634ad02f...c115 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 95/100
Dynamic Analysis Report
Classification: Trojan

634ad02fba5314a9c69334923a448c452550e08427ca7edb11d2d984eb66c115 (SHA256)

urkotu.exe

Windows Exe (x86-32)

Created at 2019-01-08 09:24:00

...

Notifications (1/1)

Code overwrite was observed during this analysis. Note that the analysis results may be affected by this modification by the sample.

Indicators

File (34)
»
Filename Hash Operations Source
C:\ComboFix - Access
C:\LinhaDefensiva - Access
C:\Program Files (x86) - Access
C:\Program Files (x86)\League of Legends - Access
C:\ProgramData - Access
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup - Access
C:\ProgramData\Task Protect 2.3 - Access
C:\ProgramData\Task Protect 2.3\kttkyovpa.txt MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3::
ImpHash: None 		Access Created File
C:\ProgramData\Task Protect 2.3\ws97995e1qms.exe - Access, Read
C:\ProgramData\Task Protect 2.3\ws97995e1qms.exe.config - Access
C:\ProgramData\Task Protect 2.3\ws97995e1qms.exe.manifest - Access
C:\ProgramData\Task Protect 2.3\ws97995e1qms.exe:Zone.Identifier - Access
C:\Users\CIiHmnxMn6Ps - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\.minecraft - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup - Access
C:\Users\CIiHmnxMn6Ps\Desktop\urkotu.exe MD5: 59706e1c7a11cc204a9be6b75cdf214b
SHA1: e12b557a77bb984674374109d99717eb97bc6429
SHA256: 634ad02fba5314a9c69334923a448c452550e08427ca7edb11d2d984eb66c115
SSDeep: 24576:MCdxte/80jYLT3U1jfsWaaFYbqukGmoBxcATQ0j:tw80cTsjkWaaxrA
ImpHash: None 		Access Sample File
C:\Users\CIiHmnxMn6Ps\Desktop\urkotu.exe:Zone.Identifier - Access
C:\Users\CIiHmnxMn6Ps\Documents - Access
C:\Users\CIiHmnxMn6Ps\jagexcache - Access
C:\Users\CIiHmnxMn6Ps\Music - Access
C:\Users\CIiHmnxMn6Ps\Pictures - Access
C:\Users\CIiHmnxMn6Ps\Videos - Access
C:\Users\CIIHMN~1\AppData\Local\Temp\11981D41.txt - Access
C:\Users\CIIHMN~1\AppData\Local\Temp\HouseCall - Access
C:\Windows\system32\drivers\prl_boot.sys - Access
C:\Windows\system32\drivers\vboxguest.sys - Access
C:\Windows\system32\drivers\vboxvideo.sys - Access
C:\Windows\system32\drivers\vmhgfs.sys - Access
C:\Windows\SYSTEM32\ntdll.dll - Access
C:\Windows\SysWOW64\explorer.exe - Access, Read
C:\Windows\SysWOW64\tapi3.dll - Access
\\.\HGFS - Access
\\.\VBoxGuest - Access
Registry (543)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\HTTP\shell\open\command Access, Read
HKEY_CLASSES_ROOT\jarfile\shell\open\command Access
HKEY_CURRENT_USER\Control Panel\Mouse Access
HKEY_CURRENT_USER\Control Panel\Mouse\SwapMouseButtons Read
HKEY_CURRENT_USER\SOFTWARE\Blizzard Entertainment Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Task Protect 2.3 Read, Write
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Task Protect 2.3 Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Google Updater Access
HKEY_CURRENT_USER\Software\AppDataLow\Google Updater\LastUpdate Write
HKEY_CURRENT_USER\Software\AppDataLow\Software Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\MyMailClient Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\{1C1C1C1C-1C1C-1C1C-1C1C-1C1C1C1C1C1C}\00101CF2\fd01153281ab2 Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1 Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\117ce5fb8f9407ebb4 Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\322f798102854 Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\322f798102854\d14736f3a3af25 Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\5559d2db9daca3e4ef7 Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\CW1 Delete
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02 Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\02693813c9e94ded Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\053351c4408b7c813 Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\0c5af5e4d37 Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\0d12757fbbf3 Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\41f5ddd483f58 Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\511df58c43fc0 Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\5615404c6cc999b Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\5ffd897d923e Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\66dfeeb3f4c63abca14 Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\7f9ca0f406c3b226 Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\8014f07ffab8a0f657 Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\820ee8cfcabdd7fb1 Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\9b98592ad9d1 Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\af65e3d3b62960 Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\cb7bbbee06636e5 Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\d4241b38e93732569 Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\d6a1c812c2 Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\dca28b911c Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\eb57aba56f848 Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\{2F917068-DC0D-ADE9-C564-77CBD67FE7B8}\11881FB1\e6577de29e95e38a02\ee74df3587 Read
HKEY_CURRENT_USER\Software\AutoIt v3\AutoIt Access
HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\TrendMicro\HijackThis Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Isolation Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner Write
HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default Access
HKEY_CURRENT_USER\Software\Microsoft\VisualStudio Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 Write
HKEY_CURRENT_USER\Software\Skype Access
HKEY_CURRENT_USER\Software\VMware, Inc. Access
HKEY_CURRENT_USER\Software\Valve\Steam Access
HKEY_CURRENT_USER\Software\Win7zip Access
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System Access
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS Access
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Read
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Access
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Read
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Read
HKEY_LOCAL_MACHINE\SOFTWARE\AdwCleaner Access
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\origin Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ws97995e1qms.exe Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ws97995e1qms.exe\Debugger Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ws97995e1qms.exe\DisableExceptionChainValidation Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Access
HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Spybot - Search & Destroy 2 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps Access
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\InstalledApps Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall Write
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall Write
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\.NET CLR Data Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\.NET CLR Networking Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\.NET CLR Networking 4.0.0.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\.NET Data Provider for Oracle Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\.NET Data Provider for SqlServer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\.NET Memory Cache 4.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\.NETFramework Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\1394ohci Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\3ware Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ACPI Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ADOVMPPackage Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ADP80XX Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AFD Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AJRouter Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ALG Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AcpiPmi Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AdobeARMservice Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AmdK8 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AmdPPM Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AppID Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AppIDSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AppMgmt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AppReadiness Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AppXSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Appinfo Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Apple Mobile Device Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AsyncMac Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AudioEndpointBuilder Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Audiosrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AxInstSV Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BDESVC Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BTHMODEM Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BTHPORT Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BasicDisplay Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BasicRender Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BattC Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Beep Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BrokerInfrastructure Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Browser Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BthAvrcpTg Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BthHFEnum Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BthHFSrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CDPSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CLFS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CNG Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\COMSysApp Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CSC Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CapImg Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CertPropSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ClickToRunSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ClipSVC Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CmBatt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CompositeBus Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CoreMessagingRegistrar Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CoreUI Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CryptSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CscService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DCLocator Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DPS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DXGKrnl Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DcomLaunch Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DcpSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DevQueryBroker Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DeviceAssociationService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DeviceInstall Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dfsc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dhcp Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DiagTrack Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DmEnrollmentSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DoSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DsSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DsmSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EFS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ESENT Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Eaphost Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EhStorClass Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EhStorTcgDrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EntAppSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ErrDev Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EventSystem Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FDResPub Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Fax Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FileCrypt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FileInfo Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Filetrace Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FltMgr Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FontCache3.0.0.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FsDepends Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Fs_Rec Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GPIOClx0101 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GpuEnergyDrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HDAudBus Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HdAudAddService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HidBatt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HidBth Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HidIr Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HidUsb Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HomeGroupListener Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HomeGroupProvider Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HpSAMD Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HyperVideo Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\IEEtwCollectorService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\IKEEXT Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\IPMIDRV Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\IPNAT Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\IRENUM Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\IoQos Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\IpFilterDriver Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\KSecDD Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\KSecPkg Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\KeyIso Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\KtmRm Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LSI_SAS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LSI_SAS2i Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LSI_SAS3i Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LSI_SSS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LSM Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LicenseManager Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Lsa Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MMCSS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MRxDAV Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSDTC Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSDTC Bridge 3.0.0.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSDTC Bridge 4.0.0.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSKSSRV Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSPCLOCK Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSPQM Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSSCNTRS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSTEE Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSiSCSI Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MTConfig Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MapsBroker Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Modem Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MozillaMaintenance Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MsBridge Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MsLldp Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MsRPC Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Msfs Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Mup Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\N360 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NAV Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NDIS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NETVSCVFPP Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NIS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NTDS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NTFS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NativeWifiP Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NcaSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NcbService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NcdAutoSetup Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NdisCap Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NdisImPlatform Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NdisTapi Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NdisVirtualBus Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NdisWan Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Ndisuio Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Ndu Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetSetupSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetTcpPortSharing Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetbiosSmb Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Netlogon Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Netman Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NgcCtnrSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NgcSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NlaSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Npfs Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Null Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\OneSyncSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\OneSyncSvc_Session1 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PEAUTH Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PNRPAutoReg Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PNRPsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Parport Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PcaSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PeerDistSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PerfDisk Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PerfHost Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PerfNet Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PerfOS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PerfProc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PimIndexMaintenanceSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PimIndexMaintenanceSvc_Session1 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PlugPlay Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PolicyAgent Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PortProxy Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Power Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PptpMiniport Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PrintNotify Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Processor Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ProfSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Psched Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\QWAVE Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\QWAVEdrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RDMANDK Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RDPDR Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RDPNP Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RDPUDD Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RapportMgmtService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasAcd Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasAgileVpn Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasAuto Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasPppoe Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasSstp Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Rasl2tp Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Razerlow Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RdpVideoMiniport Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ReFSv1 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RegFilter Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RemoteAccess Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RemoteRegistry Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RetailDemo Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcEptMapper Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcLocator Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcSs Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SCPolicySvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SCardSvr Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SDRSVC Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SENS Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SMSvcHost 3.0.0.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SMSvcHost 4.0.0.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMPTRAP Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SSDPSRV Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SamSs Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ScDeviceEnum Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Schedule Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SensorDataService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SensorService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SensrSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SerCx Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SerCx2 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Serenum Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Serial Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ServiceModelEndpoint 3.0.0.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ServiceModelOperation 3.0.0.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ServiceModelService 3.0.0.0 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SessionEnv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ShellHWDetection Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SiSRaid2 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SiSRaid4 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SmsRouter Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SpbCx Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Spooler Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SstpSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\StateRepository Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\StorSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Synth3dVsc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SysMain Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SystemEventsBroker Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TCPIP6TUNNEL Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TCPIPTUNNEL Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TPM Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TSDDD Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TabletInputService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TapiSrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip6 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TermService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Themes Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TimeBroker Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TrkWks Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TrustedInstaller Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TsUsbFlt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TsUsbGD Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UASPStor Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UEFI Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UGTHRSVC Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UGatherer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UI0Detect Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UcmCx0101 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UcmUcsi Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Ucx01000 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UdeCx Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Ufx01000 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UfxChipidea Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UmPass Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UmRdpService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UnistoreSvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UnistoreSvc_Session1 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UrsChipidea Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UrsCx01000 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\acpiex Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\acpipagr Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\acpitime Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\adsi Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\agp440 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ahcache Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\amdsata Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\amdsbs Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\amdxata Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\arcsas Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\atapi Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\b06bdrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bcmfn2 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bowser Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bthhfhid Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\bthserv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\buttonconverter Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cdfs Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cdrom Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\circlass Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\clr_optimization_v2.0.50727_32 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\clr_optimization_v2.0.50727_64 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\clr_optimization_v4.0.30319_32 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\clr_optimization_v4.0.30319_64 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cnghwassist Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\condrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\crypt32 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\dam Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\defragsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\dg_ssudbus Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\diagnosticshub.standardcollector.service Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\disk Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\dmvsc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\dmwappushservice Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\dot3svc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\drmkaud Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\e1iexpress Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ebdrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\embeddedmode Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\exfat Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\fastfat Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\fcvsc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\fdPHost Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\fdc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\fhsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\flpydisk Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\fvevol Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gagp30kx Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gencounter Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\genericusbfn Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gpsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gupdate Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gupdatem Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\hidi2c Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\hidinterrupt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\hidserv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\hwpolicy Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\hyperkbd Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\i8042prt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\iScsiPrt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\iaLPSSi_GPIO Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\iaLPSSi_I2C Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\iaStorAV Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\iaStorV Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ibbus Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\icssvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\inetaccs Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\intelide Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\intelpep Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\intelppm Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\iphlpsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\isapnp Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\kbdclass Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\kbdhid Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\kdnic Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ksthunk Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ldap Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\lfsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\lltdio Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\lltdsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\lmhosts Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\luafv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\megasas Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\megasr Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mlx4_bus Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\monitor Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mouclass Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mouhid Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mountmgr Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mpsdrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mrxsmb Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mrxsmb10 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mrxsmb20 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\msgpiowin32 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mshidkmdf Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mshidumdf Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\msisadrv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\msiserver Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mssmbios Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mvumis Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\napagent Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ndfltr Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ndiswanlegacy Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ndproxy Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\netprofm Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\netvsc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\npsvctrig Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nsi Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nsiproxy Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nv_agp Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nvraid Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nvstor Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ose64 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\p2pimsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\p2psvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\partmgr Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pci Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pciide Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pcmcia Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pcw Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pdc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\percsas2i Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\percsas3i Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pla Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\rdbss Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\rdpbus Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\rdyboost Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\rspndr Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\s3cap Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sbp2port Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\scfilter Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sdbus Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sdstor Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\seclogon Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sermouse Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sfloppy Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\smphost Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spaceport Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\srv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\srv2 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\srvnet Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\stexstor Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\stisvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\storahci Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\storflt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\stornvme Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\storqosflt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\storufs Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\storvsc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\svsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\swenum Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\swprv Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tcpipreg Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tdx Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\terminpt Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tiledatamodelsvc Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tunnel Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\uagp35 Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\udfs Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ufxsynopsys Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\uliagpkx Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\umbus Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\upnphost Access
HKEY_LOCAL_MACHINE\Software\Win7zip Access
Mutex (1)
»
Mutex Name Operations
{ergvvsvfxlybedyahvxbrbqcraka} Access
Domain (1)
»
Domain Sources
google.com Function Log
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image