registryActivity1

SetValue [37]
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	yftbufoz
valueDataSize	52
data
"C:\Windows\egocynug.exe"
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\PhishingFilter
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	EnabledV8
valueDataSize	4
data
00000000
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\PhishingFilter
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	EnabledV9
valueDataSize	4
data
00000000
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109A10090400000000000F01FEC\Usage
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	OutlookMAPI2Intl_1033
valueDataSize	4
data
4a710002
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_BINARY
value	SavedLegacySettings
valueDataSize	56
data
4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	ProxyEnable
valueDataSize	4
data
00000000
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109410000000000000000F01FEC\Usage
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	ProductFiles
valueDataSize	4
data
4a710013
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_MULTI_SZ
value	UISnapshot
valueDataSize	10
data
1033
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_MULTI_SZ
value	UIFallback
valueDataSize	10
data
1033
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	UILanguage
valueDataSize	4
data
00000409
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	HelpLanguage
valueDataSize	4
data
00000409
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	WinXPLanguagePatch
valueDataSize	4
data
00000001
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	InstallLanguage
valueDataSize	4
data
00000409
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	PreviousInstallLanguage
valueDataSize	4
data
00000409
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	WordChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	XLChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	WordMailChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	PPTChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	AccessChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	OutlookChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	PublisherChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	SharePointDesignerChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	ProjectChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	InfoPathChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	OneNoteChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	WebDesignerChangeInstallLanguage
valueDataSize	6
data
No
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	LangTuneUp
valueDataSize	32
data
OfficeCompleted
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources\EnabledLanguages
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_SZ
value	1033
valueDataSize	6
data
On
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	OfficeUILanguage
valueDataSize	4
data
00000409
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109A10090400000000000F01FEC\Usage
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	OutlookMAPI2Intl_1033
valueDataSize	4
data
4a710003
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_BINARY
value	DefaultConnectionSettings
valueDataSize	312
data
4600000002000000090000000000000000000000000000000400000000000000d02f66040e9fd201000000000000000000000000020000001700000000000000fe80000000000000406a399058641c260b0000000000000084515d7748a55c777030b073d9060000010000000000000000000000000000004000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000c0a80170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	UNCAsIntranet
valueDataSize	4
data
00000000
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	AutoDetect
valueDataSize	4
data
00000001
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	UNCAsIntranet
valueDataSize	4
data
00000000
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	AutoDetect
valueDataSize	4
data
00000001
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	UNCAsIntranet
valueDataSize	4
data
00000000
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
valueType	REG_DWORD
value	AutoDetect
valueDataSize	4
data
00000001

CreateKey [17]
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\PhishingFilter
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\MACHINE\SOFTWARE\CLASSES
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\12.0\Common\LanguageResources\EnabledLanguages
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)

OpenKey [46]
key	\REGISTRY\USER\S-1-5-21-3558273304-2305715256-1486658336-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\ehgccf\lbtpt.exe
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3558273304-2305715256-1486658336-1000
process	C:\ehgccf\lbtpt.exe
key	\REGISTRY\USER\S-1-5-21-3558273304-2305715256-1486658336-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\ehgccf\lbtpt.exe
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
process	C:\ehgccf\lbtpt.exe
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\my\PhysicalStores
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\my
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\my
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My\(null)
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My\Certificates
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My\CRLs
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My\CTLs
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Account Manager\Accounts\00000001
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
key	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)

QueryValue [11]
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography
process	C:\ehgccf\lbtpt.exe
value	MachineGuid
valueType	REG_SZ
data
ifssnbmrwbhyuarhuongwmjyhwfnwjgltvwc
valueDataSize	74
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
process	C:\ehgccf\lbtpt.exe
value	DigitalProductId
valueType
data
valueDataSize	0
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
process	C:\ehgccf\lbtpt.exe
value	DigitalProductId
valueType	REG_BINARY
data
a40000000300000030303337312d4f454d2d383939323637312d303030303400b20000005831352d3337333737000000000000006b6e4c3672eafba98ab7f626e62f04000000000007e19455fa0ff2b40200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000daf210c8
valueDataSize	164
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
process	C:\ehgccf\lbtpt.exe
value	InstallDate
valueType	REG_DWORD
data
5595bfe3
valueDataSize	4
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography
process	C:\ehgccf\lbtpt.exe
value	MachineGuid
valueType	REG_SZ
data
ifssnbmrwbhyuarhuongwmjyhwfnwjgltvwc
valueDataSize	74
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
value	MachineGuid
valueType	REG_SZ
data
ifssnbmrwbhyuarhuongwmjyhwfnwjgltvwc
valueDataSize	74
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
value	DigitalProductId
valueType
data
valueDataSize	0
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
value	DigitalProductId
valueType	REG_BINARY
data
a40000000300000030303337312d4f454d2d383939323637312d303030303400b20000005831352d3337333737000000000000006b6e4c3672eafba98ab7f626e62f04000000000007e19455fa0ff2b40200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000daf210c8
valueDataSize	164
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
value	InstallDate
valueType	REG_DWORD
data
5595bfe3
valueDataSize	4
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
value	MachineGuid
valueType	REG_SZ
data
ifssnbmrwbhyuarhuongwmjyhwfnwjgltvwc
valueDataSize	74
key	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography
process	C:\Windows\explorer.exe (v. 6.1.7601.17514)
value	MachineGuid
valueType	REG_SZ
data
ifssnbmrwbhyuarhuongwmjyhwfnwjgltvwc
valueDataSize	74