C:\sample

imm32.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

C:\Windows\system32\uxtheme.dll

Wtsapi32.dll

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

APPHELP.dll

kernel32.dll

advapi32.dll

iphlpapi.dll

version.dll

netapi32.dll

wininet.dll

psapi.dll

wtsapi32.dll

shell32.dll

userenv.dll

ole32.dll

user32.dll

ntmarta.dll

SHFOLDER

comctl32.dll

propsys.dll

OLEAUT32.DLL

SXS.DLL

C:\Windows\system32\odbcint.dll

MSVCRT.DLL

dwmapi.dll

C:\Windows\system32\ole32.dll

C:\Windows\syswow64\MSCTF.dll

uxtheme.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\_isetup\_shfoldr.dll

shfolder.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_Log.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_SaleProcess.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_SaleProcess.ENU

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_SaleProcess.EN

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_VersionProcess.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_VersionProcess.ENU

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_VersionProcess.EN

Kernel32.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_AgentProcess.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_AgentProcess.ENU

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_AgentProcess.EN

comctl32

UxTheme.dll

C:\Windows\system32\imageres.dll

C:\Windows\system32\shell32.dll

RICHED20.DLL

API-MS-Win-Security-LSALookup-L1-1-0.dll

COMCTL32

KERNEL32

CRYPTBASE.dll

CRYPTSP.dll

SHLWAPI.dll

winhttp.dll

WS2_32.dll

SspiCli.dll

RPCRT4.dll

DNSAPI.dll

api-ms-win-core-synch-l1-2-0

kernel32

api-ms-win-core-fibers-l1-1-1

advapi32

api-ms-win-core-localization-l1-2-1

api-ms-win-appmodel-runtime-l1-1-1

ext-ms-win-kernel32-package-current-l1-1-0

KERNEL32.dll

VERSION.dll

USER32.dll

GDI32.dll

Secur32.dll

WINHTTP.dll

Iphlpapi.dll

C:\Users\win7\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\Microsoft Silverlight\sllauncher.exe

api-ms-win-downlevel-shlwapi-l2-1-0.dll

api-ms-win-downlevel-ole32-l1-1-0.dll

urlmon.dll

api-ms-win-downlevel-advapi32-l2-1-0.dll

IPHLPAPI.DLL

imageres.dll

msdialg100_D.dll

MFC90ENut.dll

Afx100net.dll

C:\Program Files\LZw59df\10aareHi64.dll

CRYPT32.dll

USERENV.dll

Comctl32.dll

C:\Windows\system32\ws2_32

dhcpcsvc.DLL

secur32.dll

ncrypt.dll

C:\Windows\system32\CRTDLL.DLL

C:\Windows\system32\ExplorerFrame.dll

ntdll.dll

PROPSYS.dll

OLEAUT32

msimg32.dll

C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18834_none_72d38c5186679d48\gdiplus.dll

MSHTML.dll

C:\Users\win7\AppData\Local\Temp\nsg3DD2.tmp\System.dll

msi.dll

IMM32.dll

API-MS-WIN-Service-Management-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

MMDevAPI.DLL

wdmaud.drv

MMDEVAPI.DLL

SETUPAPI.dll

AUDIOSES.DLL

msacm32.drv

midimap.dll

CFGMGR32.dll

KERNEL32.DLL

dbghelp.dll

rpcrt4.dll

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\System.dll

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\instutils

ws2_32.dll

API-MS-Win-Security-SDDL-L1-1-0.dll

shlwapi

C:\Users\win7\AppData\Local\Temp\0340bebd.a

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll

mscoree.dll

ntdll

MSVBVM60.DLL

user32

ntvdm64.dll

kernel32.DLL

SHLWAPI.DLL

SETUPAPI.DLL

SHELL32.DLL

WINHTTP.DLL

Cabinet.dll

DEVRTL.dll

shell32

crypt32

ws2_32

urlmon

ole32

C:\Windows\system32\DSOUND.dll

OLEACCRC.DLL

NSI.dll

PSAPI.DLL

C:\Windows\system32\asycfilt.dll

Tag

PNP_TDI

GlobalMaxTcpWindowSize

ProgramFilesDir

Disable

DataFilePath

Plane1

Plane2

Plane3

Plane4

Plane5

Plane6

Plane7

Plane8

Plane9

Plane10

Plane11

Plane12

Plane13

Plane14

Plane15

Plane16

CommonFilesDir

RegisteredOwner

RegisteredOrganization

MS Shell Dlg 2

ProcessID

EnablePrivateObjectHeap

ContextLimit

ObjectLimit

IdentifierLimit

InstallRoot

CLRLoadLogDir

OnlyUseLatestCLR

NoGuiFromShim

Install

Version

SP

MachineGUID

DigitalProductId

DigitalProductId4

PnpInstanceID

FrameTabWindow

FrameMerging

SessionMerging

AdminTabProcs

TabProcGrowth

CreateUriCacheSize

EnablePunycode

NavigationDelay

UrlEncoding

DisableSecuritySettingsCheck

SystemSetupInProgress

SyncMode5

FEATURE_CLIENTAUTHCERTFILTER

FromCacheTimeout

SecureProtocols

DisableKeepAlive

IdnEnabled

PreConnectLimit

PreResolveLimit

SqmHttpStreamRandomUploadPoolSize

CacheMode

EnableHttp1_1

ProxyHttp1.1

EnableNegotiate

DisableBasicOverClearChannel

ClientAuthBuiltInUI

DisableReadRange

SocketSendBufferLength

SocketReceiveBufferLength

KeepAliveTimeout

MaxHttpRedirects

MaxConnectionsPerServer

MaxConnectionsPer1_0Server

MaxConnectionsPerProxy

ServerInfoTimeout

ConnectTimeOut

ConnectRetries

SendTimeOut

ReceiveTimeOut

DisableNTLMPreAuth

ScavengeCacheLowerBound

CertCacheNoValidate

ScavengeCacheFileLifeTime

ScavengeCacheFileLimit

HttpDefaultExpiryTimeSecs

FtpDefaultExpiryTimeSecs

LeashLegacyCookies

SendExtraCRLF

WpadSearchAllDomains

DontUseDNSLoadBalancing

ShareCredsWithWinHttp

DnsCacheEnabled

DnsCacheEntries

DnsCacheTimeout

WarnOnPost

WarnAlwaysOnPost

WarnOnZoneCrossing

WarnOnBadCertRecving

WarnOnPostRedirect

AlwaysDrainOnRedirect

WarnOnHTTPSToHTTPRedirect

TcpAutotuning

BadProxyExpiresTime

AutoProxyDetectType

WpadOverride

DisableBranchCache

UseFirstAvailable

CombineFalseStartData

DisableFalseStartBlocklist

EnforceP3PValidity

DuoProtocols

EnableSpdyDebugAsserts

DefaultConnectionSettings

ProxyEnable

ProxyServer

ProxyOverride

AutoConfigURL

AutoDetect

SavedLegacySettings

<NULL>

Compatible

Platform

WpadDecision

WpadDecisionTime

WpadExpirationDays

UserContextLockCount

UserContextListCount

ClientSign

sample

TotalLimit

DomainLimit

RootDomainLimit

MaxSubDomains

No3DBorder

IsTextPlainHonored

ZoomDisabled

MinimumSystemTimerResolution

RenderingLoopMaxTime

RtfConverterFlags

Use_DlgBox_Colors

Anchor Underline

CSS_Compat

Expand Alt Text

Display Inline Images

Display Inline Videos

Play_Background_Sounds

Play_Animations

Print_Background

SmoothScroll

XMLHTTP

Show image placeholders

Disable Script Debugger

DisableScriptDebuggerIE

Disable Diagnostics Mode

Move System Caret

Enable AutoImageResize

UseHR

Q300829

Cleanup HTCs

XDomainRequest

DOMStorage

JScriptProfileCacheEventDelay

Default_CodePage

Default_IEFontSizePrivate

Anchor Color

Anchor Color Visited

Anchor Color Hover

Always Use My Colors

Always Use My Font Size

Always Use My Font Face

Disable Visited Hyperlinks

Use Anchor Hover Color

MiscFlags

Allow Programmatic Cut_Copy_Paste

DisableCachingOfSSLPages

950

IEFontSize

IEFontSizePrivate

IEPropFontName

IEFixedFontName

IESerifFontName

IESansSerifFontName

IEUIFontName

VML

IE

WindowsEdition

CLSID

NoProtectedModeBanner

ProtectedModeOffForAllZones

Win31FileSystem

AppData

eulaaccepted

GCStressStart

GCStressStartAtJit

DisableConfigCache

CacheLocation

DownloadCacheQuotaInKB

EnableLog

LoggingLevel

ForceLog

LogFailures

VersioningLog

LogResourceBinds

UseLegacyIdentityFormat

DisableMSIPeek

NoClientChecks

\\.\CtrlSM

C:\

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db

C:\Users\desktop.ini

C:\Users

C:\Users\win7

C:\Users\win7\AppData

C:\Users\win7\AppData\Local

C:\Users\win7\AppData\Local\Temp

C:\Users\win7\Desktop\desktop.ini

C:\Users\win7\Searches\desktop.ini

C:\Users\win7\Videos\desktop.ini

C:\Users\win7\Pictures\desktop.ini

C:\Users\win7\Contacts\desktop.ini

C:\Users\win7\Favorites\desktop.ini

C:\Users\win7\Music\desktop.ini

C:\Users\win7\Downloads\desktop.ini

C:\Users\win7\Documents\desktop.ini

C:\Windows\Fonts\staticcache.dat

C:\sample

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\_isetup\_RegDLL.tmp

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\_isetup\_setup64.tmp

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\_isetup\_shfoldr.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_Log.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_SaleProcess.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_VersionProcess.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_AgentProcess.dll

C:\Users\win7\AppData\Local\Temp\_MSI5166._IS

0x0000.ini

C:\Users\win7\AppData\Local\Temp\{371E4E0F-6D84-49E6-BFEF-DD450DE8FD1F}\Setup.INI

C:\ProgramData\48ed1695-d484-472b-bd42-582714ef1368\temp

C:\Windows\system32\rsaenh.dll

\\.\Nsi

C:\sample.config

C:\sample:typelib

C:\Windows\SysWOW64\stdole2.tlb

C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat

C:\_Setup.dll

CONIN$

CONOUT$

c:\sample

C:\Users\win7\AppData\Local\Temp\firstrunmagic.txt

\??\C:\Windows\system32\explorerframe.dll

C:\Windows\SysWOW64\ieframe.dll

C:\Users\Public\Documents\Wondershare\NFWCHK.exe

C:\Users\Public\Documents\Wondershare\DownTask_1323.xml

C:\Windows

C:\Users\win7\AppData\Local\Temp\nsf3BFC.tmp

C:\Users\win7\AppData\Local\Temp\nsg3DD2.tmp\System.dll

C:\Setup.INI

C:\0x0000.ini

C:\Windows\system32\perfmon.msc

C:\Windows\media\Windows Ding.wav

wdmaud.drv

\\.\pipe\GoogleCrashServices\S-1-5-21-3979321414-2393373014-2172761192-1000

22323.exe

C:\windows\temp\01221.exe

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\System.dll

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\GWDrvIns.cmd

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\instutils.dll

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\msvcp120.dll

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\msvcr120.dll

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\GWInstSt.exe

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\glasswire-sha1.cer

C:\Users\win7\AppData\Local\Temp\nsxD866.tmp\glasswire-sha256.cer

C:\ProgramData\9a4b8b26-f4e0-4529-a5b4-93ec828f7e42\temp

C:\Windows\System32\drivers\etc\services

C:\Users\win7\AppData\Local\Temp\0340bebd.a

C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config

C:\Users\win7\AppData\Local\Temp\\~DFF1C0E6523A771102.TMP

C:\Windows\nEwb0Rn.exe

C:\nEwb0Rn.exe

C:\Windows\system32\JawsOfLife.exe

C:\Windows\system32\WishfulThinking.exe

C:\Windows\system32\DamageControl.scr

C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

C:\Users\win7\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

C:\Users\win7\Local Settings\Application Data\WINDOWS\SERVICES.EXE

C:\about.htm

C:\nEwb0Rn\Folder.htt

C:\desktop.ini

C:\nEwb0Rn\New Folder.exe

C:\Download win7.exe

C:\MP3[NEW-RELEASE].exe

C:\Friendster Blog.exe

C:\StyleXP-WindowsVistaPack.exe

C:\Mini Games.exe

C:\Users\win7\AppData\Local\Temp\temp_cab_54711765.cab

C:\Users\win7\AppData\Local\Temp\sa.rtf

C:\ProgramData\219d5106-5a99-41fd-b942-db6b503b0178\temp

C:\Users\win7\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3979321414-2393373014-2172761192-1000\58b8aea4ae7184a912187a66498d9b0c_c4b6765a-c53d-4b48-b576-0e1db4e9f3bc

C:\Users\win7\AppData\Local\Temp\evb28FB.tmp

C:\Users\win7\AppData\Local\Temp\\~DFE794BF2314A59B15.TMP

SOFTWARE\Microsoft\OLEAUT

Software\Microsoft\Windows\CurrentVersion\Setup

Software\Microsoft\Windows\CurrentVersion

system\CurrentControlSet\control\NetworkProvider\HwOrder

SYSTEM\CurrentControlSet\Services\

SYSTEM\CurrentControlSet\Control\GroupOrderList

SYSTEM\CurrentControlSet\Services\Tdx

SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

SOFTWARE\Microsoft\Windows\CurrentVersion

Software

Classes

CLSID

SOFTWARE\Microsoft\BidInterface\Loader

SOFTWARE\ODBC\ODBC.INI\ODBC

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink

SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0

SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback

Segoe UI

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Software\Borland\Locales

Software\Borland\Delphi\Locales

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

SOFTWARE\Aimersoft\349

MS Sans Serif

Tahoma

Verdana

Software\Microsoft\Windows\CurrentVersion\Uninstall\Aimersoft Music Converter_is1

SOFTWARE\InstallShield\20.0\Professional

Software\InstallShield\ISWI\7.0\SetupExeLog

Software\Microsoft\WBEM\CIMOM

SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}

SOFTWARE\MiddleRush

Software\Microsoft\.NETFramework\Policy\

v2.0

Software\Microsoft\.NETFramework

Upgrades

Standards

AppPatch

Software\Microsoft\.NETFramework\Policy\Standards

v4.0.30319

Software\Microsoft\.NETFramework\Policy\Upgrades

SOFTWARE\Microsoft\CTF\Compatibility\sample

Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}

SOFTWARE\Microsoft\CTF\TIP\

{0000897b-83df-4b96-be07-0fb58b01c4a4}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{03B5835F-F03C-411B-9CE2-AA23E1171E36}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{07EB03D6-B001-41DF-9192-BF9B841EE71F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{3697C5FA-60DD-4B56-92D4-74A569205C16}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{AE6BE008-07FB-400D-8BEB-337A64F7051F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

Keyboard Layout\Toggle

Software\Microsoft\CTF\DirectSwitchHotkeys

SOFTWARE\Microsoft\CTF\

SOFTWARE\Microsoft\CTF\KnownClasses

troilite.gaddis.1

troilite.gaddis

CurVer

{25996d5b-fd76-4a61-9551-abae192ee731}

ProgID

VersionIndependentProgID

Programmable

LocalServer32

TypeLib

Version

SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322

SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5

SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full

SOFTWARE\Microsoft\NET Framework Setup\NDP\V4\Client

Software\Microsoft\Cryptography

SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{CFE68B1E-656A-488B-8077-738CA67BA3A5}\Connection

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Microsoft\Internet Explorer\Main

Software\Policies\Microsoft\Internet Explorer\Main

MS Shell Dlg 2

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl

Software\Microsoft\Internet Explorer\Main\FeatureControl

FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562

SOFTWARE\Microsoft\Internet Explorer\MAIN

FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615

Software\Policies

Microsoft\Windows\CurrentVersion\Internet Settings

FEATURE_IEDDE_REGISTER_PROTOCOL

Software\Microsoft\Internet Explorer\MediaTypeClass

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents

FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915

FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

FEATURE_BROWSER_COMPATDATA

FEATURE_BROWSER_EMULATION

FEATURE_DISABLE_INTERNAL_SECURITY_MANAGER

Software\Policies\Microsoft\Internet Explorer

Microsoft\Internet Explorer\Security

System\Setup

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\

FEATURE_LOCALMACHINE_LOCKDOWN

Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

FEATURE_HTTP_USERNAME_PASSWORD_DISABLE

RETRY_HEADERONLYPOST_ONCONNECTIONRESET

FEATURE_MIME_HANDLING

FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611

FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY

FEATURE_INCLUDE_PORT_IN_SPN_KB908209

FEATURE_BUFFERBREAKING_818408

FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954

FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289

FEATURE_USE_CNAME_FOR_SPN_KB911149

FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274

FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK

FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS

FEATURE_DIGEST_NO_EXTRAS_IN_URI

FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608

FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477

FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545

FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615

FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730

FEATURE_ENABLE_PROXY_CACHE_REFRESH_KB2983228

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266

FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543

FEATURE_SCH_SEND_AUX_RECORD_KB_2618444

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad

ISlogit

Software\Microsoft\Internet Explorer

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent

Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Pre Platform

Post Platform

Software\Policies\Microsoft\PeerDist\Service

Software\Microsoft\Windows NT\CurrentVersion\PeerDist\Service

{69DC4768-446B-4F82-A6B0-63966A243064}

Software\Wondershare

PROTOCOLS\Name-Space Handler\

PROTOCOLS\Name-Space Handler\about\

PROTOCOLS\Name-Space Handler\*\

FEATURE_GPU_RENDERING

FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120

FEATURE_ARIA_SUPPORT

FEATURE_LEGACY_DISPPARAMS

FEATURE_PRIVATE_FONT_SETTING

FEATURE_CSS_SHOW_HIDE_EVENTS

FEATURE_DISPLAY_NODE_ADVISE_KB833311

FEATURE_ALLOW_EXPANDURI_BYPASS

FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245

FEATURE_DATABINDING_SUPPORT

FEATURE_ENFORCE_BSTR

FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING

FEATURE_OBJECT_CACHING

FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW

FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454

FEATURE_DOWNLOAD_INITIATOR_HTTP_HEADER

FEATURE_MOBILE_CUSTOMIZATIONS

FEATURE_HIGH_RESOLUTION_AWARE

FEATURE_FORCE_DISABLE_UNTRUSTEDPROTOCOL

FEATURE_USE_WEBOC_OMNAVIGATOR_IMPLEMENTATION

FEATURE_USE_SECURITY_THUNKS

FEATURE_DISABLE_DEFERRED_IMAGE_DOWNLOAD

FEATURE_LAZY_IMAGE_DECODING

FEATURE_LAZIER_IMAGE_DECODING

FEATURE_ALLOW_INTRANET_CSS_MIME_MISMATCH

FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION

FEATURE_ENABLE_LARGER_HIT_TEST

FEATURE_USE_LEGACY_JSCRIPT

FEATURE_MOBILE_VIEWPORT_WIDTH_RESTRICTIONS

FEATURE_PASTE_IMAGE_DATAURI

FEATURE_NEW_TREE_VERIFICATION

FEATURE_MOBILE_DISPOSABLE_RESOURCE_CACHE_THRESHOLD_BYTES

FEATURE_DOCUMENT_COMPATIBLE_MODE

FEATURE_ENABLE_WEB_CONTROL_VISUALS

FEATURE_XDOMAINREQUEST

FEATURE_WEBSOCKET

FEATURE_USE_UNISCRIBE

FEATURE_PAINT_INSIDE_WMPAINT

FEATURE_SOFTWARE_FILTER_RENDERING

FEATURE_SPELLCHECKING

FEATURE_FORCE_NATURAL_TEXT_METRICS

FEATURE_ENABLE_PERFWIDGET_EXTRA_INFO

FEATURE_DISABLE_FORMAT_REUSE

FEATURE_ALLOW_WINDOW_PUTNAME_CROSS_DOMAIN

FEATURE_REDUCE_RENDER_AHEAD_CACHE

FEATURE_CLEANUP_AT_FLS

Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Software\Microsoft\Internet Explorer\Application Compatibility

Software\Policies\Microsoft\Internet Explorer\DOMStorage

Software\Microsoft\Internet Explorer\DOMStorage

FEATURE_MEMPROTECT_MODE

FEATURE_OLEALIAS_GWND

FEATURE_TOPMOST_GWND

FEATURE_RESTRICT_ABOUT_PROTOCOL_IE7

SOFTWARE\Classes\PROTOCOLS\Filter\text/html

FEATURE_MIME_SNIFFING

FEATURE_FEEDS

FEATURE_ENABLE_COMPAT_LOGGING

MIME\Database\Content Type\text/html

FEATURE_PROTOCOL_LOCKDOWN

FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS

Security\Floppy Access

Security\Adv AddrBar Spoof Detection

Software\Policies\Microsoft\Internet Explorer\Zoom

Zoom

FEATURE_WEBOC_DOCUMENT_ZOOM

FEATURE_NINPUT_LEGACYMODE

FEATURE_ALIGNED_TIMERS

FEATURE_VSYNC_WATCHDOG

FEATURE_ALLOW_HIGHFREQ_TIMERS

Main

FEATURE_SAFE_BINDTOOBJECT

International

Software\Policies\Microsoft\Internet Explorer\International\Scripts

Scripts

International\Scripts

Software\Policies\Microsoft\Internet Explorer\Settings

Settings

Styles

Text Scaling

Viewport

Larger Hit Test

Script

AdvancedOptions\DISAMBIGUATION

Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop

Software\Microsoft\Windows\CurrentVersion\Policies

Software\Microsoft\Internet Explorer\PageSetup

MenuExt

SYSTEM\CurrentControlSet\Control\Nls\CodePage

FEATURE_96DPI_PIXEL

FEATURE_RESTRICT_FILEDOWNLOAD

Software\Microsoft\Windows\CurrentVersion\Explorer\TravelLog

Version Vector

FEATURE_ZONE_ELEVATION

FEATURE_DISABLE_NAVIGATION_SOUNDS

Software\Policies\Microsoft\Internet Explorer\IEDevTools\Options

IEDevTools\Options

MIME\Database\Content Type\text/xml

FEATURE_XSSFILTER

FEATURE_PROCESS_XML_AS_HTML

Microsoft\Internet Explorer\Low Rights

FEATURE_READ_ZONE_STRINGS_FROM_REGISTRY

SOFTWARE\InstallShield\16.0\Professional

SYSTEM\CurrentControlSet\Control\FileSystem

Software\Policies\Microsoft\Windows\Installer

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\Google\Update\

Software\Google\UpdateDev\

Software\Google\Update\ClientState\

Software\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}

Software\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}

Software\CodeGear\Locales

System\CurrentControlSet\Control\Keyboard Layouts\041F0409

System\CurrentControlSet\Control\Keyboard Layouts\04090409

SOFTWARE\SearchKnow

Software\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}

Software\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NUIns

Software\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage

Software\Microsoft\Windows\CurrentVersion\Uninstall\ASPackage

Software\DtsEncodeTools

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherTool

Software\Microsoft\Windows\CurrentVersion\Uninstall\YSPackage

Software\Microsoft\Windows\CurrentVersion\Uninstall\Eppink

SOFTWARE\istartsurfSoftware\istartsurfhp

SOFTWARE\key-findSoftware\key-findhp

SOFTWARE\mystartsearchSoftware\mystartsearchhp

Software\GenericAddon

Software\SpeedChecker

Software\CheckMeUp

Software\CheckMeApp

Software\IneedSpeed

Software\SpeedCheck

Software\SpeeditUp

Software\BlockAndSurf

Software\Safer-Surf

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\NUIns

Software\Wow6432Node\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}

Software\Wow6432Node\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}

Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage

Software\AppDataLow\Software\GenericAddon

Software\AppDataLow\Software\SpeedChecker

Software\AppDataLow\Software\CheckMeUp

Software\AppDataLow\Software\CheckMeApp

Software\AppDataLow\Software\IneedSpeed

Software\AppDataLow\Software\SpeedCheck

Software\AppDataLow\Software\SpeeditUp

Software\AppDataLow\Software\BlockAndSurf

Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ASPackage

Software\AppDataLow\Software\Safer-Surf

Software\Wow6432Node\DtsEncodeTools

Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WeatherTool

Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YSPackage

Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Eppink

SOFTWARE\Wow6432Node\istartsurfSOFTWARE\Wow6432Node\istartsurfhp

SOFTWARE\Wow6432Node\key-findSOFTWARE\Wow6432Node\key-findhp

SOFTWARE\Wow6432Node\mystartsearchSOFTWARE\Wow6432Node\mystartsearchhp

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASPackage

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Eppink

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YSPackage

SOFTWARE\SearchProtect

software\Microsoft\idsc

software\Microsoft\{1f7ee1a8-4436-4ffc-b97b-b5b01e87d3d2}

software\Microsoft\idsc20

software\Microsoft\{7b6d6a5c-84cc-42db-b817-000a05728e99}

software\Microsoft\{94ebd7b5-82ae-449t-b679-3d04078ed154}

software\Microsoft\{99cfe81f-094e-46bf-9bf2-7523d2668544}

software\Microsoft\{cf50d5c9-de2c-44cf-9fc8-0c591c97f448}

software\Microsoft\{0f9bf30b-d979-431e-82a9-7ed45eee98c3}

Software\Nosibay\Bubble Dock Tag

Software\AVG

Software\McAfee

Software\Nosibay\Bubble Dock

SOFTWARE\Wow6432Node\MozillaPlugins\@qq.com/QQPCMgr

SOFTWARE\MozillaPlugins\@qq.com/QQPCMgr

SOFTWARE\Tencent

SOFTWARE\Wow6432Node\Tencent

v2.0.50727

Software\Microsoft\Fusion

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sample

.DEFAULT

SOFTWARE\SearchWebKnow

SOFTWARE\SecureWebChannel

Software\Microsoft\Windows\CurrentVersion\RunOnce

System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}

SOFTWARE\Clients\StartMenuInternet

<NULL>

EA63CFB9-62E6-4912-A1C5-AD8C4E1C5D05

Global\MiddleRush

Global\AmInst__Runing_1

Local\ZonesCacheCounterMutex

Local\ZonesLockedCacheCounterMutex

Local\MidiMapper_modLongMessage_RefCnt

RasPbFile

BELARUS-VIRUS-MAKER

Global\SearchKnow

Global\SearchWebKnow

Local\MSCTF.Asm.MutexDefault1

Aimersoft Music Converter

Global\MiddleRush

RasPbFile

Global\SearchKnow

Global\SearchWebKnow

C:\DLL_Loader.exe

C:\sample

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Au_.exe

C:\Windows\system32\MSVBVM60.DLL

C:\Windows\system32\ODBC32.dll

C:\Users\win7\AppData\Local\Temp\is-ANSFN.tmp\sample.tmp

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_SaleProcess.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_VersionProcess.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_AgentProcess.dll

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\syswow64\MSCTF.dll

C:\Windows\syswow64\USER32.dll

C:\Users\win7\AppData\Local\Temp\is-UQSD5.tmp\WS_Log.dll

C:\Windows\system32\RICHED20.DLL

C:\Windows\SYSTEM32\MSCOREE.DLL

C:\Windows\SysWOW64\ieframe.dll

!

!\sample

|!

C:\Windows\SysWOW64\schannel.dll

C:\Windows\system32\CRTDLL.DLL

C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18834_none_72d38c5186679d48\gdiplus.dll

C:\Windows\SysWOW64\mshtml.dll

C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll

C:\Users\win7\AppData\Local\Temp\is-DEUK4.tmp\sample.tmp

C:\Users\win7\AppData\Local\Tem

C:\Windows\system32\DSOUND.dll