Xcitium Cloud Verdict

File Name: Instalar.exe

File Type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

SHA1: 6ff269608201a97017590f0b7cc0081ad286ba3e

MD5: eb2906a84808343685b26df16297d100

Download Kill Chain Report

Accessed Files

C:\Users\user\AppData\Local\Temp\6ff269608201a97017590f0b7cc0081ad286ba3e.exe
C:\Windows\System32\UxTheme.dll.Config
C:\Windows\System32\uxtheme.dll
C:\Users\user\AppData\Local\Temp\6ff269608201a97017590f0b7cc0081ad286ba3e.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2
- C:\Windows\Fonts\staticcache.dat
- C:\Windows\win.ini
- C:\Users\user\AppData\Local\Temp\RarSFX0
- \Device\KsecDD
- C:
- C:\Users
- C:\Users\user
- C:\Users\user\AppData
- C:\Users\user\AppData\Local
- C:\Users\user\AppData\Local\Temp
- C:\Users\user\AppData\Local\Temp\RarSFX0\LOADER.EXE
- C:\Users\user\AppData\Local\Temp\RarSFX0\Instalador.exe
- C:\Users\user\AppData\Local\Temp\RarSFX0\INSTALAR.EXE
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH.EXE
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH01.DAT
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32INS.DAT
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32MAC.DAT
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32.zip
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH59VSE.zip
- C:\Users\user\AppData\Local\Temp\RarSFX0\WININET.ZIP
- C:\Users\user\AppData\Local\Temp\RarSFX0\LEEME.DOC
- C:\Users\user\AppData\Local\Temp\RarSFX0\DUNZIP32.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32WIN.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\THD32ENG.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\THD32MAC.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\instalar.ini
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH59UPD.INI
- \??\MountPointManager
- C:\Windows\Globalization\Sorting\sortdefault.nls
- C:\Users\user\AppData\Local\Temp\RarSFX0\wdmaud.drv
- C:\Windows\System32\wdmaud.drv
- C:\Windows\System32\en-US\wdmaud.drv.mui
- C:\Windows\System32\en-US\MMDevAPI.DLL.mui
Show More 33

Read Registry Keys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\DataStore_V1.0\DataFilePath
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane16
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\AutoSuggest
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\Always Use Tab
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave1
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave2
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave3
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave4
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave5
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave6
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave7
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave8
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave9
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi1
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi2
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi3
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi4
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi5
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi6
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi7
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi8
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi9
- HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wdmaud.drv
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
- HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{026e516e-b814-414b-83cd-856d6fef4822},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},6
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},1
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{1da5d803-d492-4edd-8c23-e0c0ffee7f0e},0
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Rpc\Extensions\NdrOleExtDLL
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{026e516e-b814-414b-83cd-856d6fef4822},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},6
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},1
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{1da5d803-d492-4edd-8c23-e0c0ffee7f0e},0
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{026e516e-b814-414b-83cd-856d6fef4822},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},6
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},1
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{1da5d803-d492-4edd-8c23-e0c0ffee7f0e},0
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wavemapper
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midimapper
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\DeviceState
- HKEY_CURRENT_USER\Software\Microsoft\Multimedia\Audio\UserDuckingPreference
Show More 80

Modified Files

C:\Users\user\AppData\Local\Temp\RarSFX0\LOADER.EXE
C:\Users\user\AppData\Local\Temp\RarSFX0\Instalador.exe
C:\Users\user\AppData\Local\Temp\RarSFX0\INSTALAR.EXE
C:\Users\user\AppData\Local\Temp\RarSFX0\TH.EXE
C:\Users\user\AppData\Local\Temp\RarSFX0\TH01.DAT
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32INS.DAT
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32MAC.DAT
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32.zip
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH59VSE.zip
- C:\Users\user\AppData\Local\Temp\RarSFX0\WININET.ZIP
- C:\Users\user\AppData\Local\Temp\RarSFX0\LEEME.DOC
- C:\Users\user\AppData\Local\Temp\RarSFX0\DUNZIP32.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32WIN.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\THD32ENG.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\THD32MAC.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\instalar.ini
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH59UPD.INI
Show More 12

Resolved APIs

kernel32.dll.CloseHandle
kernel32.dll.CompareStringA
kernel32.dll.CreateDirectoryA
kernel32.dll.CreateDirectoryW
kernel32.dll.CreateFileA
- kernel32.dll.CreateFileW
- kernel32.dll.DeleteFileA
- kernel32.dll.DeleteFileW
- kernel32.dll.DosDateTimeToFileTime
- kernel32.dll.ExitProcess
- kernel32.dll.ExpandEnvironmentStringsA
- kernel32.dll.FileTimeToLocalFileTime
- kernel32.dll.FileTimeToSystemTime
- kernel32.dll.FindClose
- kernel32.dll.FindFirstFileA
- kernel32.dll.FindFirstFileW
- kernel32.dll.FindNextFileA
- kernel32.dll.FindNextFileW
- kernel32.dll.FindResourceA
- kernel32.dll.FreeLibrary
- kernel32.dll.GetCPInfo
- kernel32.dll.GetCommandLineA
- kernel32.dll.GetCurrentDirectoryA
- kernel32.dll.GetCurrentProcess
- kernel32.dll.GetDateFormatA
- kernel32.dll.GetFileAttributesA
- kernel32.dll.GetFileAttributesW
- kernel32.dll.GetFileType
- kernel32.dll.GetFullPathNameA
- kernel32.dll.GetLastError
- kernel32.dll.GetLocaleInfoA
- kernel32.dll.GetModuleFileNameA
- kernel32.dll.GetModuleHandleA
- kernel32.dll.GetNumberFormatA
- kernel32.dll.GetProcAddress
- kernel32.dll.GetProcessHeap
- kernel32.dll.GetStdHandle
- kernel32.dll.GetTempPathA
- kernel32.dll.GetTickCount
- kernel32.dll.GetTimeFormatA
- kernel32.dll.GetVersionExA
- kernel32.dll.GlobalAlloc
- kernel32.dll.HeapAlloc
- kernel32.dll.HeapFree
- kernel32.dll.HeapReAlloc
- kernel32.dll.IsDBCSLeadByte
- kernel32.dll.LoadLibraryA
- kernel32.dll.LocalFileTimeToFileTime
- kernel32.dll.MoveFileA
- kernel32.dll.MoveFileExA
- kernel32.dll.MultiByteToWideChar
- kernel32.dll.ReadFile
- kernel32.dll.SetCurrentDirectoryA
- kernel32.dll.SetEndOfFile
- kernel32.dll.SetEnvironmentVariableA
- kernel32.dll.SetFileAttributesA
- kernel32.dll.SetFileAttributesW
- kernel32.dll.SetFilePointer
- kernel32.dll.SetFileTime
- kernel32.dll.SetLastError
- kernel32.dll.Sleep
- kernel32.dll.SystemTimeToFileTime
- kernel32.dll.WaitForSingleObject
- kernel32.dll.WideCharToMultiByte
- kernel32.dll.WriteFile
- kernel32.dll.lstrcmpiA
- kernel32.dll.lstrlenA
- advapi32.dll.AdjustTokenPrivileges
- advapi32.dll.LookupPrivilegeValueA
- advapi32.dll.OpenProcessToken
- advapi32.dll.RegCloseKey
- advapi32.dll.RegCreateKeyExA
- advapi32.dll.RegOpenKeyExA
- advapi32.dll.RegQueryValueExA
- advapi32.dll.RegSetValueExA
- advapi32.dll.SetFileSecurityA
- advapi32.dll.SetFileSecurityW
- comctl32.dll.#17
- comdlg32.dll.CommDlgExtendedError
- comdlg32.dll.GetOpenFileNameA
- gdi32.dll.DeleteObject
- ole32.dll.CLSIDFromString
- ole32.dll.CoCreateInstance
- ole32.dll.CreateStreamOnHGlobal
- ole32.dll.OleInitialize
- ole32.dll.OleUninitialize
- shell32.dll.SHBrowseForFolderA
- shell32.dll.SHChangeNotify
- shell32.dll.SHFileOperationA
- shell32.dll.SHGetFileInfoA
- shell32.dll.SHGetMalloc
- shell32.dll.SHGetSpecialFolderLocation
- shell32.dll.ShellExecuteExA
- shell32.dll.SHGetPathFromIDListA
- user32.dll.CharToOemBuffA
- user32.dll.CharUpperA
- user32.dll.CopyRect
- user32.dll.CreateWindowExA
- user32.dll.DefWindowProcA
- user32.dll.DestroyIcon
- user32.dll.DestroyWindow
- user32.dll.DialogBoxParamA
- user32.dll.DispatchMessageA
- user32.dll.EnableWindow
- user32.dll.EndDialog
- user32.dll.FindWindowExA
- user32.dll.GetClassNameA
- user32.dll.GetClientRect
- user32.dll.GetDlgItem
- user32.dll.GetDlgItemTextA
- user32.dll.GetMessageA
- user32.dll.GetParent
- user32.dll.GetSysColor
- user32.dll.GetSystemMetrics
- user32.dll.GetWindow
- user32.dll.GetWindowLongA
- user32.dll.GetWindowRect
- user32.dll.GetWindowTextA
- user32.dll.IsWindow
- user32.dll.IsWindowVisible
- user32.dll.LoadBitmapA
- user32.dll.LoadCursorA
- user32.dll.LoadIconA
- user32.dll.LoadStringA
- user32.dll.MapWindowPoints
- user32.dll.MessageBoxA
- user32.dll.OemToCharA
- user32.dll.OemToCharBuffA
- user32.dll.PeekMessageA
- user32.dll.PostMessageA
- user32.dll.RegisterClassExA
- user32.dll.SendDlgItemMessageA
- user32.dll.SendMessageA
- user32.dll.SetDlgItemTextA
- user32.dll.SetFocus
- user32.dll.SetMenu
- user32.dll.SetWindowLongA
- user32.dll.SetWindowPos
- user32.dll.SetWindowTextA
- user32.dll.ShowWindow
- user32.dll.TranslateMessage
- user32.dll.UpdateWindow
- user32.dll.WaitForInputIdle
- user32.dll.wsprintfA
- user32.dll.wvsprintfA
- comctl32.dll.InitCommonControlsEx
- ole32.dll.CoGetMalloc
- uxtheme.dll.ThemeInitApiHook
- user32.dll.IsProcessDPIAware
- dwmapi.dll.DwmIsCompositionEnabled
- comctl32.dll.RegisterClassNameW
- uxtheme.dll.EnableThemeDialogTexture
- uxtheme.dll.OpenThemeData
- uxtheme.dll.IsThemePartDefined
- uxtheme.dll.GetThemeMargins
- uxtheme.dll.GetThemeBool
- uxtheme.dll.GetThemeInt
- comctl32.dll.HIMAGELIST_QueryInterface
- comctl32.dll.DrawShadowText
- comctl32.dll.DrawSizeBox
- comctl32.dll.DrawScrollBar
- comctl32.dll.SizeBoxHwnd
- comctl32.dll.ScrollBar_MouseMove
- comctl32.dll.ScrollBar_Menu
- comctl32.dll.HandleScrollCmd
- comctl32.dll.DetachScrollBars
- comctl32.dll.AttachScrollBars
- comctl32.dll.CCSetScrollInfo
- comctl32.dll.CCGetScrollInfo
- comctl32.dll.CCEnableScrollBar
- comctl32.dll.QuerySystemGestureStatus
- uxtheme.dll.#49
- uxtheme.dll.CloseThemeData
- uxtheme.dll.SetWindowTheme
- uxtheme.dll.GetThemeFont
- uxtheme.dll.GetThemeColor
- imm32.dll.ImmIsIME
- gdi32.dll.GetLayout
- gdi32.dll.GdiRealizationInfo
- gdi32.dll.FontIsLinked
- advapi32.dll.RegOpenKeyExW
- advapi32.dll.RegQueryInfoKeyW
- gdi32.dll.GetTextFaceAliasW
- advapi32.dll.RegEnumValueW
- advapi32.dll.RegQueryValueExW
- gdi32.dll.GetFontAssocStatus
- advapi32.dll.RegEnumKeyExW
- gdi32.dll.GdiIsMetaPrintDC
- shlwapi.dll.SHAutoComplete
- ole32.dll.CoInitializeEx
- ole32.dll.CoUninitialize
- cryptbase.dll.SystemFunction036
- ole32.dll.CoRegisterInitializeSpy
- ole32.dll.CoRevokeInitializeSpy
- oleaut32.dll.#500
- setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
- setupapi.dll.CM_Get_Device_Interface_List_ExW
- kernel32.dll.VirtualAlloc
- kernel32.dll.VirtualFree
- user32.dll.SetClassLongA
- user32.dll.PostQuitMessage
- user32.dll.MessageBoxExA
- user32.dll.FindWindowA
- user32.dll.DrawAnimatedRects
- user32.dll.CreateDialogParamA
- kernel32.dll.ResumeThread
- kernel32.dll.ExitThread
- kernel32.dll.SetThreadPriority
- kernel32.dll.GetStartupInfoA
- kernel32.dll.WriteProcessMemory
- kernel32.dll.WaitForDebugEvent
- kernel32.dll.TerminateThread
- kernel32.dll.TerminateProcess
- kernel32.dll.SizeofResource
- kernel32.dll.LockResource
- kernel32.dll.LoadResource
- kernel32.dll.GlobalFree
- kernel32.dll.ContinueDebugEvent
- kernel32.dll.CreateProcessA
- kernel32.dll.CreateThread
- kernel32.dll.DebugActiveProcess
- kernel32.dll.GetExitCodeProcess
- kernel32.dll.GetExitCodeThread
- kernel32.dll.SuspendThread
- shell32.dll.ShellExecuteA
- comctl32.dll.InitCommonControls
- winmm.dll.waveOutClose
- winmm.dll.waveOutGetPosition
- winmm.dll.waveOutOpen
- winmm.dll.waveOutPause
- winmm.dll.waveOutPrepareHeader
- winmm.dll.waveOutReset
- winmm.dll.waveOutRestart
- winmm.dll.waveOutUnprepareHeader
- winmm.dll.waveOutWrite
- kernel32.dll.SortGetHandle
- kernel32.dll.SortCloseHandle
- sechost.dll.OpenSCManagerW
- sechost.dll.OpenServiceW
- sechost.dll.QueryServiceStatus
- sechost.dll.CloseServiceHandle
- rpcrt4.dll.RpcStringBindingComposeW
- rpcrt4.dll.RpcBindingFromStringBindingW
- rpcrt4.dll.RpcStringFreeW
- mmdevapi.dll.#3
- wdmaud.drv.DriverProc
- wdmaud.drv.modMessage
- wdmaud.drv.midMessage
- rpcrt4.dll.NdrClientCall2
- wdmaud.drv.wodMessage
- mmdevapi.dll.DllGetClassObject
- ole32.dll.CoCreateFreeThreadedMarshaler
- setupapi.dll.SetupDiCreateDeviceInfoList
- kernel32.dll.RegOpenKeyExW
- kernel32.dll.RegCloseKey
- wdmaud.drv.mxdMessage
- ole32.dll.CoTaskMemAlloc
- shlwapi.dll.#487
- ole32.dll.CoTaskMemFree
- ole32.dll.PropVariantClear
- setupapi.dll.SetupDiOpenDeviceInfoW
- setupapi.dll.SetupDiGetDeviceInstanceIdW
- setupapi.dll.SetupDiGetDevicePropertyW
- shlwapi.dll.SHStrDupW
- audioses.dll.DllGetClassObject
- ole32.dll.NdrOleInitializeExtension
- ole32.dll.CoGetClassObject
- ole32.dll.CoGetMarshalSizeMax
- ole32.dll.CoMarshalInterface
- ole32.dll.CoUnmarshalInterface
- ole32.dll.StringFromIID
- ole32.dll.CoGetPSClsid
- ole32.dll.CoReleaseMarshalData
- ole32.dll.DcomChannelSetHResult
- wdmaud.drv.widMessage
- msacm32.drv.DriverProc
- msacm32.drv.wodMessage
- msacm32.drv.widMessage
- midimap.dll.DriverProc
- midimap.dll.modMessage
- cfgmgr32.dll.CMP_RegisterNotification
- cfgmgr32.dll.CM_MapCrToWin32Err
- setupapi.dll.SetupDiGetClassDevsExW
- setupapi.dll.SetupDiEnumDeviceInfo
- setupapi.dll.CM_Get_DevNode_Status
- setupapi.dll.SetupDiEnumDeviceInterfaces
- setupapi.dll.SetupDiGetDeviceInterfaceDetailW
- uxtheme.dll.BufferedPaintInit
- uxtheme.dll.BufferedPaintRenderAnimation
- uxtheme.dll.BeginBufferedAnimation
- uxtheme.dll.IsThemeBackgroundPartiallyTransparent
- uxtheme.dll.DrawThemeParentBackground
- uxtheme.dll.DrawThemeBackground
- uxtheme.dll.GetThemeBackgroundContentRect
- uxtheme.dll.DrawThemeText
- gdi32.dll.GetTextExtentExPointWPri
- uxtheme.dll.EndBufferedAnimation
Show More 292

Registry Keys

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\DataStore_V1.0\Disable
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\DataStore_V1.0\DataFilePath
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Plane16
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\Segoe UI
- HKEY_CURRENT_USER
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
- HKEY_LOCAL_MACHINE\Software\Policies
- HKEY_CURRENT_USER\Software\Policies
- HKEY_CURRENT_USER\Software
- HKEY_LOCAL_MACHINE\Software
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\AutoSuggest
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\Always Use Tab
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\6ff269608201a97017590f0b7cc0081ad286ba3e.exe
- HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\KnownClasses
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d35f944c-ffec-11e6-bdeb-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c4-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c5-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\Data
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2400a2c6-ccb0-11e5-b7bd-806e6f6e6963}\Generation
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DRIVERS32
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave1
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave2
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave3
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave4
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave5
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave6
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave7
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave8
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave9
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi1
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi2
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi3
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi4
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi5
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi6
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi7
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi8
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi9
- HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm
- HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wdmaud.drv
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
- HKEY_LOCAL_MACHINE\System\Setup
- HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{026e516e-b814-414b-83cd-856d6fef4822},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},6
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},1
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\Properties\{1da5d803-d492-4edd-8c23-e0c0ffee7f0e},0
- HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Rpc\Extensions\NdrOleExtDLL
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{026e516e-b814-414b-83cd-856d6fef4822},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},6
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},1
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{d39cf7fb-6b16-44c3-a019-e218374ed1f1}\Properties\{1da5d803-d492-4edd-8c23-e0c0ffee7f0e},0
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{8afafb6a-f1b0-4935-be8a-5894d19191bd}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{026e516e-b814-414b-83cd-856d6fef4822},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},2
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},6
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc},1
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Capture\{8afafb6a-f1b0-4935-be8a-5894d19191bd}\Properties\{1da5d803-d492-4edd-8c23-e0c0ffee7f0e},0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Multimedia\MIDIMap
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wavemapper
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midimapper
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\MMDevices\Audio\Render\{455ff7ad-7149-49e1-9900-d5acc7fb67ed}\DeviceState
- HKEY_CURRENT_USER\Software\Microsoft\Multimedia\Audio
- HKEY_CURRENT_USER\Software\Microsoft\Multimedia\Audio\UserDuckingPreference
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\LOADER.EXE
- HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LanguagePack\SurrogateFallback\MS Sans Serif
Show More 124

Read Files

C:\Users\user\AppData\Local\Temp\6ff269608201a97017590f0b7cc0081ad286ba3e.exe
C:\Windows\System32\UxTheme.dll.Config
C:\Windows\System32\uxtheme.dll
C:\Windows\Fonts\staticcache.dat
C:\Windows\win.ini
- \Device\KsecDD
- C:\Users\user\AppData\Local\Temp\RarSFX0\LOADER.EXE
- C:\Users\user\AppData\Local\Temp\RarSFX0\Instalador.exe
- C:\Users\user\AppData\Local\Temp\RarSFX0\INSTALAR.EXE
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH.EXE
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH01.DAT
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32INS.DAT
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32MAC.DAT
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32.zip
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH59VSE.zip
- C:\Users\user\AppData\Local\Temp\RarSFX0\WININET.ZIP
- C:\Users\user\AppData\Local\Temp\RarSFX0\LEEME.DOC
- C:\Users\user\AppData\Local\Temp\RarSFX0\DUNZIP32.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH32WIN.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\THD32ENG.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\THD32MAC.DLL
- C:\Users\user\AppData\Local\Temp\RarSFX0\instalar.ini
- C:\Users\user\AppData\Local\Temp\RarSFX0\TH59UPD.INI
- C:\Windows\Globalization\Sorting\sortdefault.nls
- C:\Windows\System32\en-US\wdmaud.drv.mui
- C:\Windows\System32\en-US\MMDevAPI.DLL.mui
Show More 21

Mutexes

CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault1

Loading...