parsfoki.blogg.se

"dw20.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5 Subtree: 38534401) "dw20.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5 Subtree: 38528769) "dw20.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5 Subtree: 38534401) "dw20.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5 Subtree: 38534401) "dw20.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4 Subtree: 38534400) "dw20.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1 Subtree: 2902272) "dw20.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1 Subtree: 2902272) "dw20.exe" queried SystemProcessInformation at 00012647-00003512-00000033-56665488Ĭreates guarded memory regions (anti-debugging trick to avoid memory dumping)