Services\ServiceModelService 3.0.0.0\Performance [Fi" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\INTERFACE\*(1)\BASEINTERFACE\\" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\DRAGDROP\*(1)\\APPNAME" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES\\*" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE\*(1)" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\*(1)\\QUIETUNINSTALLSTRING" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\*(1)\\APPNAME" in Source: sample.bin, "HKCR\CLSID" in Source: sample.bin, " HKLM\SYSTEM\CurrentControlSet\Services\VSS\Settings\* [*] HKLM\SYSTEM\CurrentControlSet\Services\VSS\Volumes\* [*] HKLM\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl\* [*] HKLM\SYSTEM\CurrentControlSet\Services\VSS\Providers\* [*] HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot [*] %systemdrive%\System Volume Information [*.{7cc467ef-6865-4831-853f-2a4817fd1bca}DB] " in Source: sample.bin, "System\CurrentControlSet\Services" in Source: sample.bin, " HKLM\System\CurrentControlSet\Services\idsvc [Start] HKLM\System\CurrentControlSet\Services\idsvc [FailureActions] %windir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation [SMSvcHost.exe.config] %windir%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation [SMSvcHost.exe.config] visuaMZ" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\*(1)\\UNINSTALLSTRING" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\\*" in Source: sample.bin, "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM\SCRIPTS\SHUTDOWN" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY\SCRIPTS\LOGON" in Source: sample.bin, "HKLM\SOFTWARE" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM\\USERINIT" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\\UIHOST" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXPLORER BARS\*(1)" in Source: sample.bin, " MigXmlHelper.IsOSEarlierThan("NT", "6.2") HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\* [*] visua@echo off net start w32time w32tm /resync cscript //B "%windir%\system32\slmgr.vbs" /upk cscript //B "%windir%\system32\slmgr.vbs" /cpky cscript //B "%windir%" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FINDEXTENSIONS" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY\SCRIPTS\LOGOFF\*(1)\\FileSysPath" in Source: sample.bin, " MigXmlHelper.IsOSEarlierThan("NT", "6.0.0.0") MigXmlHelper.DoesObjectExist("Registry","HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5 [Install]") MigXmlHelper.DoesObjectExist("" in Source: sample.bin, "HKLM\SYSTEM\*(1)\CONTROL\LSA\\NOTIFICATION PACKAGES" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\*(1)\\CLSIDEXTENSION" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\*(1)\\CLSIDEXTENSION" in Source: sample.bin, "HKCU\" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\SHELLBROWSER" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLSERVICEOBJECTDELAYLOAD\\*" in Source: sample.bin, "HKLM\SYSTEM\*(1)\CONTROL\PRINT\MONITORS\*(1)\\DRIVER" in Source: sample.bin, "HKLM\SYSTEM\*(1)\SERVICES\WINSOCK2\PARAMETERS\protocol_catalog9\Catalog_Entries64\*(1)\\PackedCatalogItem" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32\\*" in Source: sample.bin, "HKU\" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32" in Source: sample.bin, "HKLM\SYSTEM\*(1)\CONTROL\SAFEBOOT\MINIMAL\*(1)" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\*(infinite)" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\INTERFACE\*(1)\PROXYSTUBCLSID\\" in Source: sample.bin, "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM\SCRIPTS\LOGOFF" in Source: sample.bin, "HKLM\" in Source: sample.bin, "Software\Microsoft\Microsoft Antimalware" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\*(1)" in Source: sample.bin, "HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\PRINT\MONITORS" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\*(1)\\DLLNAME" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY\SCRIPTS\STARTUP\*(1)\\FileSysPath" in Source: sample.bin, "\Software\Classes" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PLUGINS\EXTENSION\*(1)\\LOCATION" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\*(1)\\CLSID" in Source: sample.bin, "HKLM\SOFTWARE\CLASSES\CLSID\*(1)\InProcServer\Codebase\\" in Source: sample.bin, "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\*(1)\\SCRIPT" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\CODE STORE DATABASE\DISTRIBUTION UNITS\*(1)" in Source: sample.bin, "HKLM\SYSTEM\*(1)\CONTROL\LSA\\AUTHENTICATION PACKAGES" in Source: sample.bin, "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER" in Source: sample.bin, "HKCU\SOFTWARE\CLASSES\CLSID\*(1)\TreatAs\\" in Source: sample.bin, "HKLM\SYSTEM\*(1)\CONTROL\SESSION MANAGER\\BOOTEXECUTE" in Source: sample.bin, "SYSTEM\CurrentControlSet\services\MpBoot\" in Source: sample.bin