https://pastein.ru/t/mXS
Загрузка данных
HKEY_CLASSES_ROOT\Applications\rundll32.exe\ add
HKEY_CLASSES_ROOT\Applications\rundll32.exe\shell\ add
HKEY_CLASSES_ROOT\Applications\rundll32.exe\shell\open\ add
(Default) REG_DWORD 0x00000000 (0) add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\ mod
PCT REG_QWORD 03 33 5b 10 c7 55 dd 01 old
REG_QWORD 7c ac 7b 9e e8 55 dd 01 new
PTT REG_QWORD 00 31 67 10 c7 55 dd 01 old
REG_QWORD 93 b0 9a 9e e8 55 dd 01 new
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\ mod
09 00 00 00 05 00 00 00 01 00 00 00 00 00 00 00
01 09 05
06 00 00 00 08 00 00 00 07 00 00 00 02 00 00 00
04 00 00 00 03 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 ... (94)
... (95)
NodeSlots REG_BINARY mod
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\ mod
02 00 00 00 01 00 00 00 00 00 00 00 ff ff ff ff
01 02
MRUListEx REG_BINARY mod
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\ mod
5 REG_BINARY 66 00 31 00 00 00 00 00 cc 56 7d 66 10 00 50 52 4f 43 45 53 7e 31 00 00 4e 00 09 00 04 00 ef be cc 56 7c 66 46 5d 47 b5 2e 00 00 00 96 a2 01 00 00 00 ... (104) add
01 00 00 00 03 00 00 00 04 00 00 00 02 00 00 00
05 01 03 04
00 00 00 00 ff ff ff ff
02 00 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\5\ add
MRUListEx REG_BINARY ff ff ff ff add
NodeSlot REG_DWORD 0x0000005f (95) add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\ add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ add
ColInfo REG_BINARY 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 ... (136) add
FFlags REG_DWORD 0x00000001 (1) add
GroupByDirection REG_DWORD 0x00000001 (1) add
GroupByKey:FMTID REG_SZ {00000000-0000-0000-0000-000000000000} add
GroupByKey:PID REG_DWORD 0x00000000 (0) add
GroupView REG_DWORD 0x00000000 (0) add
IconSize REG_DWORD 0x00000010 (16) add
LogicalViewMode REG_DWORD 0x00000001 (1) add
Mode REG_DWORD 0x00000004 (4) add
Sort REG_BINARY 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\Shell\ add
SniffedFolderType REG_SZ Generic add
HKEY_CURRENT_USER\Software\Classes\Applications\ add
HKEY_CURRENT_USER\Software\Classes\Applications\rundll32.exe\ add
HKEY_CURRENT_USER\Software\Classes\Applications\rundll32.exe\shell\ add
HKEY_CURRENT_USER\Software\Classes\Applications\rundll32.exe\shell\open\ add
(Default) REG_DWORD 0x00000000 (0) add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\ mod
PCT REG_QWORD 03 33 5b 10 c7 55 dd 01 old
REG_QWORD 7c ac 7b 9e e8 55 dd 01 new
PTT REG_QWORD 00 31 67 10 c7 55 dd 01 old
REG_QWORD 93 b0 9a 9e e8 55 dd 01 new
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\ mod
09 00 00 00 05 00 00 00 01 00 00 00 00 00 00 00
01 09 05
06 00 00 00 08 00 00 00 07 00 00 00 02 00 00 00
04 00 00 00 03 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 ... (94)
... (95)
NodeSlots REG_BINARY mod
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\ mod
02 00 00 00 01 00 00 00 00 00 00 00 ff ff ff ff
01 02
MRUListEx REG_BINARY mod
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\ mod
5 REG_BINARY 66 00 31 00 00 00 00 00 cc 56 7d 66 10 00 50 52 4f 43 45 53 7e 31 00 00 4e 00 09 00 04 00 ef be cc 56 7c 66 46 5d 47 b5 2e 00 00 00 96 a2 01 00 00 00 ... (104) add
01 00 00 00 03 00 00 00 04 00 00 00 02 00 00 00
05 01 03 04
00 00 00 00 ff ff ff ff
02 00 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\5\ add
MRUListEx REG_BINARY ff ff ff ff add
NodeSlot REG_DWORD 0x0000005f (95) add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\ add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ add
ColInfo REG_BINARY 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 ... (136) add
FFlags REG_DWORD 0x00000001 (1) add
GroupByDirection REG_DWORD 0x00000001 (1) add
GroupByKey:FMTID REG_SZ {00000000-0000-0000-0000-000000000000} add
GroupByKey:PID REG_DWORD 0x00000000 (0) add
GroupView REG_DWORD 0x00000000 (0) add
IconSize REG_DWORD 0x00000010 (16) add
LogicalViewMode REG_DWORD 0x00000001 (1) add
Mode REG_DWORD 0x00000004 (4) add
Sort REG_BINARY 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\Shell\ add
SniffedFolderType REG_SZ Generic add
HKEY_CURRENT_USER\Software\Microsoft\AuthCookies\Live\Default\DIDC\ mod
Data REG_SZ ct%3D1791326491%26hashalg%3DSHA256%26bver%3D22%26appid%3DDefault%26da%3D%253CEncryptedData%2520xmlns%253D%2522http://www.w3.org/2001/04/xmlenc%2523%2522%2520Id%253D%2522devicesoftware%2522%2520Type%253D%2522http://www.w3.org/2001/04/xmlenc%2523Element%2522%253E%253CEncryptionMethod%2520Algorithm%253 ... (1435) old
REG_SZ ct%3D1791328720%26hashalg%3DSHA256%26bver%3D22%26appid%3DDefault%26da%3D%253CEncryptedData%2520xmlns%253D%2522http://www.w3.org/2001/04/xmlenc%2523%2522%2520Id%253D%2522devicesoftware%2522%2520Type%253D%2522http://www.w3.org/2001/04/xmlenc%2523Element%2522%253E%253CEncryptionMethod%2520Algorithm%253 ... (1451) new
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property\ mod
01 00 00 00 01 00 00 00 d0 8c 9d df 01 15 d1 11
8c 7a 00 c0 4f c2 97 eb 01 00 00 00 db 95 6e df
77 f3 3f 47 b1 c8 95 3b bc 40 e8 d1 00 00 00 00
02 00 ... (346)
... (346)
0018801921667C6E REG_BINARY mod
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723\ mod
01 00 00 00 01 00 00 00 d0 8c 9d df 01 15 d1 11
8c 7a 00 c0 4f c2 97 eb 01 00 00 00 db 95 6e df
77 f3 3f 47 b1 c8 95 3b bc 40 e8 d1 00 00 00 00
02 00 ... (2986)
... (2938)
DeviceTicket REG_BINARY mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ActivityDataModel\ReaderRevisionInfo\ mod
2259DE09-A10D-947E-641F-56694FF2531D REG_MULTI_SZ 1㈷80†∠慄慴慢敳湉瑳湡散摉•›㤵ㄶⰶ †匢煥敵据≥㨠㌠㤸ⰸ †愢瑣癩瑩卹潴敲摉•›㈢㔲䐹ぅⴹㅁ䐰㤭㜴ⵅ㐶䘱㔭㘶㐹䙆㔲ㄳ≄ਬ†∠楦瑬牥•›†††椢剳慥䙤汩整≲㨠〠ਬ†††漢楲楧䙮汩整䭲祥•›ⰰ ††∠瑳瑡䙥汩整䭲祥•›ⰰ ††∠獵牥捁楴湯瑓瑡䙥汩整≲㨠〠 † old
REG_MULTI_SZ 1㈷80†∠慄慴慢敳湉瑳湡散摉•›㤵ㄶⰶ †匢煥敵据≥㨠㌠㌹ⰵ †愢瑣癩瑩卹潴敲摉•›㈢㔲䐹ぅⴹㅁ䐰㤭㜴ⵅ㐶䘱㔭㘶㐹䙆㔲ㄳ≄ਬ†∠楦瑬牥•›†††椢剳慥䙤汩整≲㨠〠ਬ†††漢楲楧䙮汩整䭲祥•›ⰰ ††∠瑳瑡䙥汩整䭲祥•›ⰰ ††∠獵牥捁楴湯瑓瑡䙥汩整≲㨠〠 † new
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${acee881c-40d8-4c2f-b63e-fcc3351fd8e4}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap\Current\ mod
02 00 00 00 1d 8d 22 04 e8 55 dd 01 00 00 00 00
17 fb ab 98
43 42 01 00 0d 12 0a 15 28 50 00 7e 00 4d 00 49
00 43 00 52 00 4f 00 53 00 4f 00 46 00 54 00 2e
00 47 ... (2629)
... (2629)
Data REG_BINARY mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-338387\ mod
04 00 00 00 fe 7f 00 00 e5 2b ae f1 c6 55 dd 01
36 bb 56 8b e8
fb 9b d4 78 e8 55 dd 01 fb fb c2 f1 c6 55 dd 01
b7 bb bb 7d 0a 56 b7 49 60 8b e8
00 00 00 00 00 00 00 00 70 f5 f2 f9 c6 55 dd 01
6b fa 89 9e e8
00 00 ... (92)
... (92)
(Default) REG_BINARY mod
04 00 00 00 00 00 00 00 fb fb c2 f1 c6 55 dd 01
02 00 02 00 00 00 00 00 57 fb cd 5a fb 54 dd 01
12 04 00 00
14
HealthEvaluation REG_BINARY mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\ add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\ add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\GlobalSettings\ add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\GlobalSettings\ProperTreeModuleInner\ add
ProperTreeModuleInner REG_BINARY 9c 00 00 00 98 00 00 00 31 53 50 53 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 3b 00 00 00 2a 00 00 00 00 4e 00 61 00 76 00 50 00 61 00 6e 00 65 ... (160) add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU\ mod
3 REG_BINARY 50 00 72 00 6f 00 63 00 6d 00 6f 00 6e 00 36 00 34 00 2e 00 65 00 78 00 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ... (592) add
02 00 00 00 01 00 00 00 00 00 00 00 ff ff ff ff
03 02 01 00 00 00 00
ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU\ mod
3 REG_BINARY 50 00 72 00 6f 00 63 00 6d 00 6f 00 6e 00 36 00 34 00 2e 00 65 00 78 00 65 00 00 00 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 ... (252) add
01 00 00 00 02 00 00 00 00 00 00 00 ff ff ff ff
03 01 02 00 00 00 00
ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*\ mod
4 REG_BINARY 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 2e 80 3a cc bf b4 2c db 4c 42 b0 29 7f e9 9a 87 c6 41 50 00 31 00 00 00 00 00 28 57 ... (346) add
03 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00
04 03 02 01
ff ff ff ff
00 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\PML\ add
0 REG_BINARY 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 2e 80 3a cc bf b4 2c db 4c 42 b0 29 7f e9 9a 87 c6 41 50 00 31 00 00 00 00 00 28 57 ... (346) add
MRUListEx REG_BINARY 00 00 00 00 ff ff ff ff add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched\ mod
C:\Users\user\Desktop\tools\ProcessMonitor\Procmon64.exe REG_DWORD 0x00000003 (3) old
REG_DWORD 0x00000005 (5) new
C:\Users\user\Desktop\tools\SysTracer x64\SysTracer.exe REG_DWORD 0x00000005 (5) old
REG_DWORD 0x00000006 (6) new
Microsoft.Windows.Explorer REG_DWORD 0x0000001a (26) old
REG_DWORD 0x0000001c (28) new
wj32.ProcessHacker2 REG_DWORD 0x00000009 (9) old
REG_DWORD 0x0000000a (10) new
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\ add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\OpenWithList\ add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\OpenWithProgids\ add
ProcMon.Logfile.1 REG_NONE add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\ mod
46 REG_BINARY 6d 00 69 00 6e 00 69 00 5f 00 72 00 75 00 6e 00 5f 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2e 00 50 00 4d 00 4c 00 00 00 86 00 32 00 00 00 00 00 00 00 ... (176) add
47 REG_BINARY 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 00 00 78 00 32 00 00 00 00 00 00 00 00 00 00 00 50 72 6f 63 65 73 ... (152) add
1e 00 00 00 2d 00 00 00 2c 00 00 00 01 00 00 00
2f 2e 1e 2d
2b 00 00 00 2a 00 00 00 29 00 00 00 23 00 00 00
2c 01 2b 2a
00 00 00 00 28 00 00 00 27 00 00 00 26 00 00 00
29 23 00 28
18 00 ... (188)
27 ... (196)
MRUListEx REG_BINARY mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.PML\ add
0 REG_BINARY 6d 00 69 00 6e 00 69 00 5f 00 72 00 75 00 6e 00 5f 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2e 00 50 00 4d 00 4c 00 00 00 86 00 32 00 00 00 00 00 00 00 ... (176) add
MRUListEx REG_BINARY 00 00 00 00 ff ff ff ff add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\ mod
13 REG_BINARY 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 00 00 78 00 32 00 00 00 00 00 00 00 00 00 00 00 50 72 6f 63 65 73 ... (152) add
0c 00 00 00 00 00 00 00 0b 00 00 00 0a 00 00 00
0d 0c 00 0b
09 00 00 00 08 00 00 00 01 00 00 00 07 00 00 00
0a 09 08 01
06 00 00 00 03 00 00 00 04 00 00 00 05 00 00 00
07 06 03 04
02 00 ... (56)
05 ... (60)
MRUListEx REG_BINARY mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001059A\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000020734\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000301FA\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000030598\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000604D8\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000704CE\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001204D8\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001504D8\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\ mod
00 00 00 00 34 01 00 00 08 03 00 00 92 00 4c 01
35 13 a2 be 59
42 00 00 00 33 00 00 00 08 85 0f 00 7b 00 31 00
41 00 43 00 31 00 34 00 45 00 37 00 37 00 2d 00
30 00 ... (1612)
... (1612)
HRZR_PGYFRFFVBA REG_BINARY mod
00 00 00 00 09 00 00 00 25 00 00 00 81 a6 17 00
28 38 3f 1b
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 ... (72)
... (72)
jw32.CebprffUnpxre2 REG_BINARY mod
00 00 00 00 04 00 00 00 05 00 00 00 45 40 03 00
08 21 5b 09
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 ... (72)
... (72)
P:\Hfref\hfre\Qrfxgbc\gbbyf\CebprffZbavgbe\Cebpzba64.rkr REG_BINARY mod
00 00 00 00 04 00 00 00 07 00 00 00 59 ac 01 00
08 7b 4d 02
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 ... (72)
... (72)
P:\Hfref\hfre\Qrfxgbc\gbbyf\FlfGenpre k64\FlfGenpre.rkr REG_BINARY mod
P:\Hfref\hfre\Qrfxgbc\yno1\fep\TerlRaretlzvav.ova.rkr REG_BINARY 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 ... (72) add
00 00 00 00 37 00 00 00 f2 00 00 00 9f 11 65 00
f4 67 af
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 ... (72)
... (72)
Zvpebfbsg.Jvaqbjf.Rkcybere REG_BINARY mod
{6Q809377-6NS0-444O-8957-N3773S02200R}\Cebprff Unpxre 2\crivrj.rkr REG_BINARY 00 00 00 00 00 00 00 00 02 00 00 00 93 cb 02 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 ... (72) add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState\ mod
PolicyState REG_DWORD 0x00000002 (2) old
REG_DWORD 0x00000000 (0) new
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search\ mod
InstalledWin32AppsRevision REG_SZ {5CEF7A98-A352-4BB5-B380-657640AF3944} old
REG_SZ {7D125EE5-D770-4EE6-B21B-81362BE20278} new
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppsConstraintIndex\ mod
LatestConstraintIndexFolder REG_SZ C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{24759195-6ac6-4901-9b76-dff09b574094} old
REG_SZ C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c949c20-581f-4cbc-ad40-f40719b65741} new
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\ mod
C:\Users\user\Desktop\lab1\src\GreyEnergymini.bin.exe REG_BINARY 53 41 43 50 01 00 00 00 00 00 00 00 07 00 00 00 28 00 00 00 03 d2 01 00 c2 73 02 00 01 00 00 00 00 00 00 00 00 00 01 06 71 02 00 00 63 1f 6e 6f 0e de ... (60) add
HKEY_CURRENT_USER\Software\Sysinternals\Process Monitor\ mod
SaveDialog REG_BINARY 2c 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 58 00 00 00 75 00 00 00 38 02 00 00 06 02 00 00 add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData\ mod
ClockTimeSeconds REG_QWORD 9c 7f c5 6a 00 00 00 00 old
REG_QWORD 02 81 c5 6a 00 00 00 00 new
TickCount REG_QWORD 23 1f 06 00 00 00 00 00 old
REG_QWORD 8d 96 0b 00 00 00 00 00 new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\ mod
LastSuccessfulRequestTimestamp REG_QWORD 00 00 00 00 00 00 00 00 old
REG_QWORD fd 6f 29 8b e8 55 dd 01 new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723\ add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723\ads.arcct.msn.com_MBI_SSL\ add
ErrorCode REG_DWORD 0x00000000 (0) add
FailureType REG_DWORD 0x00000000 (0) add
RequestCount REG_DWORD 0x00000000 (0) add
StartedTime REG_QWORD fd 6f 29 8b e8 55 dd 01 add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-21-2292890337-69778762-837601055-1001_S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723\ add
ThrottleCount REG_DWORD 0x00000001 (1) add
ThrottleStartedTime REG_QWORD cf bb ed 8a e8 55 dd 01 add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMB1Uninstall\ mod
SMB1ClientCounter REG_DWORD 0x0000002a (42) old
REG_DWORD 0x0000002b (43) new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\ mod
SessionIdHigh REG_DWORD 0x01dd55e5 (31282661) old
REG_DWORD 0x01dd55e9 (31282665) new
SessionIdLow REG_DWORD 0xeae2ec76 (3940740214) old
REG_DWORD 0xb0cfde5c (2966412892) new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\SettingsRequests\ mod
LastDownloadTime REG_QWORD 7d 9a d0 79 e7 55 dd 01 old
REG_QWORD a6 dc 42 92 e9 55 dd 01 new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState\ mod
PolicyState REG_DWORD 0x00000002 (2) old
REG_DWORD 0x00000000 (0) new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\VFUProvider\ mod
StartTime REG_QWORD 6c 5e eb 3a e8 55 dd 01 old
REG_QWORD 42 c3 e2 9a ea 55 dd 01 new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ mod
LastTaskOperationHandle REG_DWORD 0x0000009e (158) old
REG_DWORD 0x0000002d (45) new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\2584\ add
CreationTime REG_QWORD 32 63 98 9e e8 55 dd 01 add
Reason REG_DWORD 0x00000004 (4) add
Terminator REG_SZ HAM add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\4980\ add
CreationTime REG_QWORD 48 db 6b 8b e8 55 dd 01 add
Reason REG_DWORD 0x00000004 (4) add
Terminator REG_SZ HAM add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\ mod
3d 05 00 00 00 00 00 00 04 00 04 00 01 02 0a 00
4b
00 00 00 00 22 00 00 00 0d 78 79 00 10 00 00 00
59 b5 05 01 04 00 00 00 6b 50 7e 00 02 00 00 00
81 06 ... (554)
... (584)
418A073AA3BC3475 REG_BINARY mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0C327141-EACA-4468-ADCC-601D8CC57D62}\ mod
fa 03 49 e4 61 64 9b 0a 06 1b d9 ed 70 32 4d a3
12 67 5b 5b 25 8f 38 4b cb 30 d3 d3 df 49 99 44
b6 1e 74 1f 55 98 81 24 fc f8 b5 30 03 54 a1 66
fb f4 a4 32 33 d2 5f a4 dd c1 25 f9 22 ca a9 ac
Hash REG_BINARY mod
17 00 00 00 00 00 00 00 00 db 97 4c c6 00 00 00
dc 3f 32 09
00 00 00 00 00 00 00 00 00 db 97 4c c6 00 00 00
dc 3f 32 09
ff ff ff ff ff ff ff ff 48 20 42 42 48 48 48 48
7a c9 ... (625)
8f cf ... (625)
Triggers REG_BINARY mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{55412461-F053-4583-A6BF-19F36DAAD46D}\ mod
03 00 00 00 12 22 d3 5d 9c 9c d9 01 b5 9f 43 64
45 a4 05 e6
e5 55 dd 01 00 00 00 00 00 00 00 00 14 dd 46 64
e8 4c 06 1b e6
e5 55 dd 01
e8
DynamicInfo REG_BINARY mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6CD70278-3C30-4E8E-A585-8D9E5CAB415F}\ mod
03 00 00 00 e6 54 69 5e 9c 9c d9 01 8c d5 ee ea
9b 77 cc b0
e5 55 dd 01 00 00 00 00 00 00 00 00 e3 0e f3 ea
e9 0f 3d d1 b0
e5 55 dd 01
e9
DynamicInfo REG_BINARY mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E4AEB720-7F18-419F-A20E-6E0B5C4ED968}\ mod
03 00 00 00 a8 72 c5 5f 9c 9c d9 01 c3 00 d4 82
9f 42 e4 46
e5 55 dd 01 00 00 00 00 00 00 00 00 04 6e ff 82
e9 35 4c 1a 47
e5 55 dd 01
e9
DynamicInfo REG_BINARY mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA103B2E-5EB2-499F-9443-9765F29C7B5B}\ mod
03 00 00 00 6d 44 89 5d 9c 9c d9 01 e1 46 d9 ea
08 9d b9 b0
e5 55 dd 01 00 00 00 00 00 00 00 00 42 aa 04 eb
e9 15 3d f2 b0
e5 55 dd 01
e9
DynamicInfo REG_BINARY mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD99B9AA-26F4-41C8-A511-227192E65CF5}\ mod
03 00 00 00 84 b1 8b 5d 9c 9c d9 01 cd 51 ec ea
2a 09 ca b0
e5 55 dd 01 00 00 00 00 00 00 00 00 7b 4f f0 ea
e9 30 90 cd b0
e5 55 dd 01
e9
DynamicInfo REG_BINARY mod
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState\ mod
PolicyState REG_DWORD 0x00000002 (2) old
REG_DWORD 0x00000000 (0) new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-21-2292890337-69778762-837601055-1001\ mod
\Device\HarddiskVolume4\Program Files\Process Hacker 2\peview.exe REG_BINARY 8d d4 1c 74 ea 55 dd 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 add
SequenceNumber REG_DWORD 0x0000000c (12) old
REG_DWORD 0x0000000e (14) new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits\ mod
SecureTimeEstimated REG_QWORD 2f c1 d6 42 e8 55 dd 01 old
REG_QWORD 1f d6 21 0e eb 55 dd 01 new
SecureTimeHigh REG_QWORD 2f 29 9b a4 f0 55 dd 01 old
REG_QWORD 1f 3e e6 6f f3 55 dd 01 new
SecureTimeLow REG_QWORD 2f 59 12 e1 df 55 dd 01 old
REG_QWORD 1f 6e 5d ac e2 55 dd 01 new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits\RunTime\ mod
SecureTimeTickCount REG_QWORD 9c 9a 06 00 00 00 00 00 old
REG_QWORD 5b ea 18 00 00 00 00 00 new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2292890337-69778762-837601055-1001\ mod
\Device\HarddiskVolume4\Program Files\Process Hacker 2\peview.exe REG_BINARY 8d d4 1c 74 ea 55 dd 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 add
SequenceNumber REG_DWORD 0x0000000c (12) old
REG_DWORD 0x0000000e (14) new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits\ mod
SecureTimeEstimated REG_QWORD 2f c1 d6 42 e8 55 dd 01 old
REG_QWORD 1f d6 21 0e eb 55 dd 01 new
SecureTimeHigh REG_QWORD 2f 29 9b a4 f0 55 dd 01 old
REG_QWORD 1f 3e e6 6f f3 55 dd 01 new
SecureTimeLow REG_QWORD 2f 59 12 e1 df 55 dd 01 old
REG_QWORD 1f 6e 5d ac e2 55 dd 01 new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\ mod
SecureTimeTickCount REG_QWORD 9c 9a 06 00 00 00 00 00 old
REG_QWORD 5b ea 18 00 00 00 00 00 new
HKEY_LOCAL_MACHINE\SYSTEM\RNG\ mod
52 75 6e 6e 69 6e 67 21 00 d0 07 00 5d 2a a1 f2
5b b3 50 a5
91 6c 44 be 4b 59 1f 65 55 fd 40 fd a5 31 4a 27
40 d4 0a 4a 26 50 6a 80 60 16 d6 be 47 5e 73 91
30 ae 61 cf d6 41 07 a8 f3 9c 1b 89 66 67 4c f8
12 fb 70 9f 27 3f a9 bd fb 5a 5c b2 ec 21 40 2d
e6 c5 ... (76)
b3 8c ... (76)
Seed REG_BINARY mod
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b\B1A07F78\ mod
@C:\Windows\system32\notepad.exe,-469 REG_SZ Текстовый документ add
HKEY_USERS\S-1-5-18\Software\Classes\Local Settings\MuiCache\3b\B1A07F78\ mod
@C:\Windows\system32\notepad.exe,-469 REG_SZ Текстовый документ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Applications\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Applications\rundll32.exe\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Applications\rundll32.exe\shell\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Applications\rundll32.exe\shell\open\ add
(Default) REG_DWORD 0x00000000 (0) add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\ mod
PCT REG_QWORD 03 33 5b 10 c7 55 dd 01 old
REG_QWORD 7c ac 7b 9e e8 55 dd 01 new
PTT REG_QWORD 00 31 67 10 c7 55 dd 01 old
REG_QWORD 93 b0 9a 9e e8 55 dd 01 new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\ mod
09 00 00 00 05 00 00 00 01 00 00 00 00 00 00 00
01 09 05
06 00 00 00 08 00 00 00 07 00 00 00 02 00 00 00
04 00 00 00 03 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 ... (94)
... (95)
NodeSlots REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\ mod
02 00 00 00 01 00 00 00 00 00 00 00 ff ff ff ff
01 02
MRUListEx REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\ mod
5 REG_BINARY 66 00 31 00 00 00 00 00 cc 56 7d 66 10 00 50 52 4f 43 45 53 7e 31 00 00 4e 00 09 00 04 00 ef be cc 56 7c 66 46 5d 47 b5 2e 00 00 00 96 a2 01 00 00 00 ... (104) add
01 00 00 00 03 00 00 00 04 00 00 00 02 00 00 00
05 01 03 04
00 00 00 00 ff ff ff ff
02 00 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\5\ add
MRUListEx REG_BINARY ff ff ff ff add
NodeSlot REG_DWORD 0x0000005f (95) add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ add
ColInfo REG_BINARY 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 ... (136) add
FFlags REG_DWORD 0x00000001 (1) add
GroupByDirection REG_DWORD 0x00000001 (1) add
GroupByKey:FMTID REG_SZ {00000000-0000-0000-0000-000000000000} add
GroupByKey:PID REG_DWORD 0x00000000 (0) add
GroupView REG_DWORD 0x00000000 (0) add
IconSize REG_DWORD 0x00000010 (16) add
LogicalViewMode REG_DWORD 0x00000001 (1) add
Mode REG_DWORD 0x00000004 (4) add
Sort REG_BINARY 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\Shell\ add
SniffedFolderType REG_SZ Generic add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\AuthCookies\Live\Default\DIDC\ mod
Data REG_SZ ct%3D1791326491%26hashalg%3DSHA256%26bver%3D22%26appid%3DDefault%26da%3D%253CEncryptedData%2520xmlns%253D%2522http://www.w3.org/2001/04/xmlenc%2523%2522%2520Id%253D%2522devicesoftware%2522%2520Type%253D%2522http://www.w3.org/2001/04/xmlenc%2523Element%2522%253E%253CEncryptionMethod%2520Algorithm%253 ... (1435) old
REG_SZ ct%3D1791328720%26hashalg%3DSHA256%26bver%3D22%26appid%3DDefault%26da%3D%253CEncryptedData%2520xmlns%253D%2522http://www.w3.org/2001/04/xmlenc%2523%2522%2520Id%253D%2522devicesoftware%2522%2520Type%253D%2522http://www.w3.org/2001/04/xmlenc%2523Element%2522%253E%253CEncryptionMethod%2520Algorithm%253 ... (1451) new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\IdentityCRL\Immersive\production\Property\ mod
01 00 00 00 01 00 00 00 d0 8c 9d df 01 15 d1 11
8c 7a 00 c0 4f c2 97 eb 01 00 00 00 db 95 6e df
77 f3 3f 47 b1 c8 95 3b bc 40 e8 d1 00 00 00 00
02 00 ... (346)
... (346)
0018801921667C6E REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\IdentityCRL\Immersive\production\Token\S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723\ mod
01 00 00 00 01 00 00 00 d0 8c 9d df 01 15 d1 11
8c 7a 00 c0 4f c2 97 eb 01 00 00 00 db 95 6e df
77 f3 3f 47 b1 c8 95 3b bc 40 e8 d1 00 00 00 00
02 00 ... (2986)
... (2938)
DeviceTicket REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\ActivityDataModel\ReaderRevisionInfo\ mod
2259DE09-A10D-947E-641F-56694FF2531D REG_MULTI_SZ 1㈷80†∠慄慴慢敳湉瑳湡散摉•›㤵ㄶⰶ †匢煥敵据≥㨠㌠㤸ⰸ †愢瑣癩瑩卹潴敲摉•›㈢㔲䐹ぅⴹㅁ䐰㤭㜴ⵅ㐶䘱㔭㘶㐹䙆㔲ㄳ≄ਬ†∠楦瑬牥•›†††椢剳慥䙤汩整≲㨠〠ਬ†††漢楲楧䙮汩整䭲祥•›ⰰ ††∠瑳瑡䙥汩整䭲祥•›ⰰ ††∠獵牥捁楴湯瑓瑡䙥汩整≲㨠〠 † old
REG_MULTI_SZ 1㈷80†∠慄慴慢敳湉瑳湡散摉•›㤵ㄶⰶ †匢煥敵据≥㨠㌠㌹ⰵ †愢瑣癩瑩卹潴敲摉•›㈢㔲䐹ぅⴹㅁ䐰㤭㜴ⵅ㐶䘱㔭㘶㐹䙆㔲ㄳ≄ਬ†∠楦瑬牥•›†††椢剳慥䙤汩整≲㨠〠ਬ†††漢楲楧䙮汩整䭲祥•›ⰰ ††∠瑳瑡䙥汩整䭲祥•›ⰰ ††∠獵牥捁楴湯瑓瑡䙥汩整≲㨠〠 † new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${acee881c-40d8-4c2f-b63e-fcc3351fd8e4}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap\Current\ mod
02 00 00 00 1d 8d 22 04 e8 55 dd 01 00 00 00 00
17 fb ab 98
43 42 01 00 0d 12 0a 15 28 50 00 7e 00 4d 00 49
00 43 00 52 00 4f 00 53 00 4f 00 46 00 54 00 2e
00 47 ... (2629)
... (2629)
Data REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-338387\ mod
04 00 00 00 fe 7f 00 00 e5 2b ae f1 c6 55 dd 01
36 bb 56 8b e8
fb 9b d4 78 e8 55 dd 01 fb fb c2 f1 c6 55 dd 01
b7 bb bb 7d 0a 56 b7 49 60 8b e8
00 00 00 00 00 00 00 00 70 f5 f2 f9 c6 55 dd 01
6b fa 89 9e e8
00 00 ... (92)
... (92)
(Default) REG_BINARY mod
04 00 00 00 00 00 00 00 fb fb c2 f1 c6 55 dd 01
02 00 02 00 00 00 00 00 57 fb cd 5a fb 54 dd 01
12 04 00 00
14
HealthEvaluation REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\GlobalSettings\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\GlobalSettings\ProperTreeModuleInner\ add
ProperTreeModuleInner REG_BINARY 9c 00 00 00 98 00 00 00 31 53 50 53 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 3b 00 00 00 2a 00 00 00 00 4e 00 61 00 76 00 50 00 61 00 6e 00 65 ... (160) add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU\ mod
3 REG_BINARY 50 00 72 00 6f 00 63 00 6d 00 6f 00 6e 00 36 00 34 00 2e 00 65 00 78 00 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ... (592) add
02 00 00 00 01 00 00 00 00 00 00 00 ff ff ff ff
03 02 01 00 00 00 00
ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU\ mod
3 REG_BINARY 50 00 72 00 6f 00 63 00 6d 00 6f 00 6e 00 36 00 34 00 2e 00 65 00 78 00 65 00 00 00 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 ... (252) add
01 00 00 00 02 00 00 00 00 00 00 00 ff ff ff ff
03 01 02 00 00 00 00
ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*\ mod
4 REG_BINARY 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 2e 80 3a cc bf b4 2c db 4c 42 b0 29 7f e9 9a 87 c6 41 50 00 31 00 00 00 00 00 28 57 ... (346) add
03 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00
04 03 02 01
ff ff ff ff
00 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\PML\ add
0 REG_BINARY 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 2e 80 3a cc bf b4 2c db 4c 42 b0 29 7f e9 9a 87 c6 41 50 00 31 00 00 00 00 00 28 57 ... (346) add
MRUListEx REG_BINARY 00 00 00 00 ff ff ff ff add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched\ mod
C:\Users\user\Desktop\tools\ProcessMonitor\Procmon64.exe REG_DWORD 0x00000003 (3) old
REG_DWORD 0x00000005 (5) new
C:\Users\user\Desktop\tools\SysTracer x64\SysTracer.exe REG_DWORD 0x00000005 (5) old
REG_DWORD 0x00000006 (6) new
Microsoft.Windows.Explorer REG_DWORD 0x0000001a (26) old
REG_DWORD 0x0000001c (28) new
wj32.ProcessHacker2 REG_DWORD 0x00000009 (9) old
REG_DWORD 0x0000000a (10) new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\OpenWithList\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\OpenWithProgids\ add
ProcMon.Logfile.1 REG_NONE add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\ mod
46 REG_BINARY 6d 00 69 00 6e 00 69 00 5f 00 72 00 75 00 6e 00 5f 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2e 00 50 00 4d 00 4c 00 00 00 86 00 32 00 00 00 00 00 00 00 ... (176) add
47 REG_BINARY 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 00 00 78 00 32 00 00 00 00 00 00 00 00 00 00 00 50 72 6f 63 65 73 ... (152) add
1e 00 00 00 2d 00 00 00 2c 00 00 00 01 00 00 00
2f 2e 1e 2d
2b 00 00 00 2a 00 00 00 29 00 00 00 23 00 00 00
2c 01 2b 2a
00 00 00 00 28 00 00 00 27 00 00 00 26 00 00 00
29 23 00 28
18 00 ... (188)
27 ... (196)
MRUListEx REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.PML\ add
0 REG_BINARY 6d 00 69 00 6e 00 69 00 5f 00 72 00 75 00 6e 00 5f 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2e 00 50 00 4d 00 4c 00 00 00 86 00 32 00 00 00 00 00 00 00 ... (176) add
MRUListEx REG_BINARY 00 00 00 00 ff ff ff ff add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\ mod
13 REG_BINARY 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 00 00 78 00 32 00 00 00 00 00 00 00 00 00 00 00 50 72 6f 63 65 73 ... (152) add
0c 00 00 00 00 00 00 00 0b 00 00 00 0a 00 00 00
0d 0c 00 0b
09 00 00 00 08 00 00 00 01 00 00 00 07 00 00 00
0a 09 08 01
06 00 00 00 03 00 00 00 04 00 00 00 05 00 00 00
07 06 03 04
02 00 ... (56)
05 ... (60)
MRUListEx REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001059A\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000020734\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000301FA\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000030598\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000604D8\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000704CE\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001204D8\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000001504D8\ add
VirtualDesktop REG_BINARY 10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\ mod
00 00 00 00 34 01 00 00 08 03 00 00 92 00 4c 01
35 13 a2 be 59
42 00 00 00 33 00 00 00 08 85 0f 00 7b 00 31 00
41 00 43 00 31 00 34 00 45 00 37 00 37 00 2d 00
30 00 ... (1612)
... (1612)
HRZR_PGYFRFFVBA REG_BINARY mod
00 00 00 00 09 00 00 00 25 00 00 00 81 a6 17 00
28 38 3f 1b
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 ... (72)
... (72)
jw32.CebprffUnpxre2 REG_BINARY mod
00 00 00 00 04 00 00 00 05 00 00 00 45 40 03 00
08 21 5b 09
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 ... (72)
... (72)
P:\Hfref\hfre\Qrfxgbc\gbbyf\CebprffZbavgbe\Cebpzba64.rkr REG_BINARY mod
00 00 00 00 04 00 00 00 07 00 00 00 59 ac 01 00
08 7b 4d 02
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 ... (72)
... (72)
P:\Hfref\hfre\Qrfxgbc\gbbyf\FlfGenpre k64\FlfGenpre.rkr REG_BINARY mod
P:\Hfref\hfre\Qrfxgbc\yno1\fep\TerlRaretlzvav.ova.rkr REG_BINARY 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 ... (72) add
00 00 00 00 37 00 00 00 f2 00 00 00 9f 11 65 00
f4 67 af
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf
00 00 ... (72)
... (72)
Zvpebfbsg.Jvaqbjf.Rkcybere REG_BINARY mod
{6Q809377-6NS0-444O-8957-N3773S02200R}\Cebprff Unpxre 2\crivrj.rkr REG_BINARY 00 00 00 00 00 00 00 00 02 00 00 00 93 cb 02 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 ... (72) add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState\ mod
PolicyState REG_DWORD 0x00000002 (2) old
REG_DWORD 0x00000000 (0) new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Search\ mod
InstalledWin32AppsRevision REG_SZ {5CEF7A98-A352-4BB5-B380-657640AF3944} old
REG_SZ {7D125EE5-D770-4EE6-B21B-81362BE20278} new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Search\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppsConstraintIndex\ mod
LatestConstraintIndexFolder REG_SZ C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{24759195-6ac6-4901-9b76-dff09b574094} old
REG_SZ C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c949c20-581f-4cbc-ad40-f40719b65741} new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\ mod
C:\Users\user\Desktop\lab1\src\GreyEnergymini.bin.exe REG_BINARY 53 41 43 50 01 00 00 00 00 00 00 00 07 00 00 00 28 00 00 00 03 d2 01 00 c2 73 02 00 01 00 00 00 00 00 00 00 00 00 01 06 71 02 00 00 63 1f 6e 6f 0e de ... (60) add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Sysinternals\Process Monitor\ mod
SaveDialog REG_BINARY 2c 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 58 00 00 00 75 00 00 00 38 02 00 00 06 02 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Applications\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Applications\rundll32.exe\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Applications\rundll32.exe\shell\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Applications\rundll32.exe\shell\open\ add
(Default) REG_DWORD 0x00000000 (0) add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\ mod
PCT REG_QWORD 03 33 5b 10 c7 55 dd 01 old
REG_QWORD 7c ac 7b 9e e8 55 dd 01 new
PTT REG_QWORD 00 31 67 10 c7 55 dd 01 old
REG_QWORD 93 b0 9a 9e e8 55 dd 01 new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\ mod
09 00 00 00 05 00 00 00 01 00 00 00 00 00 00 00
01 09 05
06 00 00 00 08 00 00 00 07 00 00 00 02 00 00 00
04 00 00 00 03 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
02 02 ... (94)
... (95)
NodeSlots REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\ mod
02 00 00 00 01 00 00 00 00 00 00 00 ff ff ff ff
01 02
MRUListEx REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\ mod
5 REG_BINARY 66 00 31 00 00 00 00 00 cc 56 7d 66 10 00 50 52 4f 43 45 53 7e 31 00 00 4e 00 09 00 04 00 ef be cc 56 7c 66 46 5d 47 b5 2e 00 00 00 96 a2 01 00 00 00 ... (104) add
01 00 00 00 03 00 00 00 04 00 00 00 02 00 00 00
05 01 03 04
00 00 00 00 ff ff ff ff
02 00 00 00 00 ff ff ff ff
MRUListEx REG_BINARY mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\5\ add
MRUListEx REG_BINARY ff ff ff ff add
NodeSlot REG_DWORD 0x0000005f (95) add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\ add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ add
ColInfo REG_BINARY 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 ... (136) add
FFlags REG_DWORD 0x00000001 (1) add
GroupByDirection REG_DWORD 0x00000001 (1) add
GroupByKey:FMTID REG_SZ {00000000-0000-0000-0000-000000000000} add
GroupByKey:PID REG_DWORD 0x00000000 (0) add
GroupView REG_DWORD 0x00000000 (0) add
IconSize REG_DWORD 0x00000010 (16) add
LogicalViewMode REG_DWORD 0x00000001 (1) add
Mode REG_DWORD 0x00000004 (4) add
Sort REG_BINARY 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\Shell\ add
SniffedFolderType REG_SZ Generic add
