Process Name,Operation,Path,Result,Detail
DistantWorlds.exe,RegOpenKey,HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Session Manager\Segment Heap,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\SYSTEM\CurrentControlSet\Control\Session Manager,REPARSE,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Session Manager\ResourcePolicies,NAME NOT FOUND,Length: 24
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows,SUCCESS,"Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFile,C:\Windows\System32\wow64log.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows,SUCCESS,"Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryNameInformationFile,C:\Windows,SUCCESS,Name: \Windows
DistantWorlds.exe,CloseFile,C:\Windows,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\Software\Microsoft\Wow64\x86,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Wow64\x86\DistantWorlds.exe,NAME NOT FOUND,Length: 520
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Wow64\x86\(Default),SUCCESS,"Type: REG_SZ, Length: 26, Data: wow64cpu.dll"
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Wow64\x86,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Session Manager\Segment Heap,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\SYSTEM\CurrentControlSet\Control\Session Manager,REPARSE,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Session Manager\ResourcePolicies,NAME NOT FOUND,Length: 24
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,
DistantWorlds.exe,CreateFile,D:\Steam\SteamApps\common\Distant Worlds Universe,SUCCESS,"Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\3c74afb9-8d82-44e3-b52c-365dbf48382a,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,Name: \Windows\SysWOW64\KernelBase.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\05f95efe-7f75-49c7-a994-60a55cc09571,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,Name: \Windows\SysWOW64\KernelBase.dll
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\SafeBoot\Option,REPARSE,"Desired Access: Query Value, Set Value"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\SafeBoot\Option,NAME NOT FOUND,"Desired Access: Query Value, Set Value"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Srp\GP\DLL,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Srp\GP\DLL,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Policies\Microsoft\Windows\Safer\CodeIdentifiers,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled,NAME NOT FOUND,Length: 80
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\FileSystem\,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\FileSystem,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\FileSystem,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\FileSystem\LongPathsEnabled,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 0"
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\FileSystem,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\(Default),SUCCESS,"Type: REG_SZ, Length: 18, Data: 0006020E"
DistantWorlds.exe,RegOpenKey,HKLM\SYSTEM\CurrentControlSet\Control\Session Manager,REPARSE,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Session Manager\ResourcePolicies,NAME NOT FOUND,Length: 24
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:09 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,"Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\imm32.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,"AllocationSize: 143,360, EndOfFile: 143,152, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\imm32.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\Enabled,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 0"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Lsa,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Lsa,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Lsa,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy,NAME NOT FOUND,Length: 20
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 0"
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy,SUCCESS,
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Lsa,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\a6d3c9ac-9128-522a-495a-1821191173c2,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\sspicli.dll,SUCCESS,Name: \Windows\SysWOW64\sspicli.dll
DistantWorlds.exe,RegOpenKey,HKLM,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: Read"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\OLE,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Ole\PageAllocatorUseSystemHeap,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\OLE,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Ole\PageAllocatorSystemHeapIsPrivate,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\OLE,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Ole\AggressiveMTATesting,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegOpenKey,HKLM,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x100"
DistantWorlds.exe,RegOpenKey,HKLM\Software\Microsoft\Ole\FeatureDevelopmentProperties,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x100"
DistantWorlds.exe,RegOpenKey,HKLM\Software\Microsoft\Ole\FeatureDevelopmentProperties,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x100"
DistantWorlds.exe,RegOpenKey,HKLM\Software\Microsoft\Ole,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCU,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCU,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,"Query: HandleTags, HandleTags: 0x100"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Local Settings,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Local Settings,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegCloseKey,HKCU,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes\Local Settings,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes\Local Settings,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Local Settings\Software\Microsoft\Ole\FeatureDevelopmentProperties,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes\Local Settings,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes\Local Settings,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Local Settings\Software\Microsoft\Ole\FeatureDevelopmentProperties,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes\Local Settings,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes\Local Settings,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Local Settings\Software\Microsoft\Ole,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes\Local Settings,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes\Local Settings,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Local Settings\Software\Microsoft,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCU\Software\Classes\Local Settings\Software\Microsoft,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Microsoft\OLE\Tracing,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Ole\Tracing,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\1aff6089-e863-4d36-bdfd-3581f07440be,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\combase.dll,SUCCESS,Name: \Windows\SysWOW64\combase.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\f0558438-f56a-5987-47da-040ca75aef05,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\combase.dll,SUCCESS,Name: \Windows\SysWOW64\combase.dll
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:09 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:09 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\imm32.dll,SUCCESS,
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\f25bcd2e-2690-55dc-3bc4-07b65b1b41c9,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\user32.dll,SUCCESS,Name: \Windows\SysWOW64\user32.dll
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Policies\Microsoft\Windows\Display,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Policies\Microsoft\Windows\Display,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options,REPARSE,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options,SUCCESS,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options,SUCCESS,"Query: HandleTags, HandleTags: 0x400"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DistantWorlds.exe,NAME NOT FOUND,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Policies\Microsoft\Windows\Display,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Policies\Microsoft\Windows\Display,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles,NAME NOT FOUND,Length: 20
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKCU\Control Panel\Desktop,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegQueryValue,HKCU\Control Panel\Desktop\EnablePerProcessSystemDPI,NAME NOT FOUND,Length: 520
DistantWorlds.exe,RegCloseKey,HKCU\Control Panel\Desktop,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Compatibility32,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Compatibility32\DistantWorlds,NAME NOT FOUND,Length: 172
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Compatibility32,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\IME Compatibility,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 0"
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options,SUCCESS,"Query: HandleTags, HandleTags: 0x400"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DistantWorlds.exe,NAME NOT FOUND,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\30336ed4-e327-447c-9de0-51b652c86108,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\windows.storage.dll,SUCCESS,Name: \Windows\SysWOW64\windows.storage.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\b87cf16b-0bf8-4492-a510-d5f59626b033,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\windows.storage.dll,SUCCESS,Name: \Windows\SysWOW64\windows.storage.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\a40b455c-253c-4311-ac6d-6e667edccefc,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\windows.storage.dll,SUCCESS,Name: \Windows\SysWOW64\windows.storage.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\703fcc13-b66f-5868-ddd9-e2db7f381ffb,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\windows.storage.dll,SUCCESS,Name: \Windows\SysWOW64\windows.storage.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\32980f26-c8f5-5767-6b26-635b3fa83c61,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\windows.storage.dll,SUCCESS,Name: \Windows\SysWOW64\windows.storage.dll
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\30336ed4-e327-447c-9de0-51b652c86108,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\shell32.dll,SUCCESS,Name: \Windows\SysWOW64\shell32.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\b87cf16b-0bf8-4492-a510-d5f59626b033,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\shell32.dll,SUCCESS,Name: \Windows\SysWOW64\shell32.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\32980f26-c8f5-5767-6b26-635b3fa83c61,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\shell32.dll,SUCCESS,Name: \Windows\SysWOW64\shell32.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\703fcc13-b66f-5868-ddd9-e2db7f381ffb,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\shell32.dll,SUCCESS,Name: \Windows\SysWOW64\shell32.dll
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Microsoft\OLE\Tracing,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Ole\Tracing,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\1aff6089-e863-4d36-bdfd-3581f07440be,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\ole32.dll,SUCCESS,Name: \Windows\SysWOW64\ole32.dll
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\f0558438-f56a-5987-47da-040ca75aef05,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\ole32.dll,SUCCESS,Name: \Windows\SysWOW64\ole32.dll
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\oleaut32.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\oleaut32.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:13 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\oleaut32.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\oleaut32.dll,SUCCESS,"Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\oleaut32.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\oleaut32.dll,SUCCESS,"AllocationSize: 593,920, EndOfFile: 593,536, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\oleaut32.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\oleaut32.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\ole32.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\ole32.dll,SUCCESS,"CreationTime: 5/01/2018 6:53:17 PM, LastAccessTime: 5/01/2018 6:53:17 PM, LastWriteTime: 1/01/2018 9:42:32 PM, ChangeTime: 5/01/2018 8:03:05 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\ole32.dll,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\OLEAUT,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Session Manager,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode,NAME NOT FOUND,Length: 16
DistantWorlds.exe,QueryOpen,D:\Steam\SteamApps\common\Distant Worlds Universe\bxsdk32.dll,NAME NOT FOUND,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\System\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,QueryOpen,D:\Steam\SteamApps\common\Distant Worlds Universe\bxsdk32.dll,NAME NOT FOUND,
DistantWorlds.exe,CreateFile,C:\Program Files\NVIDIA GPU Computing Toolkit\CUDA\v9.0\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\NVIDIA GPU Computing Toolkit\CUDA\v9.0\libnvvp\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\ProgramData\Oracle\Java\javapath_target_448718\bxsdk32.dll,REPARSE,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>"
DistantWorlds.exe,CreateFile,C:\ProgramData\Oracle\Java\javapath_target_448718\BXSDK32.DLL,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\wbem\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\WindowsPowerShell\v1.0\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\wamp\bin\php\php5.5.12\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\ProgramData\ComposerSetup\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\wbem\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\WindowsPowerShell\v1.0\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Git\cmd\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Ruby21\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\AppData\Roaming\Composer\vendor\drush\drush\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\cygwin64\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\wamp\bin\mysql\mysql5.6.17\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Common Files\Autodesk Shared\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Autodesk\Backburner\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\QuickTime\QTSystem\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\opscode\chefdk\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\.dnx\bin\bxsdk32.dll,PATH NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft DNX\Dnvm\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft SQL Server\130\Tools\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\HashiCorp\Vagrant\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\GtkSharp\2.12\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Skype\Phone\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\nodejs\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\110\Tools\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Microsoft SQL Server\120\Tools\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft SQL Server\120\Tools\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft SQL Server\120\DTS\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\sK1 Project\UniConvertor-1.1.5\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\sK1 Project\UniConvertor-1.1.5\DLLs\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Ruby21\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Scapple\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\AppData\Local\atom\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\AppData\Local\Microsoft\WindowsApps\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\AppData\Roaming\npm\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Microsoft\Rpc,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Rpc,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Rpc,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Rpc\MaxRpcSize,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Rpc,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName,SUCCESS,"Type: REG_SZ, Length: 14, Data: SATURN"
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\Setup,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SYSTEM\Setup,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SYSTEM\Setup\OOBEInProgress,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 0"
DistantWorlds.exe,RegCloseKey,HKLM\SYSTEM\Setup,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\Setup,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SYSTEM\Setup,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SYSTEM\Setup\SystemSetupInProgress,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 0"
DistantWorlds.exe,RegCloseKey,HKLM\SYSTEM\Setup,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options,SUCCESS,"Query: HandleTags, HandleTags: 0x400"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DistantWorlds.exe,NAME NOT FOUND,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Policies\Microsoft\Windows NT\Rpc,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Rpc,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Microsoft\Rpc,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Rpc,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Rpc,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Rpc\IdleTimerWindow,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Rpc,SUCCESS,
DistantWorlds.exe,QueryOpen,D:\Steam\SteamApps\common\Distant Worlds Universe\sxs.dll,NAME NOT FOUND,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\sxs.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\sxs.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:23 PM, LastAccessTime: 29/09/2017 11:42:23 PM, LastWriteTime: 29/09/2017 11:42:23 PM, ChangeTime: 30/10/2017 1:51:09 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\sxs.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\sxs.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\sxs.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\sxs.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\sxs.dll,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\CustomLocale,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Nls\CustomLocale,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\CustomLocale\EMPTY,NAME NOT FOUND,Length: 120
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\CustomLocale\EMPTY,NAME NOT FOUND,Length: 120
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\NLS\Language,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\NLS\Language,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Nls\Language,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\Language\InstallLanguageFallback,BUFFER OVERFLOW,Length: 16
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Nls\Language,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegEnumKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages,SUCCESS,"Index: 0, Name: en-GB"
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages,SUCCESS,"Query: HandleTags, HandleTags: 0x400"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB\Type,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 274"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB\DefaultFallback,SUCCESS,"Type: REG_SZ, Length: 12, Data: en-US"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB\en-US,SUCCESS,"Type: REG_MULTI_SZ, Length: 4, Data: "
DistantWorlds.exe,RegEnumValue,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB,SUCCESS,"Index: 0, Name: DefaultFallback, Type: REG_SZ, Length: 12, Data: en-US"
DistantWorlds.exe,RegEnumValue,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB,SUCCESS,"Index: 1, Name: en-US, Type: REG_MULTI_SZ, Length: 4, Data: "
DistantWorlds.exe,RegEnumValue,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB,SUCCESS,"Index: 2, Name: LCID, Type: REG_DWORD, Length: 4, Data: 2057"
DistantWorlds.exe,RegEnumValue,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB,SUCCESS,"Index: 3, Name: Type, Type: REG_DWORD, Length: 4, Data: 274"
DistantWorlds.exe,RegEnumValue,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB,NO MORE ENTRIES,"Index: 4, Length: 512"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB\AlternateCodePage,NAME NOT FOUND,Length: 12
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\en-GB,SUCCESS,
DistantWorlds.exe,RegEnumKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages,NO MORE ENTRIES,"Index: 1, Length: 512"
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Policies\Microsoft\MUI\Settings,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Policies\Microsoft\MUI\Settings,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCU,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: All Access"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Control Panel\Desktop\MuiCached\MachineLanguageConfiguration,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegEnumValue,HKLM\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,NO MORE ENTRIES,"Index: 0, Length: 512"
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,SUCCESS,
DistantWorlds.exe,RegCloseKey,HKCU,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Policies\Microsoft\MUI\Settings,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Policies\Microsoft\MUI\Settings,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCU,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: All Access"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Software\Policies\Microsoft\Control Panel\Desktop,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Control Panel\Desktop\LanguageConfiguration,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCU\Control Panel\Desktop\LanguageConfiguration,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegEnumValue,HKCU\Control Panel\Desktop\LanguageConfiguration,NO MORE ENTRIES,"Index: 0, Length: 512"
DistantWorlds.exe,RegCloseKey,HKCU\Control Panel\Desktop\LanguageConfiguration,SUCCESS,
DistantWorlds.exe,RegCloseKey,HKCU,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Policies\Microsoft\MUI\Settings,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Policies\Microsoft\MUI\Settings,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCU,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: All Access"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Software\Policies\Microsoft\Control Panel\Desktop,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Control Panel\Desktop,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCU\Control Panel\Desktop,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKCU\Control Panel\Desktop\PreferredUILanguages,BUFFER OVERFLOW,Length: 12
DistantWorlds.exe,RegQueryValue,HKCU\Control Panel\Desktop\PreferredUILanguages,SUCCESS,"Type: REG_MULTI_SZ, Length: 12, Data: en-GB"
DistantWorlds.exe,RegCloseKey,HKCU\Control Panel\Desktop,SUCCESS,
DistantWorlds.exe,RegCloseKey,HKCU,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\Software\WOW6432Node\Policies\Microsoft\MUI\Settings,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Policies\Microsoft\MUI\Settings,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCU,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: All Access"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Control Panel\Desktop\MuiCached,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCU\Control Panel\Desktop\MuiCached,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages,BUFFER OVERFLOW,Length: 12
DistantWorlds.exe,RegQueryValue,HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages,SUCCESS,"Type: REG_MULTI_SZ, Length: 12, Data: en-GB"
DistantWorlds.exe,RegCloseKey,HKCU\Control Panel\Desktop\MuiCached,SUCCESS,
DistantWorlds.exe,RegCloseKey,HKCU,SUCCESS,
DistantWorlds.exe,QueryOpen,D:\Steam\SteamApps\common\Distant Worlds Universe\mpr.dll,NAME NOT FOUND,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\mpr.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\mpr.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:16 PM, LastAccessTime: 29/09/2017 11:42:16 PM, LastWriteTime: 29/09/2017 11:42:16 PM, ChangeTime: 30/10/2017 1:51:12 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\mpr.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\mpr.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\mpr.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\mpr.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\mpr.dll,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\system\CurrentControlSet\control\NetworkProvider\HwOrder,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\control\NetworkProvider\HwOrder,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\NetworkProvider\HwOrder,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKLM\system\CurrentControlSet\control\NetworkProvider\ProviderOrder,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\control\NetworkProvider\ProviderOrder,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\NetworkProvider\ProviderOrder,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegOpenKey,HKCC,REPARSE,Desired Access: Maximum Allowed
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\HARDWARE PROFILES\CURRENT,REPARSE,Desired Access: Maximum Allowed
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001,REPARSE,Desired Access: Maximum Allowed
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: Read"
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001,SUCCESS,"Query: HandleTags, HandleTags: 0x400"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001\System,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: Read"
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001\System,SUCCESS,"Query: HandleTags, HandleTags: 0x400"
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001\System,SUCCESS,"Query: Flags, UserFlags: 0x0"
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001\System,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001,SUCCESS,"Query: HandleTags, HandleTags: 0x400"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001\System,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: Read"
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001\System,SUCCESS,"Query: HandleTags, HandleTags: 0x400"
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Hardware Profiles\0001\System,SUCCESS,
DistantWorlds.exe,QueryOpen,D:\Steam\SteamApps\common\Distant Worlds Universe,SUCCESS,"CreationTime: 25/01/2018 4:55:17 AM, LastAccessTime: 25/01/2018 10:08:48 AM, LastWriteTime: 25/01/2018 10:08:48 AM, ChangeTime: 25/01/2018 10:08:48 AM, AllocationSize: 12,288, EndOfFile: 12,288, FileAttributes: D"
DistantWorlds.exe,QueryNameInformationFile,D:\Steam\SteamApps\common\Distant Worlds Universe,BUFFER OVERFLOW,Name: \Steam
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\CustomLocale,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\CustomLocale,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Nls\CustomLocale,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\CustomLocale\en-AU,NAME NOT FOUND,Length: 532
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Nls\CustomLocale,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale\en-AU,NAME NOT FOUND,Length: 532
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale,SUCCESS,
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\000602xx,SUCCESS,"Type: REG_SZ, Length: 26, Data: kernel32.dll"
DistantWorlds.exe,CreateFile,C:\Windows\Globalization\Sorting\SortDefault.nls,SUCCESS,"Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\Globalization\Sorting\SortDefault.nls,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\Globalization\Sorting\SortDefault.nls,SUCCESS,"AllocationSize: 3,371,008, EndOfFile: 3,368,788, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CreateFileMapping,C:\Windows\Globalization\Sorting\SortDefault.nls,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,CloseFile,C:\Windows\Globalization\Sorting\SortDefault.nls,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Ids,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Ids,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Ids,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Ids\en-AU,NAME NOT FOUND,Length: 90
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\Sorting\Ids\en,NAME NOT FOUND,Length: 90
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,D:\Steam\SteamApps\common\Distant Worlds Universe\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,D:\Steam\SteamApps\common\Distant Worlds Universe,SUCCESS,"Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryNameInformationFile,D:\Steam\SteamApps\common\Distant Worlds Universe,SUCCESS,Name: \Steam\SteamApps\common\Distant Worlds Universe
DistantWorlds.exe,CloseFile,D:\Steam\SteamApps\common\Distant Worlds Universe,SUCCESS,
DistantWorlds.exe,CreateFile,D:\,SUCCESS,"Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryDirectory,D:\,SUCCESS,"0: $RECYCLE.BIN, 1: 9AF54C9E6223, 2: Downloads, 3: Files, 4: Font Collections, 5: Font Collections (ARCHIVE), 6: Games, 7: home"
DistantWorlds.exe,CloseFile,D:\,SUCCESS,
DistantWorlds.exe,QueryOpen,D:\Steam\SteamApps\common\Distant Worlds Universe\bxsdk32.dll,NAME NOT FOUND,
DistantWorlds.exe,CreateFile,C:\Windows\System32\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\System32,SUCCESS,"Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\System32,SUCCESS,Name: \Windows\System32
DistantWorlds.exe,CloseFile,C:\Windows\System32,SUCCESS,
DistantWorlds.exe,CreateFile,C:\,SUCCESS,"Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryDirectory,C:\,SUCCESS,"0: $Recycle.Bin, 1: Autodesk, 2: AVScanner.ini, 3: bootmgr, 4: BOOTNXT, 5: Codecs, 6: ColourConstructor_0-1-8_PC, 7: cygwin64"
DistantWorlds.exe,CloseFile,C:\,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\System\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,QueryOpen,D:\Steam\SteamApps\common\Distant Worlds Universe\bxsdk32.dll,NAME NOT FOUND,
DistantWorlds.exe,CreateFile,C:\Program Files\NVIDIA GPU Computing Toolkit\CUDA\v9.0\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\NVIDIA GPU Computing Toolkit\CUDA\v9.0\libnvvp\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\ProgramData\Oracle\Java\javapath_target_448718\bxsdk32.dll,REPARSE,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: <unknown>"
DistantWorlds.exe,CreateFile,C:\ProgramData\Oracle\Java\javapath_target_448718\BXSDK32.DLL,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\wbem\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\WindowsPowerShell\v1.0\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\wamp\bin\php\php5.5.12\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\ProgramData\ComposerSetup\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\wbem\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\WindowsPowerShell\v1.0\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Git\cmd\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Ruby21\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\AppData\Roaming\Composer\vendor\drush\drush\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\cygwin64\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\wamp\bin\mysql\mysql5.6.17\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Common Files\Autodesk Shared\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Autodesk\Backburner\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\QuickTime\QTSystem\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\opscode\chefdk\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\.dnx\bin\bxsdk32.dll,PATH NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft DNX\Dnvm\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft SQL Server\130\Tools\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\HashiCorp\Vagrant\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\GtkSharp\2.12\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Skype\Phone\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\nodejs\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\110\Tools\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Microsoft SQL Server\120\Tools\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft SQL Server\120\Tools\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files\Microsoft SQL Server\120\DTS\Binn\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\sK1 Project\UniConvertor-1.1.5\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\sK1 Project\UniConvertor-1.1.5\DLLs\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Ruby21\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Scapple\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\AppData\Local\atom\bin\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\AppData\Local\Microsoft\WindowsApps\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,CreateFile,C:\Users\Darren\AppData\Roaming\npm\bxsdk32.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0625000 seconds, Private Bytes: 35,729,408, Working Set: 31,424,512"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Locale,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Locale,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Nls\Locale,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Language Groups,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Nls\Language Groups,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Nls\Language Groups,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Control\Nls\Locale,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\Locale\00000C09,SUCCESS,"Type: REG_SZ, Length: 4, Data: 1"
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Control\Nls\Language Groups,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Nls\Language Groups\1,SUCCESS,"Type: REG_SZ, Length: 4, Data: 1"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Query: Cached, SubKeys: 0, Values: 67"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 0, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 0, Name: Lucida Sans Unicode, Type: REG_MULTI_SZ, Length: 440, Data: MSGOTHIC.TTC,MS UI Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 1, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 1, Name: Microsoft Sans Serif, Type: REG_MULTI_SZ, Length: 440, Data: MSGOTHIC.TTC,MS UI Gothic, YUGOTHM.TTC,Yu Gothic UI, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 2, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 2, Name: Tahoma, Type: REG_MULTI_SZ, Length: 440, Data: MSGOTHIC.TTC,MS UI Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 3, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 3, Name: Segoe UI, Type: REG_MULTI_SZ, Length: 848, Data: TAHOMA.TTF,Tahoma, MEIRYO.TTC,Meiryo UI,128,96, MEIRYO.TTC,Meiryo UI, MSGOTHIC.TTC,MS UI Gothic, MSJH.TTC,Microsoft JhengHei UI,128,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic,128,96, MALGUN.TTF,Malgun Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 4, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 4, Name: Segoe UI Bold, Type: REG_MULTI_SZ, Length: 778, Data: MEIRYOB.TTC,Meiryo UI Bold,128,96, MEIRYOB.TTC,Meiryo UI Bold, MSJHBD.TTC,Microsoft JhengHei UI Bold,128,96, MSJHBD.TTC,Microsoft JhengHei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,128,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 5, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 5, Name: Segoe UI Light, Type: REG_MULTI_SZ, Length: 778, Data: MEIRYO.TTC,Meiryo UI,128,96, MEIRYO.TTC,Meiryo UI, MSJHL.TTC,Microsoft JhengHei UI Light,128,96, MSJHL.TTC,Microsoft JhengHei UI Light, MSYHL.TTC,Microsoft YaHei UI Light,128,96, MSYHL.TTC,Microsoft YaHei UI Light, MALGUNSL.TTF,Malgun Gothic Semilight,128,96, MALGUNSL.TTF,Malgun Gothic Semilight, YUGOTHL.TTC,Yu Gothic UI Light,128,96, YUGOTHL.TTC,Yu Gothic UI Light, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 6, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 6, Name: Segoe UI Semilight, Type: REG_MULTI_SZ, Length: 738, Data: MEIRYO.TTC,Meiryo UI,128,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft JhengHei UI,128,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUNSL.TTF,Malgun Gothic Semilight,128,96, MALGUNSL.TTF,Malgun Gothic Semilight, YUGOTHR.TTC,Yu Gothic UI Semilight,128,96, YUGOTHR.TTC,Yu Gothic UI Semilight, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 7, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 7, Name: Segoe UI Semibold, Type: REG_MULTI_SZ, Length: 686, Data: MEIRYO.TTC,Meiryo UI,128,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft Jhenghei UI,128,96, MSJH.TTC,Microsoft Jhenghei UI, MSYH.TTC,Microsoft Yahei UI,128,96, MSYH.TTC,Microsoft Yahei UI, MALGUN.TTF,Malgun Gothic,128,96, MALGUN.TTF,Malgun Gothic, YUGOTHB.TTC,Yu Gothic UI Semibold,128,96, YUGOTHB.TTC,Yu Gothic UI Semibold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 8, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 8, Name: Ebrima, Type: REG_MULTI_SZ, Length: 748, Data: SEGOEUI.TTF,Segoe UI,110,82, SEGOEUI.TTF,Segoe UI, MEIRYO.TTC,Meiryo UI,120,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft JhengHei UI,120,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic,118,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 9, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 9, Name: Ebrima Bold, Type: REG_MULTI_SZ, Length: 900, Data: SEGOEUIB.TTF,Segoe UI Bold,110,82, SEGOEUIB.TTF,Segoe UI Bold, MEIRYOB.TTC,Meiryo UI Bold,120,96, MEIRYOB.TTC,Meiryo UI Bold, MSJHBD.TTC,Microsoft JhengHei UI Bold,120,96, MSJHBD.TTC,Microsoft JhengHei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,118,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 10, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 10, Name: Gadugi, Type: REG_MULTI_SZ, Length: 748, Data: SEGOEUI.TTF,Segoe UI,110,82, SEGOEUI.TTF,Segoe UI, MEIRYO.TTC,Meiryo UI,120,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft JhengHei UI,120,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic,118,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 11, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 11, Name: Gadugi Bold, Type: REG_MULTI_SZ, Length: 900, Data: SEGOEUIB.TTF,Segoe UI Bold,110,82, SEGOEUIB.TTF,Segoe UI Bold, MEIRYOB.TTC,Meiryo UI Bold,120,96, MEIRYOB.TTC,Meiryo UI Bold, MSJHBD.TTC,Microsoft JhengHei UI Bold,120,96, MSJHBD.TTC,Microsoft JhengHei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,118,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 12, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 12, Name: Khmer UI, Type: REG_MULTI_SZ, Length: 748, Data: SEGOEUI.TTF,Segoe UI,110,82, SEGOEUI.TTF,Segoe UI, MEIRYO.TTC,Meiryo UI,120,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft JhengHei UI,120,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic,118,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 13, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 13, Name: Khmer UI Bold, Type: REG_MULTI_SZ, Length: 900, Data: SEGOEUIB.TTF,Segoe UI Bold,110,82, SEGOEUIB.TTF,Segoe UI Bold, MEIRYOB.TTC,Meiryo UI Bold,120,96, MEIRYOB.TTC,Meiryo UI Bold, MSJHBD.TTC,Microsoft JhengHei UI Bold,120,96, MSJHBD.TTC,Microsoft JhengHei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,118,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 14, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 14, Name: Lao UI, Type: REG_MULTI_SZ, Length: 748, Data: SEGOEUI.TTF,Segoe UI,110,82, SEGOEUI.TTF,Segoe UI, MEIRYO.TTC,Meiryo UI,120,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft JhengHei UI,120,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic,118,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 15, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 15, Name: Lao UI Bold, Type: REG_MULTI_SZ, Length: 900, Data: SEGOEUIB.TTF,Segoe UI Bold,110,82, SEGOEUIB.TTF,Segoe UI Bold, MEIRYOB.TTC,Meiryo UI Bold,120,96, MEIRYOB.TTC,Meiryo UI Bold, MSJHBD.TTC,Microsoft JhengHei UI Bold,120,96, MSJHBD.TTC,Microsoft JhengHei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,118,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 16, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 16, Name: Leelawadee, Type: REG_MULTI_SZ, Length: 748, Data: SEGOEUI.TTF,Segoe UI,110,82, SEGOEUI.TTF,Segoe UI, MEIRYO.TTC,Meiryo UI,120,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft JhengHei UI,120,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic,118,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 17, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 17, Name: Leelawadee Bold, Type: REG_MULTI_SZ, Length: 900, Data: SEGOEUIB.TTF,Segoe UI Bold,110,82, SEGOEUIB.TTF,Segoe UI Bold, MEIRYOB.TTC,Meiryo UI Bold,120,96, MEIRYOB.TTC,Meiryo UI Bold, MSJHBD.TTC,Microsoft JhengHei UI Bold,120,96, MSJHBD.TTC,Microsoft JhengHei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,118,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 18, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 18, Name: Leelawadee UI, Type: REG_MULTI_SZ, Length: 748, Data: SEGOEUI.TTF,Segoe UI,110,82, SEGOEUI.TTF,Segoe UI, MEIRYO.TTC,Meiryo UI,120,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft JhengHei UI,120,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic,118,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 19, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 19, Name: Leelawadee UI Bold, Type: REG_MULTI_SZ, Length: 900, Data: SEGOEUIB.TTF,Segoe UI Bold,110,82, SEGOEUIB.TTF,Segoe UI Bold, MEIRYOB.TTC,Meiryo UI Bold,120,96, MEIRYOB.TTC,Meiryo UI Bold, MSJHBD.TTC,Microsoft JhengHei UI Bold,120,96, MSJHBD.TTC,Microsoft JhengHei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,118,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 20, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 20, Name: Nirmala UI, Type: REG_MULTI_SZ, Length: 748, Data: SEGOEUI.TTF,Segoe UI,110,82, SEGOEUI.TTF,Segoe UI, MEIRYO.TTC,Meiryo UI,120,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft JhengHei UI,120,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic,118,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 21, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 21, Name: Nirmala UI Bold, Type: REG_MULTI_SZ, Length: 900, Data: SEGOEUIB.TTF,Segoe UI Bold,110,82, SEGOEUIB.TTF,Segoe UI Bold, MEIRYOB.TTC,Meiryo UI Bold,120,96, MEIRYOB.TTC,Meiryo UI Bold, MSJHBD.TTC,Microsoft JhengHei UI Bold,120,96, MSJHBD.TTC,Microsoft JhengHei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,118,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 22, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 22, Name: Nirmala UI Semilight, Type: REG_MULTI_SZ, Length: 738, Data: MEIRYO.TTC,Meiryo UI,128,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft JhengHei UI,128,96, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUNSL.TTF,Malgun Gothic Semilight,128,96, MALGUNSL.TTF,Malgun Gothic Semilight, YUGOTHR.TTC,Yu Gothic UI Semilight,128,96, YUGOTHR.TTC,Yu Gothic UI Semilight, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 23, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 23, Name: MingLiU, Type: REG_MULTI_SZ, Length: 546, Data: MICROSS.TTF,Microsoft Sans Serif,40,48, MICROSS.TTF,Microsoft Sans Serif, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, YUGOTHM.TTC,Yu Gothic UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 24, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 24, Name: PMingLiU, Type: REG_MULTI_SZ, Length: 542, Data: MICROSS.TTF,Microsoft Sans Serif,40,48, MICROSS.TTF,Microsoft Sans Serif, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS PMincho, BATANG.TTC,Batang, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, YUGOTHM.TTC,Yu Gothic UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 25, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 25, Name: MingLiU_HKSCS, Type: REG_MULTI_SZ, Length: 586, Data: MICROSS.TTF,Microsoft Sans Serif,40,48, MICROSS.TTF,Microsoft Sans Serif, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, YUGOTHM.TTC,Yu Gothic UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 26, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 26, Name: MingLiU-ExtB, Type: REG_MULTI_SZ, Length: 586, Data: MICROSS.TTF,Microsoft Sans Serif,40,48, MICROSS.TTF,Microsoft Sans Serif, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, YUGOTHM.TTC,Yu Gothic UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 27, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 27, Name: PMingLiU-ExtB, Type: REG_MULTI_SZ, Length: 584, Data: MICROSS.TTF,Microsoft Sans Serif,40,48, MICROSS.TTF,Microsoft Sans Serif, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS PMincho, BATANG.TTC,Batang, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, YUGOTHM.TTC,Yu Gothic UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 28, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 28, Name: MingLiU_HKSCS-ExtB, Type: REG_MULTI_SZ, Length: 638, Data: MICROSS.TTF,Microsoft Sans Serif,40,48, MICROSS.TTF,Microsoft Sans Serif, MINGLIU.TTC,MingLiU_HKSCS, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, YUGOTHM.TTC,Yu Gothic UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 29, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 29, Name: Microsoft JhengHei, Type: REG_MULTI_SZ, Length: 626, Data: SEGOEUI.TTF,Segoe UI,114,78, SEGOEUI.TTF,Segoe UI, MINGLIU.TTC,MingLiU, MSYH.TTC,Microsoft YaHei,128,96, MSYH.TTC,Microsoft YaHei, MEIRYO.TTC,Meiryo,128,85, MEIRYO.TTC,Meiryo, MALGUN.TTF,Malgun Gothic,128,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 30, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 30, Name: Microsoft JhengHei Bold, Type: REG_MULTI_SZ, Length: 750, Data: SEGOEUIB.TTF,Segoe UI Bold,114,78, SEGOEUIB.TTF,Segoe UI Bold, MINGLIU.TTC,MingLiU, MSYHBD.TTC,Microsoft YaHei Bold,128,96, MSYHBD.TTC,Microsoft YaHei Bold, MEIRYOB.TTC,Meiryo Bold,128,85, MEIRYOB.TTC,Meiryo Bold, MALGUNBD.TTF,Malgun Gothic Bold,128,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 31, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 31, Name: Microsoft JhengHei UI, Type: REG_MULTI_SZ, Length: 524, Data: SEGOEUI.TTF,Segoe UI,114,78, SEGOEUI.TTF,Segoe UI, MINGLIU.TTC,MingLiU, MSYH.TTC,Microsoft YaHei UI, MEIRYO.TTC,Meiryo UI, MALGUN.TTF,Malgun Gothic,128,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 32, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 32, Name: Microsoft JhengHei UI Bold, Type: REG_MULTI_SZ, Length: 622, Data: SEGOEUIB.TTF,Segoe UI Bold,114,78, SEGOEUIB.TTF,Segoe UI Bold, MINGLIU.TTC,MingLiU, MSYHBD.TTC,Microsoft YaHei UI Bold, MEIRYOB.TTC,Meiryo UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,128,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 33, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 33, Name: Microsoft JhengHei UI Light, Type: REG_MULTI_SZ, Length: 638, Data: SEGOEUIL.TTF,Segoe UI Light,114,78, SEGOEUIL.TTF,Segoe UI Light, MINGLIU.TTC,MingLiU, MSYHL.TTC,Microsoft YaHei UI Light, MEIRYO.TTC,Meiryo UI, MALGUNSL.TTF,Malgun Gothic Semilight,128,96, MALGUNSL.TTF,Malgun Gothic Semilight, YUGOTHL.TTC,Yu Gothic UI Light,128,96, YUGOTHL.TTC,Yu Gothic UI Light, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 34, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 34, Name: SimSun, Type: REG_MULTI_SZ, Length: 552, Data: MICROSS.TTF,Microsoft Sans Serif,108,122, MICROSS.TTF,Microsoft Sans Serif, MINGLIU.TTC,PMingLiU, MSMINCHO.TTC,MS PMincho, BATANG.TTC,Batang, MSYH.TTC,Microsoft YaHei UI, MSJH.TTC,Microsoft JhengHei UI, YUGOTHM.TTC,Yu Gothic UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 35, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 35, Name: SimSun-ExtB, Type: REG_MULTI_SZ, Length: 588, Data: MICROSS.TTF,Microsoft Sans Serif,108,122, MICROSS.TTF,Microsoft Sans Serif, SIMSUN.TTC,SimSun, MINGLIU.TTC,PMingLiU, MSMINCHO.TTC,MS PMincho, BATANG.TTC,Batang, MSYH.TTC,Microsoft YaHei UI, MSJH.TTC,Microsoft JhengHei UI, YUGOTHM.TTC,Yu Gothic UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 36, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 36, Name: NSimSun, Type: REG_MULTI_SZ, Length: 408, Data: MINGLIU.TTC,PMingLiU, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe, MSYH.TTC,Microsoft YaHei UI, MSJH.TTC,Microsoft JhengHei UI, YUGOTHM.TTC,Yu Gothic UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 37, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 37, Name: Microsoft YaHei, Type: REG_MULTI_SZ, Length: 634, Data: SEGOEUI.TTF,Segoe UI,120,80, SEGOEUI.TTF,Segoe UI, SIMSUN.TTC,SimSun, MSJH.TTC,Microsoft JhengHei,128,96, MSJH.TTC,Microsoft JhengHei, MEIRYO.TTC,Meiryo,128,85, MEIRYO.TTC,Meiryo, MALGUN.TTF,Malgun Gothic,128,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 38, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 38, Name: Microsoft YaHei Bold, Type: REG_MULTI_SZ, Length: 758, Data: SEGOEUIB.TTF,Segoe UI Bold,120,80, SEGOEUIB.TTF,Segoe UI Bold, SIMSUN.TTC,SimSun, MSJHBD.TTC,Microsoft Jhenghei Bold,128,96, MSJHBD.TTC,Microsoft Jhenghei Bold, MEIRYOB.TTC,Meiryo Bold,128,85, MEIRYOB.TTC,Meiryo Bold, MALGUNBD.TTF,Malgun Gothic Bold,128,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 39, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 39, Name: Microsoft YaHei UI, Type: REG_MULTI_SZ, Length: 526, Data: SEGOEUI.TTF,Segoe UI,120,80, SEGOEUI.TTF,Segoe UI, SIMSUN.TTC,SimSun, MSJH.TTC,Microsoft Jhenghei UI, MEIRYO.TTC,Meiryo UI, MALGUN.TTF,Malgun Gothic,128,96, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 40, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 40, Name: Microsoft YaHei UI Bold, Type: REG_MULTI_SZ, Length: 624, Data: SEGOEUIB.TTF,Segoe UI Bold,120,80, SEGOEUIB.TTF,Segoe UI Bold, SIMSUN.TTC,SimSun, MSJHBD.TTC,Microsoft Jhenghei UI Bold, MEIRYOB.TTC,Meiryo UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,128,96, MALGUNBD.TTF,Malgun Gothic Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 41, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 41, Name: Microsoft YaHei UI Light, Type: REG_MULTI_SZ, Length: 640, Data: SEGOEUIL.TTF,Segoe UI Light,120,80, SEGOEUIL.TTF,Segoe UI Light, SIMSUN.TTC,SimSun, MSJHL.TTC,Microsoft Jhenghei UI Light, MEIRYO.TTC,Meiryo UI, MALGUNSL.TTF,Malgun Gothic Semilight,128,96, MALGUNSL.TTF,Malgun Gothic Semilight, YUGOTHL.TTC,Yu Gothic UI Light,128,96, YUGOTHL.TTC,Yu Gothic UI Light, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 42, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 42, Name: Yu Gothic UI, Type: REG_MULTI_SZ, Length: 258, Data: SEGOEUI.TTF,Segoe UI, MSJH.TTC,Microsoft JhengHei, MSYH.TTC,Microsoft YaHei, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 43, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 43, Name: Yu Gothic UI Bold, Type: REG_MULTI_SZ, Length: 318, Data: SEGOEUIB.TTF,Segoe UI Bold, MSJHBD.TTC,Microsoft Jhenghei UI Bold, MSYHBD.TTC,Microsoft YaHei Bold, MALGUNBD.TTF,Malgun Gothic Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 44, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 44, Name: Yu Gothic UI Light, Type: REG_MULTI_SZ, Length: 330, Data: SEGOEUIL.TTF,Segoe UI Light, MSJHL.TTC,Microsoft Jhenghei UI Light, MSYHL.TTC,Microsoft YaHei Light, MALGUNSL.TTF,Malgun Gothic Semilight, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 45, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 45, Name: Yu Gothic UI Semilight, Type: REG_MULTI_SZ, Length: 312, Data: SEGOEUISL.TTF,Segoe UI Semilight, MSJH.TTC,Microsoft Jhenghei UI, MSYH.TTC,Microsoft YaHei, MALGUNSL.TTF,Malgun Gothic Semilight, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 46, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 46, Name: Yu Gothic UI Semibold, Type: REG_MULTI_SZ, Length: 282, Data: SEGUISB.TTF,Segoe UI Semibold, MSJH.TTC,Microsoft Jhenghei UI, MSYH.TTC,Microsoft YaHei, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 47, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 47, Name: Meiryo, Type: REG_MULTI_SZ, Length: 678, Data: SEGOEUI.TTF,Segoe UI,133,83, SEGOEUI.TTF,Segoe UI, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, MSGOTHIC.TTC,MS UI Gothic, MSJH.TTC,Microsoft Jhenghei,128,96, MSJH.TTC,Microsoft JhengHei, MSYH.TTC,Microsoft YaHei,128,96, MSYH.TTC,Microsoft YaHei, MALGUN.TTF,Malgun Gothic,128,96, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 48, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 48, Name: Meiryo Bold, Type: REG_MULTI_SZ, Length: 806, Data: SEGOEUIB.TTF,Segoe UI Bold,133,83, SEGOEUIB.TTF,Segoe UI Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, MSGOTHIC.TTC,MS UI Gothic, MSJHBD.TTC,Microsoft Jhenghei Bold,128,96, MSJHBD.TTC,Microsoft Jhenghei Bold, MSYHBD.TTC,Microsoft YaHei Bold,128,96, MSYHBD.TTC,Microsoft YaHei Bold, MALGUNBD.TTF,Malgun Gothic Bold,128,96, MALGUNBD.TTF,Malgun Gothic Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 49, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 49, Name: Meiryo UI, Type: REG_MULTI_SZ, Length: 702, Data: SEGOEUI.TTF,Segoe UI,133,83, SEGOEUI.TTF,Segoe UI, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, MSGOTHIC.TTC,MS UI Gothic, MSJH.TTC,Microsoft Jhenghei UI,128,96, MSJH.TTC,Microsoft Jhenghei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic,128,96, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 50, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 50, Name: Meiryo UI Bold, Type: REG_MULTI_SZ, Length: 830, Data: SEGOEUIB.TTF,Segoe UI Bold,133,83, SEGOEUIB.TTF,Segoe UI Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, MSGOTHIC.TTC,MS UI Gothic, MSJHBD.TTC,Microsoft Jhenghei UI Bold,128,96, MSJHBD.TTC,Microsoft Jhenghei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, MALGUNBD.TTF,Malgun Gothic Bold,128,96, MALGUNBD.TTF,Malgun Gothic Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 51, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 51, Name: MS Gothic, Type: REG_MULTI_SZ, Length: 392, Data: MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,GulimChe, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 52, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 52, Name: MS PGothic, Type: REG_MULTI_SZ, Length: 388, Data: MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 53, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 53, Name: MS UI Gothic, Type: REG_MULTI_SZ, Length: 536, Data: MICROSS.TTF,Microsoft Sans Serif,128,142, MICROSS.TTF,Microsoft Sans Serif, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 54, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 54, Name: MS Mincho, Type: REG_MULTI_SZ, Length: 390, Data: MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, BATANG.TTC,Batang, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 55, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 55, Name: MS PMincho, Type: REG_MULTI_SZ, Length: 392, Data: MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, BATANG.TTC,Batang, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, MALGUN.TTF,Malgun Gothic, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 56, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 56, Name: Batang, Type: REG_MULTI_SZ, Length: 404, Data: MSMINCHO.TTC,MS PMincho, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 57, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 57, Name: BatangChe, Type: REG_MULTI_SZ, Length: 400, Data: MSMINCHO.TTC,MS Mincho, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 58, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 58, Name: Dotum, Type: REG_MULTI_SZ, Length: 408, Data: MSGOTHIC.TTC,MS UI Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 59, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 59, Name: DotumChe, Type: REG_MULTI_SZ, Length: 400, Data: MSGOTHIC.TTC,MS Gothic, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 60, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 60, Name: Gulim, Type: REG_MULTI_SZ, Length: 556, Data: MICROSS.TTF,Microsoft Sans Serif,128,140, MICROSS.TTF,Microsoft Sans Serif, MSGOTHIC.TTC,MS UI Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 61, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 61, Name: GulimChe, Type: REG_MULTI_SZ, Length: 400, Data: MSGOTHIC.TTC,MS Gothic, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 62, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 62, Name: Gungsuh, Type: REG_MULTI_SZ, Length: 404, Data: MSMINCHO.TTC,MS PMincho, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 63, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 63, Name: GungsuhChe, Type: REG_MULTI_SZ, Length: 400, Data: MSMINCHO.TTC,MS Mincho, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MALGUN.TTF,Malgun Gothic, YUGOTHM.TTC,Yu Gothic UI, MSJH.TTC,Microsoft JhengHei UI, MSYH.TTC,Microsoft YaHei UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 64, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 64, Name: Malgun Gothic, Type: REG_MULTI_SZ, Length: 666, Data: SEGOEUI.TTF,Segoe UI,130,81, SEGOEUI.TTF,Segoe UI, GULIM.TTC,Gulim, MEIRYO.TTC,Meiryo UI,128,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft Jhenghei UI,128,96, MSJH.TTC,Microsoft Jhenghei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, YUGOTHM.TTC,Yu Gothic UI,128,96, YUGOTHM.TTC,Yu Gothic UI, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 65, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 65, Name: Malgun Gothic Bold, Type: REG_MULTI_SZ, Length: 790, Data: SEGOEUIB.TTF,Segoe UI Bold,130,81, SEGOEUIB.TTF,Segoe UI Bold, GULIM.TTC,Gulim, MEIRYOB.TTC,Meiryo UI Bold,128,96, MEIRYOB.TTC,Meiryo UI Bold, MSJHBD.TTC,Microsoft Jhenghei UI Bold,128,96, MSJHBD.TTC,Microsoft Jhenghei UI Bold, MSYHBD.TTC,Microsoft YaHei UI Bold,128,96, MSYHBD.TTC,Microsoft YaHei UI Bold, YUGOTHB.TTC,Yu Gothic UI Bold,128,96, YUGOTHB.TTC,Yu Gothic UI Bold, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,BUFFER OVERFLOW,"Index: 66, Length: 220"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,"Index: 66, Name: Malgun Gothic Semilight, Type: REG_MULTI_SZ, Length: 754, Data: SEGOEUISL.TTF,Segoe UI Semilight,130,81, SEGOEUISL.TTF,Segoe UI Semilight, GULIM.TTC,Gulim, MEIRYO.TTC,Meiryo UI,128,96, MEIRYO.TTC,Meiryo UI, MSJH.TTC,Microsoft Jhenghei UI,128,96, MSJH.TTC,Microsoft Jhenghei UI, MSYH.TTC,Microsoft YaHei UI,128,96, MSYH.TTC,Microsoft YaHei UI, YUGOTHR.TTC,Yu Gothic UI Semilight,128,96, YUGOTHR.TTC,Yu Gothic UI Semilight, SEGUISYM.TTF,Segoe UI Symbol"
DistantWorlds.exe,RegEnumValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,NO MORE ENTRIES,"Index: 67, Length: 220"
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath,SUCCESS,"Type: REG_SZ, Length: 66, Data: C:\Windows\Fonts\staticcache.dat"
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\Fonts\StaticCache.dat,SUCCESS,"Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\Fonts\StaticCache.dat,SUCCESS,"AllocationSize: 18,612,224, EndOfFile: 18,612,224, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,ReadFile,C:\Windows\Fonts\StaticCache.dat,SUCCESS,"Offset: 0, Length: 60, Priority: Normal"
DistantWorlds.exe,CreateFileMapping,C:\Windows\Fonts\StaticCache.dat,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\Fonts\StaticCache.dat,SUCCESS,"AllocationSize: 18,612,224, EndOfFile: 18,612,224, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CreateFileMapping,C:\Windows\Fonts\StaticCache.dat,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2,SUCCESS,"Type: REG_SZ, Length: 24, Data: SimSun-ExtB"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2,SUCCESS,"Type: REG_SZ, Length: 24, Data: SimSun-ExtB"
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,"Query: Cached, SubKeys: 4, Values: 1"
DistantWorlds.exe,RegEnumKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,"Index: 0, Name: MingLiU"
DistantWorlds.exe,RegEnumKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,"Index: 1, Name: MingLiU_HKSCS"
DistantWorlds.exe,RegEnumKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,"Index: 2, Name: PMingLiU"
DistantWorlds.exe,RegEnumKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,"Index: 3, Name: SimSun"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,"Query: HandleTags, HandleTags: 0x100"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\uxtheme.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\uxtheme.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:25 PM, LastAccessTime: 29/09/2017 11:42:25 PM, LastWriteTime: 29/09/2017 11:42:25 PM, ChangeTime: 30/10/2017 1:51:11 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\uxtheme.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\uxtheme.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\uxtheme.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\uxtheme.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\uxtheme.dll,SUCCESS,Name: \Windows\SysWOW64\uxtheme.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\uxtheme.dll,SUCCESS,"AllocationSize: 475,136, EndOfFile: 472,576, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\uxtheme.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,"CreationTime: 30/10/2017 1:53:13 PM, LastAccessTime: 30/10/2017 1:53:13 PM, LastWriteTime: 30/10/2017 1:53:13 PM, ChangeTime: 5/01/2018 6:54:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\msctf.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\msctf.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,Name: \Windows\SysWOW64\msctf.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,"AllocationSize: 1,327,104, EndOfFile: 1,323,840, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,"CreationTime: 30/10/2017 1:53:13 PM, LastAccessTime: 30/10/2017 1:53:13 PM, LastWriteTime: 30/10/2017 1:53:13 PM, ChangeTime: 5/01/2018 6:54:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\msctf.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\msctf.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,Name: \Windows\SysWOW64\msctf.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,"AllocationSize: 1,327,104, EndOfFile: 1,323,840, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\msctf.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:31 PM, LastAccessTime: 1/10/2017 12:36:52 AM, LastWriteTime: 1/10/2017 12:36:52 AM, ChangeTime: 30/10/2017 1:50:52 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll,SUCCESS,Name: \Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll,SUCCESS,"AllocationSize: 544,768, EndOfFile: 541,080, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,QueryOpen,D:\Steam\SteamApps\common\Distant Worlds Universe\DistantWorlds.exe,SUCCESS,"CreationTime: 25/01/2018 5:05:02 AM, LastAccessTime: 25/01/2018 5:05:02 AM, LastWriteTime: 24/01/2018 7:35:04 AM, ChangeTime: 25/01/2018 10:08:48 AM, AllocationSize: 13,418,496, EndOfFile: 13,418,496, FileAttributes: A"
DistantWorlds.exe,QueryOpen,D:\Steam\SteamApps\common\Distant Worlds Universe\DistantWorlds.exe,SUCCESS,"CreationTime: 25/01/2018 5:05:02 AM, LastAccessTime: 25/01/2018 5:05:02 AM, LastWriteTime: 24/01/2018 7:35:04 AM, ChangeTime: 25/01/2018 10:08:48 AM, AllocationSize: 13,418,496, EndOfFile: 13,418,496, FileAttributes: A"
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\dwmapi.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\dwmapi.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:16 PM, LastAccessTime: 29/09/2017 11:42:16 PM, LastWriteTime: 29/09/2017 11:42:16 PM, ChangeTime: 30/10/2017 1:51:11 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\dwmapi.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\dwmapi.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\dwmapi.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\dwmapi.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\dwmapi.dll,SUCCESS,Name: \Windows\SysWOW64\dwmapi.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\dwmapi.dll,SUCCESS,"AllocationSize: 126,976, EndOfFile: 126,872, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\dwmapi.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\SYSTEM\CurrentControlSet\Control\Session Manager,REPARSE,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Session Manager\ResourcePolicies,NAME NOT FOUND,Length: 24
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\Compatibility\DistantWorlds.exe,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\rpcss.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\Compatibility\DistantWorlds.exe,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\TextInputFramework.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\TextInputFramework.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:10 PM, LastAccessTime: 29/09/2017 11:42:10 PM, LastWriteTime: 29/09/2017 11:42:10 PM, ChangeTime: 9/01/2018 6:34:46 AM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\TextInputFramework.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\TextInputFramework.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\TextInputFramework.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\TextInputFramework.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\TextInputFramework.dll,SUCCESS,Name: \Windows\SysWOW64\TextInputFramework.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\TextInputFramework.dll,SUCCESS,"AllocationSize: 483,328, EndOfFile: 480,912, NumberOfLinks: 3, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\TextInputFramework.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\CoreUIComponents.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\CoreUIComponents.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:10 PM, LastAccessTime: 29/09/2017 11:42:10 PM, LastWriteTime: 29/09/2017 11:42:10 PM, ChangeTime: 30/10/2017 1:51:07 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\CoreUIComponents.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\CoreUIComponents.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\CoreUIComponents.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\CoreUIComponents.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\CoreUIComponents.dll,SUCCESS,Name: \Windows\SysWOW64\CoreUIComponents.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\CoreUIComponents.dll,SUCCESS,"AllocationSize: 2,314,240, EndOfFile: 2,313,472, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\CoreUIComponents.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,"CreationTime: 5/01/2018 6:53:16 PM, LastAccessTime: 5/01/2018 6:53:16 PM, LastWriteTime: 1/01/2018 10:03:36 PM, ChangeTime: 5/01/2018 8:03:05 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\CoreMessaging.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,Name: \Windows\SysWOW64\CoreMessaging.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,"AllocationSize: 569,344, EndOfFile: 566,664, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\ntmarta.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\ntmarta.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:11 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\ntmarta.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\ntmarta.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\ntmarta.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\ntmarta.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\ntmarta.dll,SUCCESS,Name: \Windows\SysWOW64\ntmarta.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\ntmarta.dll,SUCCESS,"AllocationSize: 155,648, EndOfFile: 152,440, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\ntmarta.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,"CreationTime: 5/01/2018 6:53:16 PM, LastAccessTime: 5/01/2018 6:53:16 PM, LastWriteTime: 1/01/2018 10:03:36 PM, ChangeTime: 5/01/2018 8:03:05 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\CoreMessaging.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:06 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\WinTypes.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,Name: \Windows\SysWOW64\WinTypes.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,"AllocationSize: 835,584, EndOfFile: 832,648, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:06 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:06 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\4e7add1a-6945-435a-82b6-612688ba9f57,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\WinTypes.dll,SUCCESS,Name: \Windows\SysWOW64\WinTypes.dll
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\3720dda7-caea-4af3-a138-375aafc3f1d6,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\CoreUIComponents.dll,SUCCESS,Name: \Windows\SysWOW64\CoreUIComponents.dll
DistantWorlds.exe,RegOpenKey,HKLM\SYSTEM\CurrentControlSet\Control\Session Manager,REPARSE,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"Desired Access: Query Value, Enumerate Sub Keys"
DistantWorlds.exe,RegSetInfoKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Session Manager\ResourcePolicies,NAME NOT FOUND,Length: 24
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\WMI\Security\ebadf775-48aa-4bf3-8f8e-ec68d113c98e,NAME NOT FOUND,Length: 524
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\TextInputFramework.dll,SUCCESS,Name: \Windows\SysWOW64\TextInputFramework.dll
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\CTF,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\CTF,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\CTF,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\Software\Wow6432Node\Microsoft\Input,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Input,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Input,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Input,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Input\InputServiceEnabled,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 1"
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Input,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\OOBE,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: All Access"
DistantWorlds.exe,RegSetInfoKey,HKCU\Software\Classes,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegOpenKey,HKLM\Software\Microsoft\COM3,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\COM3,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\COM3,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\COM3\Com+Enabled,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 1"
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\COM3,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:07 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\clbcatq.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,Name: \Windows\SysWOW64\clbcatq.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,"AllocationSize: 520,192, EndOfFile: 519,640, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:14 PM, LastAccessTime: 29/09/2017 11:42:14 PM, LastWriteTime: 29/09/2017 11:42:14 PM, ChangeTime: 30/10/2017 1:51:07 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\clbcatq.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,Name: \Windows\SysWOW64\clbcatq.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,"AllocationSize: 520,192, EndOfFile: 519,640, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\clbcatq.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\Registration\R00000000000d.clb,SUCCESS,"Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\Registration\R00000000000d.clb,SUCCESS,"AllocationSize: 24,576, EndOfFile: 23,144, NumberOfLinks: 1, DeletePending: False, Directory: False"
DistantWorlds.exe,CreateFileMapping,C:\Windows\Registration\R00000000000d.clb,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\Registration\R00000000000d.clb,SUCCESS,"AllocationSize: 24,576, EndOfFile: 23,144, NumberOfLinks: 1, DeletePending: False, Directory: False"
DistantWorlds.exe,CreateFileMapping,C:\Windows\Registration\R00000000000d.clb,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,"Query: HandleTags, HandleTags: 0x1"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Wow6432Node\CLSID\{E22AD333-B25F-460C-83D0-0581107395C9},NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCR\Wow6432Node\CLSID\{E22AD333-B25F-460C-83D0-0581107395C9},SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\TreatAs,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\TreatAs,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\(Default),SUCCESS,"Type: REG_SZ, Length: 70, Data: UIAutomation8 Client Central Class"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\(Default),SUCCESS,"Type: REG_SZ, Length: 70, Data: UIAutomation8 Client Central Class"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"Query: HandleTags, HandleTags: 0x601"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32\InprocServer32,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"Query: HandleTags, HandleTags: 0x601"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32\(Default),SUCCESS,"Type: REG_SZ, Length: 82, Data: C:\Windows\SysWOW64\uiautomationcore.dll"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"Query: HandleTags, HandleTags: 0x601"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32\(Default),SUCCESS,"Type: REG_SZ, Length: 82, Data: C:\Windows\SysWOW64\uiautomationcore.dll"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"Query: HandleTags, HandleTags: 0x601"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32\ThreadingModel,SUCCESS,"Type: REG_SZ, Length: 10, Data: Both"
DistantWorlds.exe,RegCloseKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocHandler32,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocHandler32,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocHandler,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocHandler,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKCU,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,"Query: HandleTags, HandleTags: 0x0"
DistantWorlds.exe,RegQueryKey,HKCU,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes,REPARSE,Desired Access: Notify
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes,SUCCESS,Desired Access: Notify
DistantWorlds.exe,RegSetInfoKey,HKCU\Software\Classes,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegCloseKey,HKCU,SUCCESS,
DistantWorlds.exe,RegCloseKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\Software\Wow6432Node\Microsoft\OLE,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Ole\MaxSxSHashCount,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,"Query: HandleTags, HandleTags: 0x1"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Wow6432Node\CLSID\{E22AD333-B25F-460C-83D0-0581107395C9},NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCR\Wow6432Node\CLSID\{E22AD333-B25F-460C-83D0-0581107395C9},SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\TreatAs,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\TreatAs,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\(Default),SUCCESS,"Type: REG_SZ, Length: 70, Data: UIAutomation8 Client Central Class"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\(Default),SUCCESS,"Type: REG_SZ, Length: 70, Data: UIAutomation8 Client Central Class"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"Query: HandleTags, HandleTags: 0x601"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32\InprocServer32,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"Query: HandleTags, HandleTags: 0x601"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32\(Default),SUCCESS,"Type: REG_SZ, Length: 82, Data: C:\Windows\SysWOW64\uiautomationcore.dll"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"Query: HandleTags, HandleTags: 0x601"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32\(Default),SUCCESS,"Type: REG_SZ, Length: 82, Data: C:\Windows\SysWOW64\uiautomationcore.dll"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,"Query: HandleTags, HandleTags: 0x601"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32\ThreadingModel,SUCCESS,"Type: REG_SZ, Length: 10, Data: Both"
DistantWorlds.exe,RegCloseKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocServer32,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocHandler32,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocHandler32,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocHandler,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\InprocHandler,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\LocalServer32,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\LocalServer32,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\AppID,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\LocalServer,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\LocalServer,NAME NOT FOUND,Desired Access: Query Value
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,"Query: HandleTags, HandleTags: 0x1"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Wow6432Node\CLSID\{E22AD333-B25F-460C-83D0-0581107395C9},NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCR\Wow6432Node\CLSID\{E22AD333-B25F-460C-83D0-0581107395C9},SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\Elevation,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\Elevation,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegCloseKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,
DistantWorlds.exe,RegCloseKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes,SUCCESS,"Desired Access: Maximum Allowed, Granted Access: All Access"
DistantWorlds.exe,RegSetInfoKey,HKCU\Software\Classes,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,"Query: HandleTags, HandleTags: 0x1"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\Wow6432Node\CLSID\{E22AD333-B25F-460C-83D0-0581107395C9},NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCR\Wow6432Node\CLSID\{E22AD333-B25F-460C-83D0-0581107395C9},SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\TreatAs,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,"Query: HandleTags, HandleTags: 0xe01"
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9}\TreatAs,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegCloseKey,HKCR\WOW6432Node\CLSID\{e22ad333-b25f-460c-83d0-0581107395c9},SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\UIAutomationCore.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\UIAutomationCore.dll,SUCCESS,"CreationTime: 29/09/2017 11:42:10 PM, LastAccessTime: 29/09/2017 11:42:10 PM, LastWriteTime: 29/09/2017 11:42:10 PM, ChangeTime: 30/10/2017 1:51:08 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\UIAutomationCore.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\UIAutomationCore.dll,SUCCESS,"Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\UIAutomationCore.dll,FILE LOCKED WITH ONLY READERS,"SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
DistantWorlds.exe,CreateFileMapping,C:\Windows\SysWOW64\UIAutomationCore.dll,SUCCESS,SyncType: SyncTypeOther
DistantWorlds.exe,QueryNameInformationFile,C:\Windows\SysWOW64\UIAutomationCore.dll,SUCCESS,Name: \Windows\SysWOW64\UIAutomationCore.dll
DistantWorlds.exe,QueryStandardInformationFile,C:\Windows\SysWOW64\UIAutomationCore.dll,SUCCESS,"AllocationSize: 1,671,168, EndOfFile: 1,668,096, NumberOfLinks: 2, DeletePending: False, Directory: False"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\UIAutomationCore.dll,SUCCESS,
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,QueryBasicInformationFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,"CreationTime: 29/09/2017 11:41:43 PM, LastAccessTime: 29/09/2017 11:41:43 PM, LastWriteTime: 29/09/2017 11:41:43 PM, ChangeTime: 30/10/2017 1:50:33 PM, FileAttributes: A"
DistantWorlds.exe,CloseFile,C:\Windows\SysWOW64\KernelBase.dll,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\Software\Wow6432Node\Microsoft\Rpc\Extensions,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Rpc\Extensions,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Rpc\Extensions,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Rpc\Extensions,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL,SUCCESS,"Type: REG_EXPAND_SZ, Length: 24, Data: combase.dll"
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Rpc\Extensions,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKLM\System\CurrentControlSet\Control\Session Manager,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Session Manager\SafeProcessSearchMode,NAME NOT FOUND,Length: 16
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64,SUCCESS,"Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx\AllowDevelopmentWithoutDevLicense,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 65535"
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense,NAME NOT FOUND,Length: 24
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,"Query: HandleTags, HandleTags: 0x1"
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,"Query: HandleTags, HandleTags: 0x1"
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\AppID\DistantWorlds.exe,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCR\AppID\DistantWorlds.exe,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,"Query: HandleTags, HandleTags: 0x1"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\AppID\DistantWorlds.exe,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCR\AppID\DistantWorlds.exe,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\Software\Wow6432Node\Microsoft\OLE\AppCompat,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Ole\AppCompat,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Ole\AppCompat,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Ole\AppCompat,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel,NAME NOT FOUND,Length: 144
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Ole\AppCompat,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Wow6432Node\Microsoft\OLE,REPARSE,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryValue,HKLM\SOFTWARE\Microsoft\Ole\DefaultAccessPermission,NAME NOT FOUND,Length: 144
DistantWorlds.exe,CreateFile,C:\Windows\SysWOW64\rpcss.dll,NAME NOT FOUND,"Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
DistantWorlds.exe,RegCloseKey,HKLM\SOFTWARE\Microsoft\Ole,SUCCESS,
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Lsa,REPARSE,Desired Access: Query Value
DistantWorlds.exe,RegOpenKey,HKLM\System\CurrentControlSet\Control\Lsa,SUCCESS,Desired Access: Query Value
DistantWorlds.exe,RegQueryValue,HKLM\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous,SUCCESS,"Type: REG_DWORD, Length: 4, Data: 0"
DistantWorlds.exe,RegCloseKey,HKLM\System\CurrentControlSet\Control\Lsa,SUCCESS,
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,"Query: HandleTags, HandleTags: 0x1"
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,"Query: HandleTags, HandleTags: 0x1"
DistantWorlds.exe,RegQueryKey,HKCU\Software\Classes,SUCCESS,Query: Name
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046},NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046},SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046},SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046},SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046},SUCCESS,"Query: HandleTags, HandleTags: 0x401"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32,NAME NOT FOUND,Desired Access: Read
DistantWorlds.exe,RegOpenKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32,SUCCESS,Desired Access: Read
DistantWorlds.exe,RegSetInfoKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32,SUCCESS,"KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32,SUCCESS,Query: Name
DistantWorlds.exe,RegQueryKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32,SUCCESS,"Query: HandleTags, HandleTags: 0x401"
DistantWorlds.exe,RegOpenKey,HKCU\Software\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32,NAME NOT FOUND,Desired Access: Maximum Allowed
DistantWorlds.exe,RegQueryValue,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default),SUCCESS,"Type: REG_SZ, Length: 78, Data: {00000320-0000-0000-C000-000000000046}"
DistantWorlds.exe,RegCloseKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32,SUCCESS,
DistantWorlds.exe,RegCloseKey,HKCR\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046},SUCCESS,
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
DistantWorlds.exe,Process Profiling,,SUCCESS,"User Time: 0.1406250 seconds, Kernel Time: 0.0937500 seconds, Private Bytes: 38,039,552, Working Set: 36,143,104"
