signature=0b27c655e30da254be058aa59e22d3b0,恶意软件分析 & URL链接扫描 免费在线病毒分析平台 | 魔盾安全分析...

C:\Windows\Globalization\Sorting\sortdefault.nls

C:\Users\test\AppData\Local\GDIPFONTCACHEV1.DAT

C:\Windows\Fonts\AGENCYR.TTF

C:\Windows\Fonts\simsun.ttc

C:\Users\test\AppData\Local\Temp\1cabaaa.tmp

C:\Windows\Fonts\msyh.ttf

C:\Windows\Fonts\msyhbd.ttf

C:\Windows\Globalization\Sorting\sortdefault.nls

C:\Users\test\AppData\Local\GDIPFONTCACHEV1.DAT

C:\Windows\Fonts\simsun.ttc

C:\Windows\Fonts\msyh.ttf

C:\Windows\Fonts\msyhbd.ttf

C:\Users\test\AppData\Local\GDIPFONTCACHEV1.DAT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts

HKEY_CURRENT_USER\Software\Microsoft\GDIPlus

HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath

HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance

HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\C_____________________1.4.2.1___.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3697C5FA-60DD-4B56-92D4-74A569205C16}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3FC47A08-E5C9-4BCA-A2C7-BC9A282AED14}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}

HKEY_CURRENT_USER

HKEY_CURRENT_USER\Keyboard Layout\Toggle

HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey

HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey

HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable

HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\KnownClasses

HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000804

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\a

HKEY_CURRENT_USER\Software\Microsoft\CTF\LayoutIcon\0804\00000804

HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable

HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey

HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey

HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000804

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\a

kernel32.dll.IsProcessorFeaturePresent

cryptbase.dll.SystemFunction036

kernel32.dll.SortGetHandle

kernel32.dll.SortCloseHandle

user32.dll.GetWindowInfo

user32.dll.GetAncestor

user32.dll.GetMonitorInfoA

user32.dll.EnumDisplayMonitors

user32.dll.EnumDisplayDevicesA

gdi32.dll.ExtTextOutW

gdi32.dll.GdiIsMetaPrintDC

msimg32.dll.AlphaBlend

gdi32.dll.CreateSolidBrush

user32.dll.LoadCursorA

gdiplus.dll.GdipCreateStringFormat

gdiplus.dll.GdipCreateFontFamilyFromName

kernel32.dll.RegOpenKeyExW

kernel32.dll.RegQueryInfoKeyA

kernel32.dll.RegCloseKey

kernel32.dll.RegCreateKeyExW

kernel32.dll.RegQueryValueExW

gdiplus.dll.GdipCreateFont

gdiplus.dll.GdipDeleteFontFamily

gdiplus.dll.GdipSetStringFormatAlign

gdiplus.dll.GdipSetStringFormatLineAlign

kernel32.dll.GetCurrentProcessId

user32.dll.RegisterClassExA

user32.dll.DefWindowProcA

gdi32.dll.CreateRectRgn

windowscodecs.dll.DllGetClassObject

kernel32.dll.WerRegisterMemoryBlock

gdi32.dll.SetRectRgn

kernel32.dll.GetProcessHeap

kernel32.dll.HeapAlloc

gdiplus.dll.GdipGraphicsClear

gdiplus.dll.GdipDrawImageRectI

gdiplus.dll.GdipCreateCachedBitmap

gdiplus.dll.GdipDeleteGraphics

gdiplus.dll.GdipDrawCachedBitmap

gdiplus.dll.GdipSetClipRectI

gdiplus.dll.GdipResetClip

user32.dll.SetWindowRgn

user32.dll.GetClassLongA

user32.dll.SetClassLongA

gdiplus.dll.GdipDrawImageRectRectI

user32.dll.GetWindowLongA

user32.dll.SetWindowLongA

user32.dll.SetWindowPos

ole32.dll.CoInitializeEx

ole32.dll.CoUninitialize

ole32.dll.CoRegisterInitializeSpy

ole32.dll.CoRevokeInitializeSpy

user32.dll.FillRect

gdi32.dll.SelectClipRgn

oleaut32.dll.#8

oleaut32.dll.#12

gdiplus.dll.GdipGetPropertyItemSize

gdiplus.dll.GdipGetPropertyItem

gdiplus.dll.GdipImageGetFrameCount

gdiplus.dll.GdipImageSelectActiveFrame

gdi32.dll.CombineRgn

gdi32.dll.FillRgn

gdiplus.dll.GdipDrawString

gdiplus.dll.GdipSetInterpolationMode

gdiplus.dll.GdipSetPixelOffsetMode

gdiplus.dll.GdipCreateHBITMAPFromBitmap

oleaut32.dll.SysAllocString

oleaut32.dll.SysStringLen

oleaut32.dll.SysFreeString

Local\MSCTF.Asm.MutexDefault1