What is bhoDirectPass32.dll?

bhoDirectPass32.dll is part of Trend Micro Password Manager and developed by Trend Micro Inc. according to the bhoDirectPass32.dll version information.

bhoDirectPass32.dll's description is "Trend Micro Password Manager browser add-on"

bhoDirectPass32.dll is digitally signed by Trend Micro, Inc..

bhoDirectPass32.dll is usually located in the 'C:\Program Files\Trend Micro\TMIDS\' folder.

None of the anti-virus scanners at VirusTotal reports anything malicious about bhoDirectPass32.dll.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on bhoDirectPass32.dll:

Property	Value
Product name	Trend Micro Password Manager
Company name	Trend Micro Inc.
File description	Trend Micro Password Manager browser add-on
Internal name	bhoDirectPass.dll
Original filename	bhoDirectPass.dll
Legal copyright	Copyright (C) 2018 Trend Micro Incorporated. All rights reserved.
Legal trademark	Copyright (C) Trend Micro Inc.
Private build	Build 1069 - 7/13/2018
Product version	3.8
File version	3.8.0.1069
Special build	1069

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product name	Trend Micro Password Manager
Company name	Trend Micro Inc.
File description	Trend Micro Password Manager browser..
Internal name	bhoDirectPass.dll
Original filename	bhoDirectPass.dll
Legal copyright	Copyright (C) 2018 Trend Micro Inc..
Legal trademark	Copyright (C) Trend Micro Inc.
Private build	Build 1069 - 7/13/2018
Product version	3.8
File version	3.8.0.1069
Special build	1069

Digital signatures [?]

bhoDirectPass32.dll has a valid digital signature.

Property	Value
Signer name	Trend Micro, Inc.
Certificate issuer name	VeriSign Class 3 Code Signing 2010 CA
Certificate serial number	60d927b542b7d1147fb2f0c4b9c1bbb2

VirusTotal report

None of the 63 anti-virus programs at VirusTotal detected the bhoDirectPass32.dll file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "regkey_written": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\0\\win32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\Version\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\NoExplorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Toolbar\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\Version\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\HELPDIR\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\Version\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\FLAGS\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\(Default)"
    ],
    "dll_loaded": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\e426db9f11d3c270362472c25928b117e07fea84e0def26e7e94dbcae45c56db.bin.dll",
        "ntmarta.dll",
        "kernel32.dll",
        "C:\\Windows\\system32\\kernel32.dll",
        "ADVAPI32.dll",
        "rpcrt4.dll"
    ],
    "file_opened": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\e426db9f11d3c270362472c25928b117e07fea84e0def26e7e94dbcae45c56db.bin.dll",
        "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
    ],
    "regkey_opened": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\Programmable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Toolbar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\Programmable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\FLAGS",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}",
        "HKEY_CLASSES_ROOT\\dllfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\HELPDIR",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Toolbar\\val",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}",
        "HKEY_CLASSES_ROOT\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\0\\win32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}",
        "HKEY_CLASSES_ROOT\\.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\Programmable",
        "HKEY_CURRENT_USER\\Interface",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}",
        "HKEY_CURRENT_USER\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects\\{782829FB-43A5-4AE0-A14E-590A252E7946}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\TypeLib"
    ],
    "mutex": [
        "DP_SHM_MUTEX"
    ],
    "file_read": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\e426db9f11d3c270362472c25928b117e07fea84e0def26e7e94dbcae45c56db.bin.dll"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\0\\win32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\HELPDIR\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\FLAGS\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\(Default)"
    ]
}

Generic

[
    {
        "process_path": "C:\\Windows\\SysWOW64\\regsvr32.exe",
        "process_name": "regsvr32.exe",
        "pid": 2420,
        "summary": {
            "regkey_written": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\0\\win32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\Version\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\NoExplorer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Toolbar\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\Version\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\HELPDIR\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\Version\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\FLAGS\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\(Default)"
            ],
            "dll_loaded": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\e426db9f11d3c270362472c25928b117e07fea84e0def26e7e94dbcae45c56db.bin.dll",
                "ntmarta.dll",
                "kernel32.dll",
                "C:\\Windows\\system32\\kernel32.dll",
                "ADVAPI32.dll",
                "rpcrt4.dll"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\e426db9f11d3c270362472c25928b117e07fea84e0def26e7e94dbcae45c56db.bin.dll",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\Programmable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Toolbar",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\Programmable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\FLAGS",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}",
                "HKEY_CLASSES_ROOT\\dllfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\HELPDIR",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Toolbar\\val",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}",
                "HKEY_CLASSES_ROOT\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\0\\win32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{782829FB-43A5-4AE0-A14E-590A252E7946}",
                "HKEY_CLASSES_ROOT\\.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\Programmable",
                "HKEY_CURRENT_USER\\Interface",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}",
                "HKEY_CURRENT_USER\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects\\{782829FB-43A5-4AE0-A14E-590A252E7946}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{97EE74D2-C351-4ECE-B75A-8CD36FAE3661}\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{FA5625E7-14A4-4135-9C75-1F4CE145E6F9}\\TypeLib"
            ],
            "mutex": [
                "DP_SHM_MUTEX"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\e426db9f11d3c270362472c25928b117e07fea84e0def26e7e94dbcae45c56db.bin.dll"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\0\\win32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\HELPDIR\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{05A76D87-35F6-433A-AC9B-05CCC166D3E2}\\1.0\\FLAGS\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D07C7B93-26F7-48E2-A126-7E83DFC8EBC8}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9D3344EF-A052-4AD4-B269-F63D9E58FB7B}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DA8083E8-441F-4653-8F3A-32B55D4C0897}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{E4ED22C8-A657-4A7A-9B55-40F1A41291D6}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D85AC099-463F-41C0-ABE0-F08E71FC2222}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{C9982099-06E7-4C41-B2A5-C15DBDC22EA9}\\(Default)"
            ]
        },
        "first_seen": 1599835987.84375,
        "ppid": 1268
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1599835987.53125,
        "ppid": 376
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "This executable has a PDB path",
        "severity": 1,
        "marks": [
            {
                "category": "pdb_path",
                "ioc": "D:\\DirectPass_3.5\\src\\win\\VC\\Win32\\Release\\IE_BHO\\bhoDirectPass32.pdb",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "has_pdb"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "system",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GlobalMemoryStatusEx",
                    "return_value": 1,
                    "arguments": {},
                    "time": 1599835987.96875,
                    "tid": 2460,
                    "flags": {}
                },
                "pid": 2420,
                "type": "call",
                "cid": 69
            }
        ],
        "references": [],
        "name": "antivm_memory_available"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "The file contains an unknown PE resource name possibly indicative of a packer",
        "severity": 1,
        "marks": [
            {
                "category": "resource name",
                "ioc": "REGISTRY",
                "type": "ioc",
                "description": null
            },
            {
                "category": "resource name",
                "ioc": "TYPELIB",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "pe_unknown_resource_name"
    },
    {
        "markcount": 4,
        "families": [],
        "description": "Allocates read-write-execute memory (usually to unpack itself)",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2420,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "base_address": "0x74b8c000"
                    },
                    "time": 1599835987.95275,
                    "tid": 2460,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2420,
                "type": "call",
                "cid": 11
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2420,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "base_address": "0x77311000"
                    },
                    "time": 1599835987.95275,
                    "tid": 2460,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2420,
                "type": "call",
                "cid": 13
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2420,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "base_address": "0x77b61000"
                    },
                    "time": 1599835987.95275,
                    "tid": 2460,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2420,
                "type": "call",
                "cid": 15
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2420,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "base_address": "0x74ad1000"
                    },
                    "time": 1599835987.96875,
                    "tid": 2460,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2420,
                "type": "call",
                "cid": 17
            }
        ],
        "references": [],
        "name": "allocates_rwx"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Installs a Browser Helper Object to thwart the users browsing experience",
        "severity": 3,
        "marks": [
            {
                "category": "bho_regkey",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\(Default)",
                "type": "ioc",
                "description": null
            },
            {
                "category": "bho_regkey",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects\\{782829FB-43A5-4AE0-A14E-590A252E7946}\\NoExplorer",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "installs_bho"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 662,
            "time": 6.221313953399658,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5190,
            "time": 6.159013032913208,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5518,
            "time": 4.1711108684539795,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5846,
            "time": 6.168083906173706,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6174,
            "time": 4.7984490394592285,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6502,
            "time": 3.0581789016723633,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 6830,
            "time": 4.72580099105835,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 15512,
            "time": 4.190592050552368,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 23896,
            "time": 6.247729063034058,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "e508db1f20792982f88efa1ef88d547242468ce42628b271e61ff3e13e7d79df",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "8ad2bec86d4c815d7d1586917d39e7ab1e992967a06d154cbd469f0b09e714d6",
    "irc": [],
    "https_ex": []
}

Screenshots

Hashes [?]

Property	Value
MD5	f615045ddaee430ce8b711a47b10a800
SHA256	e426db9f11d3c270362472c25928b117e07fea84e0def26e7e94dbcae45c56db

What will you do with the file?

To help other users, please let us know what you will do with the file:

Malware or legitimate?

If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.

Free online surveys

And now some shameless self promotion ;)

Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.

If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

No comments posted yet.

What is bhoDirectPass32.dll?

Vendor and version information [?]

Digital signatures [?]

VirusTotal report

Sandbox Report

Summary

Summary

Generic

Signatures

Yara

Network

Screenshots

Hashes [?]

What will you do with the file?

Malware or legitimate?

And now some shameless self promotion ;)

Comments

Leave a reply