carb0nf1ber.no-ip.org

By Pig, December 25, 2009

carb0nf1ber.no-ip.org 94.129.166.204
miraclezdohappen.homeip.net 94.129.132.83
Outgoing connection to remote server: carb0nf1ber.no-ip.org TCP port 15966
Outgoing connection to remote server: miraclezdohappen.homeip.net TCP port 15966
Outgoing connection to remote server: miraclezdohappen.homeip.net TCP port 15966

Registry Changes by all processes
Create or Open
Changes HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun “Policies” = [REG_EXPAND_SZ, value: C:ProgrammeWindows Updatewinupdates.exe]
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun “Policies” = [REG_EXPAND_SZ, value: C:ProgrammeWindows Updatewinupdates.exe]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun “winupdates” = [REG_EXPAND_SZ, value: C:ProgrammeWindows Updatewinupdates.exe]
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “winupdates” = [REG_EXPAND_SZ, value: C:ProgrammeWindows Updatewinupdates.exe]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalled Components{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} “StubPath” = C:ProgrammeWindows Updatewinupdates.exe Restart
HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalled Components{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} “StubPath” = [REG_EXPAND_SZ, value: C:ProgrammeWindows Updatewinupdates.exe]
HKEY_CURRENT_USERSoftwareSpread “FirstExecution” = [REG_EXPAND_SZ, value: 25/12/2009 — 14:49]
HKEY_CURRENT_USERSoftwareSpread “NewIdentification” = [REG_EXPAND_SZ, value: Spread]
Reads HKEY_CURRENT_USERControl PanelMouse “SwapMouseButtons”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTFSystemShared “CUAS”
HKEY_CURRENT_USERKeyboard LayoutToggle “Language Hotkey”
HKEY_CURRENT_USERKeyboard LayoutToggle “Layout Hotkey”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTF “EnableAnchorContext”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionIMM “Ime File”
HKEY_CURRENT_USERSoftwareMicrosoftCTF “Disable Thread Input Manager”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion “ProgramFilesDir”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “AppData”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun “winupdates”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “winupdates”
HKEY_LOCAL_MACHINESOFTWAREClassesHTTPshellopencommand “”
HKEY_CURRENT_USERSoftwareMicrosoftCTF “Disable Thread Input Manager”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTFSystemShared “CUAS”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun “winupdates”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “winupdates”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun “Policies”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun “Policies”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalled Components{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} “StubPath”
HKEY_CURRENT_USERSoftwareMicrosoftMultimediaAudio “SystemFormats”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.imaadpcm “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.imaadpcm “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.imaadpcm “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.imaadpcm “cFilterTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msadpcm “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msadpcm “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msadpcm “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msadpcm “cFilterTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msg711 “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msg711 “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msg711 “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msg711 “cFilterTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msgsm610 “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msgsm610 “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msgsm610 “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msgsm610 “cFilterTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.trspch “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.trspch “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.trspch “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.trspch “cFilterTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msg723 “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msg723 “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msg723 “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msg723 “cFilterTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msaudio1 “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msaudio1 “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msaudio1 “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.msaudio1 “cFilterTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.sl_anet “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.sl_anet “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.sl_anet “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.sl_anet “cFilterTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.iac2 “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.iac2 “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.iac2 “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.iac2 “cFilterTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.l3acm “fdwSupport”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.l3acm “cFormatTags”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.l3acm “aFormatTagCache”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftAudioCompressionManagerDriverCachemsacm.l3acm “cFilterTags”
HKEY_CURRENT_USERSoftwareMicrosoftMultimediaAudio Compression ManagerMSACM “NoPCMConverter”
HKEY_CURRENT_USERSoftwareMicrosoftMultimediaAudio Compression ManagerPriority v4.00 “Priority1”
HKEY_CURRENT_USERControl PanelPowerCfg “AdminMaxSleep”
HKEY_CURRENT_USERControl PanelPowerCfg “AdminMaxVideoTimeout”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControls FolderPowerCfg “LastID”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTFSystemShared “CUAS”
HKEY_CURRENT_USERKeyboard LayoutToggle “Language Hotkey”
HKEY_CURRENT_USERKeyboard LayoutToggle “Layout Hotkey”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTF “EnableAnchorContext”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionIMM “Ime File”
HKEY_CURRENT_USERSoftwareMicrosoftCTF “Disable Thread Input Manager”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders “AppData”
HKEY_CURRENT_USERSoftwareSpread “NewIdentification”
HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSession ManagerAppCompatibility “DisableAppCompat”
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{56F9679E-7826-4C84-81F3-532071A8BCC5}InprocServer32 “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows SearchProtocolHandlersFile “ProgID”
HKEY_LOCAL_MACHINESOFTWAREClassesfile “ShellFolder”
HKEY_LOCAL_MACHINESOFTWAREClassesMapi “ShellFolder”
HKEY_LOCAL_MACHINESOFTWAREClassesOutlookexpress “ShellFolder”
HKEY_LOCAL_MACHINESOFTWAREClassesOTFS “ShellFolder”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersDefault “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersDefault “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersDefault “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersDefault “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.bmp “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.bmp “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.bmp “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.bmp “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.c “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.c “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.c “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.c “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cpp “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cpp “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cpp “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cpp “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cs “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cs “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cs “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cs “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cxx “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cxx “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cxx “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.cxx “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.doc “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.doc “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.doc “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.doc “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.dot “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.dot “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.dot “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.dot “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.emf “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.emf “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.emf “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.emf “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.eml “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.eml “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.eml “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.eml “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.err “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.err “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.err “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.err “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.gif “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.gif “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.gif “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.gif “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.h “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.h “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.h “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.h “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.htm “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.htm “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.htm “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.htm “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.html “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.html “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.html “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.html “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.hxx “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.hxx “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.hxx “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.hxx “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.idl “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.idl “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.idl “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.idl “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpeg “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpeg “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpeg “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpeg “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpg “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpg “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpg “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jpg “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jsl “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jsl “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jsl “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.jsl “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mht “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mht “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mht “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mht “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mhtml “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mhtml “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mhtml “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.mhtml “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.nws “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.nws “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.nws “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.nws “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pdf “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pdf “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pdf “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pdf “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.png “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.png “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.png “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.png “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pot “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pot “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pot “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pot “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pps “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pps “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pps “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.pps “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.ppt “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.ppt “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.ppt “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.ppt “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.rtf “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.rtf “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.rtf “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.rtf “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.txt “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.txt “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.txt “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.txt “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.vb “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.vb “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.vb “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.vb “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wmf “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wmf “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wmf “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wmf “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wrn “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wrn “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wrn “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.wrn “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xls “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xls “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xls “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xls “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xlt “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xlt “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xlt “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xlt “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xml “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xml “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xml “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xml “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xsd “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xsd “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xsd “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension.xsd “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecalendar “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecalendar “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecalendar “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecalendar “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecommunications “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecommunications “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecommunications “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecommunications “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecontact “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecontact “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecontact “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypecontact “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypedocument “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypedocument “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypedocument “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypedocument “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeemail “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeemail “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeemail “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeemail “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefavorite “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefavorite “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefavorite “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefavorite “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefolder “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefolder “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefolder “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypefolder “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeim “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeim “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeim “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeim “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeimages “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeimages “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeimages “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeimages “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypemusic “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypemusic “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypemusic “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypemusic “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypenote “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypenote “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypenote “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypenote “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepicture “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepicture “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepicture “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepicture “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepresentation “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepresentation “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepresentation “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypepresentation “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeprogram “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeprogram “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeprogram “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypeprogram “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypespreadsheet “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypespreadsheet “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypespreadsheet “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypespreadsheet “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypetext “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypetext “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypetext “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypetext “ScriptOk”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypevideo “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypevideo “ContentType”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypevideo “TemplateUrl”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedTypevideo “ScriptOk”
HKEY_LOCAL_MACHINESYSTEMWPAMediaCenter “Installed”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftRpcSecurityService “DefaultAuthLevel”
HKEY_CURRENT_USERSoftwareSpread “FirstExecution”
HKEY_LOCAL_MACHINEHARDWAREDESCRIPTIONSystemCentralProcessor “ProcessorNameString”
HKEY_CURRENT_USERControl PanelMouse “SwapMouseButtons”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTFSystemShared “CUAS”
HKEY_CURRENT_USERKeyboard LayoutToggle “Language Hotkey”
HKEY_CURRENT_USERKeyboard LayoutToggle “Layout Hotkey”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTF “EnableAnchorContext”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionIMM “Ime File”
HKEY_CURRENT_USERSoftwareMicrosoftCTF “Disable Thread Input Manager”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTFSystemShared “CUAS”
HKEY_CURRENT_USERKeyboard LayoutToggle “Language Hotkey”
HKEY_CURRENT_USERKeyboard LayoutToggle “Layout Hotkey”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCTF “EnableAnchorContext”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Script HostSettings “Enabled”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Script HostSettings “LogSecuritySuccesses”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Script HostSettings “IgnoreUserSettings”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Script HostSettings “TrustPolicy”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Script HostSettings “UseWINSAFER”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Script HostSettings “Timeout”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Script HostSettings “DisplayLogo”
HKEY_CURRENT_USERSoftwareMicrosoftWindows Script HostSettings “Timeout”
HKEY_CURRENT_USERSoftwareMicrosoftWindows Script HostSettings “DisplayLogo”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionIMM “Ime File”
HKEY_CURRENT_USERSoftwareMicrosoftCTF “Disable Thread Input Manager”
HKEY_LOCAL_MACHINESOFTWAREClasses.vbs “”
HKEY_LOCAL_MACHINESOFTWAREClassesVBSFileScriptEngine “”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustCertificate{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$DLL”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustCertificate{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$Function”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustFinalPolicy{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$DLL”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustFinalPolicy{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$Function”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustInitialization{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$DLL”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustInitialization{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$Function”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustMessage{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$DLL”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustMessage{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$Function”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustSignature{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$DLL”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustSignature{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$Function”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustCertCheck{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$DLL”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustCertCheck{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$Function”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustCleanup{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$DLL”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyProvidersTrustCleanup{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} “$Function”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptography “MachineGuid”
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionWinTrustTrust ProvidersSoftware Publishing “State”
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSecurity “Safety Warning Level”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMScripting “Default Impersonation Level”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMCIMOM “Logging Directory”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMCIMOM “Logging”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMCIMOM “Log File Max Size”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMCIMOM “Repository Directory”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMCIMOM “ProcessID”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMCIMOM “EnablePrivateObjectHeap”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMCIMOM “ContextLimit”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMCIMOM “ObjectLimit”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWBEMCIMOM “IdentifierLimit”
HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{565783C6-CB41-11D1-8B02-00600806D9B6}1.2 “win32”
HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{420B2830-E718-11CF-893D-00A0C9054228}1.0 “win32”
Enums
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows SearchProtocolHandlers
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows SearchProtocolHandlersFile
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersExtension
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Desktop SearchPreviewersPerceivedType
HKEY_LOCAL_MACHINESYSTEMControlSet001ControlMediaResourcesmsvideo
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyOIDEncodingType 0CryptSIPDllIsMyFileType2
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyOID
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyOIDEncodingType 0CryptSIPDllPutSignedDataMsg
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptographyOIDEncodingType 0CryptSIPDllGetSignedDataMsg

File Changes by all processes
New Files C:ProgrammeWindows Updatewinupdates.exe
C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt
DeviceTcp
DeviceIp
DeviceIp
C:Dokumente und EinstellungenAdministratorAnwendungsdatenlogs.dat
C:DOKUME~1ADMINI~1LOKALE~1TempXxX.xXx
C:DOKUME~1ADMINI~1LOKALE~1TempUuU.uUu
DeviceRasAcd
C:DOKUME~1ADMINI~1LOKALE~1Tempteste.vbs
C:DOKUME~1ADMINI~1LOKALE~1Tempteste.txt
Opened Files .PIPElsarpc
C:winupdate.exe
C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt
C:ProgrammeWindows Updatewinupdates.exe
.Ip
.PIPElsarpc
C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt
C:ProgrammeWindows Updatewinupdates.exe
C:ProgrammeWindows Update
C:Dokumente und EinstellungenAdministratorAnwendungsdatenlogs.dat
.PIPEwkssvc
C:ProgrammeWindows Desktop SearchMSNLNamespaceMgr.dll
C:WINDOWSRegistrationR000000000007.clb
C:WINDOWSAppPatchsysmain.sdb
C:WINDOWSAppPatchsystest.sdb
DeviceNamedPipeShimViewer
C:ProgrammeWindows Update
C:WINDOWSsystem32
C:DOKUME~1ADMINI~1LOKALE~1Tempteste.txt
.PIPElsarpc
C:ProgrammeWindows Updatewinupdates.exe
C:WINDOWSsystem32de-DEcscript.exe.mui
.PIPElsarpc
C:WINDOWSsystem32cscript.exe
C:WINDOWSRegistrationR000000000007.clb
C:DOKUME~1ADMINI~1LOKALE~1Tempteste.vbs
C:WINDOWSsystem32de-DEwshext.dll.mui
C:WINDOWSsystem32wbemwbemdisp.TLB
C:WINDOWSsystem32scrrun.dll
Deleted Files C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt
C:DOKUME~1ADMINI~1LOKALE~1TempUuU.uUu
C:DOKUME~1ADMINI~1LOKALE~1TempXxX.xXx
C:DOKUME~1ADMINI~1LOKALE~1Tempteste.vbs
C:DOKUME~1ADMINI~1LOKALE~1Tempteste.txt
Chronological Order Get File Attributes: C:WINDOWS Flags: (SECURITY_ANONYMOUS)
Open File: .PIPElsarpc (OPEN_EXISTING)
Open File: C:winupdate.exe (OPEN_EXISTING)
Get File Attributes: C:ProgrammeWindows Update Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C: Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Programme Flags: (SECURITY_ANONYMOUS)
Find File: C:ProgrammeWindows Updatewinupdates.exe
Copy File: c:winupdate.exe to C:ProgrammeWindows Updatewinupdates.exe
Create File: C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt
Find File: C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt
Open File: C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt (OPEN_EXISTING)
Find File: C:ProgrammeWindows Updatewinupdates.exe
Open File: C:ProgrammeWindows Updatewinupdates.exe (OPEN_EXISTING)
Create/Open File: DeviceTcp (OPEN_ALWAYS)
Create/Open File: DeviceIp (OPEN_ALWAYS)
Create/Open File: DeviceIp (OPEN_ALWAYS)
Open File: .Ip (OPEN_EXISTING)
Get File Attributes: C:WINDOWS Flags: (SECURITY_ANONYMOUS)
Open File: .PIPElsarpc (OPEN_EXISTING)
Find File: C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt
Open File: C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt (OPEN_EXISTING)
Delete File: C:DOKUME~1ADMINI~1LOKALE~1TempXX–XX–XX.txt
Open File: C:ProgrammeWindows Updatewinupdates.exe (OPEN_EXISTING)
Set File Time: C:ProgrammeWindows Updatewinupdates.exe
Open File: C:ProgrammeWindows Update (OPEN_EXISTING)
Set File Time: C:ProgrammeWindows Update
Get File Attributes: C:ProgrammeWindows Updatewinupdates.exe Flags: (SECURITY_ANONYMOUS)
Set File Attributes: C:ProgrammeWindows Updatewinupdates.exe Flags: (FILE_ATTRIBUTE_ARCHIVE FILE_ATTRIBUTE_COMPRESSED FILE_ATTRIBUTE_HIDDEN FILE_ATTRIBUTE_READONLY FILE_ATTRIBUTE_SYSTEM FILE_ATTRIBUTE_COMPRESSED SECURITY_ANONYMOUS)
Get File Attributes: C:ProgrammeWindows Update Flags: (SECURITY_ANONYMOUS)
Set File Attributes: C:ProgrammeWindows Update Flags: (FILE_ATTRIBUTE_COMPRESSED FILE_ATTRIBUTE_HIDDEN FILE_ATTRIBUTE_READONLY FILE_ATTRIBUTE_SYSTEM FILE_ATTRIBUTE_COMPRESSED SECURITY_ANONYMOUS)
Find File: C:Dokumente und EinstellungenAdministratorAnwendungsdatenlogs.dat
Create File: C:Dokumente und EinstellungenAdministratorAnwendungsdatenlogs.dat
Open File: C:Dokumente und EinstellungenAdministratorAnwendungsdatenlogs.dat (OPEN_EXISTING)
Set File Attributes: C:Dokumente und EinstellungenAdministratorAnwendungsdatenlogs.dat Flags: (FILE_ATTRIBUTE_NORMAL SECURITY_ANONYMOUS)
Set File Time: C:Dokumente und EinstellungenAdministratorAnwendungsdatenlogs.dat
Set File Attributes: C:Dokumente und EinstellungenAdministratorAnwendungsdatenlogs.dat Flags: (FILE_ATTRIBUTE_HIDDEN SECURITY_ANONYMOUS)
Find File: C:ProgrammeWindows Updatewinupdates.exe
Find File: C:DOKUME~1ADMINI~1LOKALE~1TempXxX.xXx
Create File: C:DOKUME~1ADMINI~1LOKALE~1TempXxX.xXx
Find File: C:DOKUME~1ADMINI~1LOKALE~1TempUuU.uUu
Create File: C:DOKUME~1ADMINI~1LOKALE~1TempUuU.uUu
Find File: C:Dokumente und EinstellungenAdministratorAnwendungsdatenSQLite3.dll
Get File Attributes: C:DOKUME~1ADMINI~1LOKALE~1TempUuU.uUu Flags: (SECURITY_ANONYMOUS)
Set File Attributes: C:DOKUME~1ADMINI~1LOKALE~1TempUuU.uUu Flags: (SECURITY_ANONYMOUS)
Delete File: C:DOKUME~1ADMINI~1LOKALE~1TempUuU.uUu
Open File: .PIPEwkssvc (OPEN_EXISTING)
Get File Attributes: c: Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAdministratorEigene Dateiendesktop.ini Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:Dokumente und EinstellungenAll UsersDokumentedesktop.ini Flags: (SECURITY_ANONYMOUS)
Open File: C:ProgrammeWindows Desktop SearchMSNLNamespaceMgr.dll (OPEN_EXISTING)
Get File Attributes: C:WINDOWSRegistration Flags: (SECURITY_ANONYMOUS)
Open File: C:WINDOWSRegistrationR000000000007.clb (OPEN_EXISTING)
Get File Attributes: C:ProgrammeWindows Updatewinupdates.exe:Zone.Identifier Flags: (SECURITY_ANONYMOUS)
Open File: C:WINDOWSAppPatchsysmain.sdb (OPEN_EXISTING)
Open File: C:WINDOWSAppPatchsystest.sdb (OPEN_EXISTING)
Open File: DeviceNamedPipeShimViewer (OPEN_EXISTING)
Open File: C:ProgrammeWindows Update ()
Create/Open File: DeviceRasAcd (OPEN_ALWAYS)
Get File Attributes: C:DOKUME~1ADMINI~1LOKALE~1TempXxX.xXx Flags: (SECURITY_ANONYMOUS)
Set File Attributes: C:DOKUME~1ADMINI~1LOKALE~1TempXxX.xXx Flags: (SECURITY_ANONYMOUS)
Delete File: C:DOKUME~1ADMINI~1LOKALE~1TempXxX.xXx
Create File: C:DOKUME~1ADMINI~1LOKALE~1Tempteste.vbs
Find File: C:WINDOWSsystem32cscript.exe
Get File Attributes: C:DOKUME~1ADMINI~1LOKALE~1Temp Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:WINDOWSsystem32cscript.exe Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:WINDOWSsystem32cscript.exe:Zone.Identifier Flags: (SECURITY_ANONYMOUS)
Open File: C:WINDOWSsystem32 ()
Find File: C:DOKUME~1ADMINI~1LOKALE~1Tempteste.txt
Delete File: C:DOKUME~1ADMINI~1LOKALE~1Tempteste.vbs
Open File: C:DOKUME~1ADMINI~1LOKALE~1Tempteste.txt (OPEN_EXISTING)
Delete File: C:DOKUME~1ADMINI~1LOKALE~1Tempteste.txt
Get File Attributes: C:WINDOWS Flags: (SECURITY_ANONYMOUS)
Open File: .PIPElsarpc (OPEN_EXISTING)
Get File Attributes: C:Programmedesktop.ini Flags: (SECURITY_ANONYMOUS)
Get File Attributes: C:ProgrammeWindows Updatedesktop.ini Flags: (SECURITY_ANONYMOUS)
Open File: C:ProgrammeWindows Updatewinupdates.exe (OPEN_EXISTING)
Open File: C:WINDOWSsystem32de-DEcscript.exe.mui (OPEN_EXISTING)
Open File: .PIPElsarpc (OPEN_EXISTING)
Open File: C:WINDOWSsystem32cscript.exe (OPEN_EXISTING)
Get File Attributes: C:WINDOWSRegistration Flags: (SECURITY_ANONYMOUS)
Open File: C:WINDOWSRegistrationR000000000007.clb (OPEN_EXISTING)
Open File: C:DOKUME~1ADMINI~1LOKALE~1Tempteste.vbs (OPEN_EXISTING)
Open File: C:WINDOWSsystem32de-DEwshext.dll.mui (OPEN_EXISTING)
Get File Attributes: C:WINDOWSsystem32WBEMLogs Flags: (SECURITY_ANONYMOUS)
Open File: C:WINDOWSsystem32wbemwbemdisp.TLB (OPEN_EXISTING)
Open File: C:WINDOWSsystem32scrrun.dll (OPEN_EXISTING)
Create File: C:DOKUME~1ADMINI~1LOKALE~1Tempteste.txt

Categories: Uncategorized