What is NetzFix.exe?

NetzFix.exe is part of 7-Zip and developed by Igor Pavlov according to the NetzFix.exe version information.

NetzFix.exe's description is "7z Setup SFX"

NetzFix.exe is usually located in the 'c:\downloads\' folder.

Some of the anti-virus scanners at VirusTotal detected NetzFix.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on NetzFix.exe:

Property	Value
Product name	7-Zip
Company name	Igor Pavlov
File description	7z Setup SFX
Internal name	7zS.sfx
Original filename	7zS.sfx.exe
Legal copyright	Copyright (c) 1999-2006 Igor Pavlov
Product version	4.42
File version	4.42

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product name	7-Zip
Company name	Igor Pavlov
File description	7z Setup SFX
Internal name	7zS.sfx
Original filename	7zS.sfx.exe
Legal copyright	Copyright (c) 1999-2006 Igor Pavlov
Product version	4.42
File version	4.42

Digital signatures [?]

NetzFix.exe is not signed.

VirusTotal report

7 of the 73 anti-virus programs at VirusTotal detected the NetzFix.exe file. That's a 10% detection rate.

Scanner	Detection Name
Antiy-AVL	RiskWare[RemoteAdmin]/Win32.WinVNC
CAT-QuickHeal	Trojan.Presenoker
Cylance	Unsafe
Fortinet	Riskware/NirCmd
Jiangmin	Trojan/JmGenGeneric.zu
NANO-Antivirus	Riskware.Win32.NirCmd.hglxh
Sophos	NirCmd (PUA)

7 of the 73 anti-virus programs detected the NetzFix.exe file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "file_created": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\winvnc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon3.ico",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\vnchooks.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon2.ico",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\background.bmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon1.ico",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\logo.bmp"
    ],
    "regkey_written": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
    ],
    "dll_loaded": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\dwmapi.dll",
        "gdiplus.dll",
        "ntdll",
        "GDI32.dll",
        "gdi32.dll",
        "KERNEL32.DLL",
        "kernel32.dll",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll",
        "CRYPTBASE.dll",
        "C:\\Windows\\system32\\rsaenh.dll",
        "C:\\Windows\\system32\\ole32.dll",
        "dwmapi.dll",
        "C:\\Windows\\system32\\uxtheme.dll",
        "UxTheme.dll",
        "ADVAPI32.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\culture.dll",
        "C:\\Windows\\syswow64\\MSCTF.dll",
        "C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\uxtheme.dll",
        "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
        "WINMM.dll",
        "OLEAUT32.DLL",
        "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll",
        "advapi32.dll",
        "comctl32",
        "ole32.dll",
        "SHLWAPI.dll",
        "CRYPTSP.dll",
        "USER32.dll",
        "IMM32.dll",
        "C:\\Windows\\system32\\IMM32.DLL",
        "C:\\Windows\\system32\\Winsta.dll",
        "shell32.dll",
        "uxtheme.dll",
        "OLEAUT32.dll",
        "rpcrt4.dll",
        "SHELL32.dll",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll",
        "comctl32.dll",
        "SETUPAPI.dll",
        "COMCTL32.dll",
        "mscoree.dll",
        "RpcRtRemote.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ole32.dll",
        "msvcrt.dll",
        "AdvApi32.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\System.Windows.Forms.ni.dll",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Gdiplus.dll",
        "user32.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll"
    ],
    "file_opened": [
        "C:\\Windows\\Fonts\\msyh.ttf",
        "",
        "C:\\",
        "C:\\Windows\\Fonts\\tahoma.ttf",
        "C:\\Users\\cuck\\",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\background.bmp",
        "C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\",
        "C:\\Windows\\Fonts\\msjh.ttf",
        "C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
        "C:\\Windows\\",
        "C:\\Windows\\assembly\\pubpol4.dat",
        "C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp",
        "C:\\Users\\",
        "C:\\Windows\\System32\\l_intl.nls",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index143.dat",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\",
        "C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\",
        "C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\",
        "C:\\Windows\\Fonts\\malgun.ttf",
        "\\Device\\NamedPipe\\",
        "C:\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\\",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\logo.bmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\winvnc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\",
        "C:\\Users\\cuck\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
        "C:\\Users\\cuck\\AppData\\Local\\",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon3.ico",
        "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon2.ico",
        "C:\\Windows\\Fonts\\micross.ttf",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
        "C:\\Windows\\Fonts\\segoeui.ttf",
        "C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\",
        "C:\\Windows\\System32\\rsaenh.dll",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config",
        "C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp",
        "C:\\Users\\cuck\\AppData\\",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon1.ico"
    ],
    "regkey_opened": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.Accessibility__b03f5f7f11d50a3a",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|7zS574B.tmp|Aero.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Deployment__b03f5f7f11d50a3a",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Assemblies\\Global",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\standards",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Fusion",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|7zS574B.tmp|Aero.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\winvnc.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\Standards",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\534352c2\\15994281",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Security__b03f5f7f11d50a3a",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\index143",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\standards\\v2.0.50727",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\v2.0.50727\\Security\\Policy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System__b77a5c561934e089",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\StrongName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Xml__b77a5c561934e089",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
        "HKEY_CURRENT_USER\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets\\LocalIntranet",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Assemblies\\Global",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\AppPatch",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Drawing__b03f5f7f11d50a3a",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\GACChangeNotification\\Default",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v2.0",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|7zS574B.tmp|Aero.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Shell Dlg",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\628eab58\\6715aae0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\APTCA",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Assemblies\\Global",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
        "HKEY_CURRENT_USER\\Control Panel\\Desktop",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework\\Policy\\Standards",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Windows.Forms__b77a5c561934e089",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\628eab58\\4bde540b",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\Upgrades",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Configuration__b03f5f7f11d50a3a",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\PublisherPolicy\\Default",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets\\Internet",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\internal\\jit\\Perf",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Aero.exe"
    ],
    "file_written": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\winvnc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon3.ico",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\vnchooks.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon2.ico",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon1.ico",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\logo.bmp"
    ],
    "regkey_deleted": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC"
    ],
    "file_deleted": [
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1132.22898000",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1132.22898000",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1132.22898296"
    ],
    "directory_removed": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp"
    ],
    "file_exists": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en-US\\Aero.resources\\Aero.resources.exe",
        "C:\\Windows\\Globalization\\en-us.nlp",
        "C:\\Windows\\assembly\\GAC\\PublisherPolicy.tme",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en\\Aero.resources\\Aero.resources.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en-US\\Aero.resources.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en\\Aero.resources.dll",
        "C:\\Windows\\System32\\cmd.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\\"C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd\"",
        "C:\\Windows\\Fonts\\ahronbd.ttf",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en-US\\Aero.resources\\Aero.resources.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en-US\\Aero.resources.exe",
        "C:\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\\msvcr80.dll",
        "C:\\Windows\\System32\\MSCOREE.DLL.local",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\fusion.localgac",
        "C:\\Windows\\Globalization\\en.nlp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.config",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en\\Aero.resources\\Aero.resources.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en\\Aero.resources.exe"
    ],
    "file_failed": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
        "C:\\Windows\\Microsoft.NET\\Framework64\\Upgrades.2.0.50727\\",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe.config",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch"
    ],
    "guid": [
        "{4590f812-1d3a-11d0-891f-00aa004b2e24}",
        "{00000003-0000-0000-c000-000000000046}",
        "{4590f811-1d3a-11d0-891f-00aa004b2e24}",
        "{44aca674-e8fc-11d0-a07c-00c04fb68820}",
        "{674b6698-ee92-11d0-ad71-00c04fd8fdff}",
        "{8bc3f05e-d86b-11d0-a075-00c04fb68820}",
        "{7c857801-7381-11cf-884d-00aa004b2e24}",
        "{d5f569d0-593b-101a-b569-08002b2dbf7a}",
        "{f309ad18-d86a-11d0-a075-00c04fb68820}",
        "{dc12a687-737f-11cf-884d-00aa004b2e24}"
    ],
    "wmi_query": [
        "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE (  Caption = \"aero.exe\")"
    ],
    "command_line": [
        "reg  query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v PromptOnSecureDesktop_VNC",
        ".\\winvnc.exe",
        "\"C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd\" ",
        "reg  add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop \/t REG_DWORD \/d 0 \/f",
        "C:\\Windows\\system32\\cmd.exe \/c REG QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC",
        "REG  QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC",
        "winvnc.cmd",
        "nircmdc.exe  win hide ititle \"scvnc_start\"",
        "reg  delete \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC \/f",
        "reg  query HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v PromptOnSecureDesktop",
        "taskkill  \/IM aero.exe",
        "winvnc.exe ",
        "REG  QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop",
        "reg  add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop \/t REG_DWORD \/d 0x0 \/f",
        "Aero.exe ",
        "reg  add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC \/t REG_DWORD \/d 0x0",
        "C:\\Windows\\system32\\cmd.exe \/c REG QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop"
    ],
    "file_read": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
        "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config"
    ],
    "regkey_read": [
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\PInvokeInline",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\DisplayName",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewAlphaSelect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\NIDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\NIDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\TailCallOpt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\CompletionChar",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\GDIPlus\\FontCachePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\DefaultLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DisableUNCCheck",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\ConfigMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\DisplayName",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\SaferFlags",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\EnableBalloonTips",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\DbgJITDebugLaunchSetting",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\RemoteRpcDll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\DisableHotCold",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\ILDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\index143\\ILUsageMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\MVID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\DevOverrideEnable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\EvalationData",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AccListViewV6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\WBEM\\CIMOM\\EnableObjectValidation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\PathCompletionChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NoClientChecks",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\ConfigMask",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\EnableExtensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\OnlyUseLatestCLR",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LoggingLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\ForceLog",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\Status",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DelayedExpansion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LogFailures",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DefaultColor",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\ConfigMask",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSUserEnabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\Modules",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\DisplayName",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\PathCompletionChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\MVID",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\DownloadCacheQuotaInKB",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\UseLegacyIdentityFormat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\mscorlib,2.0.0.0,,b77a5c561934e089,AMD64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\EnableExtensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Cryptography\\PrivateKeyLifetimeSeconds",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SESSION MANAGER\\SafeProcessSearchMode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\WBEM\\CIMOM\\Logging",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\index143\\NIUsageMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Cryptography\\PrivKeyCacheMaxItems",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DefaultColor",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\ConfigString",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\C187F7CB",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\MissingDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\GCStressStart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\ConfigString",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\GCStressStartAtJit",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\CacheLocation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\ILDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\LegacyPolicyTimeStamp",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\PolicyScope",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DelayedExpansion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\CLRLoadLogDir",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\MVID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\DbgManagedDebugger",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\MissingDependencies",
        "HKEY_CURRENT_USER\\Control Panel\\Desktop\\SmoothScroll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\NewGCCalc",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\LogFileName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\Modules",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Srp\\GP\\RuleCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\ConfigString",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\LastModTime",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\CompletionChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\LastModTime",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\Levels",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\Latest",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\TURNOFFDEBUGINFO",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DisableUNCCheck",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\ConfigMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\DisableConfigCache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\EvalationData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\EvalationData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\LatestIndex",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\NIDependencies",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewShadow",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\ConfigString",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\NIDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\ILDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Sans Serif",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LogResourceBinds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System,2.0.0.0,,b77a5c561934e089,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\EnableLog",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSAppCompat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\MissingDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\PInvokeCalliOpt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\CseOn",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Cryptography\\PrivKeyCachePurgeIntervalSeconds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\EvalationData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Strong Cryptographic Provider\\Image Path",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\ILDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\SIG",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\VersioningLog",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\DisableMSIPeek",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\MissingDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\MVID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\AutoRun",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\index4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Strong Cryptographic Provider\\Type"
    ],
    "directory_enumerated": [
        "C:\\Users\\cuck\\AppData",
        "C:\\Users\\cuck\\AppData\\Local\\Temp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp",
        "C:\\Python27\\reg.*",
        "C:\\Python27\\Scripts\\reg.*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
        "C:\\Python27\\Scripts\\taskkill.*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\REG.*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\reg.*",
        "C:\\Windows\\System32\\reg.*",
        "C:\\Users\\cuck\\AppData\\Local",
        "C:\\Python27\\taskkill.*",
        "C:\\Windows\\System32\\taskkill.COM",
        "C:\\Python27\\REG.*",
        "C:\\Python27\\Scripts\\REG.*",
        "C:\\Users",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\logo.bmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\winvnc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
        "C:\\Windows\\System32\\REG.*",
        "C:\\Windows\\System32\\reg.COM",
        "C:\\Windows\\System32\\taskkill.*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\taskkill",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\*",
        "C:\\Python27\\Scripts\\taskkill",
        "C:\\Users\\cuck",
        "C:\\Python27\\Scripts\\reg",
        "C:\\Windows\\System32\\taskkill.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\background.bmp",
        "C:\\Python27\\REG",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\reg",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon3.ico",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\vnchooks.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\taskkill.*",
        "C:\\Python27\\reg",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
        "C:\\Python27\\Scripts\\REG",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon2.ico",
        "C:\\Python27\\taskkill",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon1.ico",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\REG",
        "C:\\Windows\\System32\\reg.exe"
    ],
    "directory_created": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp"
    ]
}

Dropped

[
    {
        "yara": [],
        "sha1": "2a67098e0c3708b14a53920755002a20ea618d84",
        "name": "8b5e63a9c9edf719_nircmdc.exe",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
        "type": "PE32 executable (console) Intel 80386, for MS Windows, UPX compressed",
        "sha256": "8b5e63a9c9edf7191ac8465a4be2d76b4ab5b33be29c5153c129e0665667699c",
        "urls": [],
        "crc32": "52F8DDEF",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/1090\/files\/8b5e63a9c9edf719_nircmdc.exe",
        "ssdeep": null,
        "size": 26112,
        "sha512": "a646049663a6f9fcb9c6d802fbf9665a97acdf0483fe8c01894c76b70c0be284f21f4ef45a5ebb10cd3fabb1cf41ec916d1a3db6a374fea7e3a628132903c033",
        "pids": [
            2308
        ],
        "md5": "65dad2d20e660c212a5f2a421a819847"
    },
    {
        "yara": [],
        "sha1": "cb0d021a4879bb556c16722f3f7e6abd7cd72cca",
        "name": "c27ab8e85dbe676d_winvnc.exe",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
        "type": "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed",
        "sha256": "c27ab8e85dbe676d52ebd662e92af04e172679935c137becd06efd8257624e1a",
        "urls": [],
        "crc32": "F6B0F4AC",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/1090\/files\/c27ab8e85dbe676d_winvnc.exe",
        "ssdeep": null,
        "size": 191500,
        "sha512": "bc781ee0d39744d6429017eb1694ea75dbb7793a4ba60e9ee5200e7a97d77bf1bb2653a3c5392c91e6a29dda09b5c259ef98126efc455d9aa1dd3a88f19defb5",
        "pids": [
            2308
        ],
        "md5": "d8862589975e9a0b25b4730449583427"
    },
    {
        "yara": [],
        "sha1": "08c547f1477b3d9952af8f22120a44bec7c50e17",
        "name": "6ecff4195638797e_vnchooks.dll",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\vnchooks.dll",
        "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
        "sha256": "6ecff4195638797e62137fb2b37f1f92bb02bf42b5f9ba8ecbfd69f11495c412",
        "urls": [
            "http:\/\/crl.verisign.com\/ThawteTimestampingCA.crl0",
            "http:\/\/ocsp.verisign.com0",
            "http:\/\/crl.globalsign.net\/ObjectSign.crl0",
            "http:\/\/crl.globalsign.net\/primobject.crl0",
            "http:\/\/crl.globalsign.net\/Root.crl0",
            "http:\/\/crl.verisign.com\/tss-ca.crl0"
        ],
        "crc32": "841EF56B",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/1090\/files\/6ecff4195638797e_vnchooks.dll",
        "ssdeep": null,
        "size": 104088,
        "sha512": "3332d6d2a4e5e64c1076f213e034274622b61c8930d4c9cf3bf741e224c6f5ced2915e56bd6acf526cf2d68e943cf4c88b27d99274b0c3b997bcbe02df836967",
        "pids": [
            2308
        ],
        "md5": "76b9ca4c686a652476bb72035eefe0cf"
    },
    {
        "yara": [],
        "sha1": "35d2a313b657d809bf6b069dc8c49882d919f8b9",
        "name": "d1e43642deed7a9a_winvnc.cmd",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
        "type": "DOS batch file, ASCII text, with CRLF line terminators",
        "sha256": "d1e43642deed7a9ac271d8c9bb5a1d93a52fe5c196118cd215f8407ff9d1a3b4",
        "urls": [],
        "crc32": "474C882E",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/1090\/files\/d1e43642deed7a9a_winvnc.cmd",
        "ssdeep": null,
        "size": 1664,
        "sha512": "5085803e44e8fd828cc7f4c74ea2ff075924e336b42bb66b530806d2e7e22e065b877d461b0b087ef4947200065fcd73cd880893e663aef3209aaa2754e39f2b",
        "pids": [
            2308
        ],
        "md5": "fa07e7668040cf16a197c434b141a979"
    }
]

Generic

[
    {
        "process_path": "C:\\Windows\\SysWOW64\\reg.exe",
        "process_name": "reg.exe",
        "pid": 608,
        "summary": {
            "file_opened": [
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "dll_loaded": [
                "kernel32.dll"
            ]
        },
        "first_seen": 1563331990.9835,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\reg.exe",
        "process_name": "reg.exe",
        "pid": 2800,
        "summary": {
            "file_opened": [
                "C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
            ],
            "dll_loaded": [
                "kernel32.dll"
            ],
            "regkey_written": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
            ]
        },
        "first_seen": 1563331988.1085,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\reg.exe",
        "process_name": "reg.exe",
        "pid": 2660,
        "summary": {
            "file_opened": [
                "C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "dll_loaded": [
                "kernel32.dll"
            ],
            "regkey_written": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC"
            ]
        },
        "first_seen": 1563331987.6554,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\reg.exe",
        "process_name": "reg.exe",
        "pid": 2292,
        "summary": {
            "file_opened": [
                "C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "dll_loaded": [
                "kernel32.dll"
            ],
            "regkey_deleted": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC"
            ]
        },
        "first_seen": 1563331991.7648,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\taskkill.exe",
        "process_name": "taskkill.exe",
        "pid": 2472,
        "summary": {
            "dll_loaded": [
                "C:\\Windows\\system32\\Winsta.dll"
            ],
            "file_opened": [
                "C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32",
                "HKEY_CURRENT_USER\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}",
                "HKEY_CURRENT_USER\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
            ],
            "wmi_query": [
                "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE (  Caption = \"aero.exe\")"
            ],
            "guid": [
                "{4590f812-1d3a-11d0-891f-00aa004b2e24}",
                "{00000003-0000-0000-c000-000000000046}",
                "{4590f811-1d3a-11d0-891f-00aa004b2e24}",
                "{44aca674-e8fc-11d0-a07c-00c04fb68820}",
                "{674b6698-ee92-11d0-ad71-00c04fd8fdff}",
                "{8bc3f05e-d86b-11d0-a075-00c04fb68820}",
                "{7c857801-7381-11cf-884d-00aa004b2e24}",
                "{d5f569d0-593b-101a-b569-08002b2dbf7a}",
                "{f309ad18-d86a-11d0-a075-00c04fb68820}",
                "{dc12a687-737f-11cf-884d-00aa004b2e24}"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\WBEM\\CIMOM\\Logging",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\WBEM\\CIMOM\\EnableObjectValidation"
            ]
        },
        "first_seen": 1563331991.9835,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
        "process_name": "Aero.exe",
        "pid": 1132,
        "summary": {
            "dll_loaded": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\dwmapi.dll",
                "gdiplus.dll",
                "ntdll",
                "gdi32.dll",
                "kernel32.dll",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll",
                "CRYPTBASE.dll",
                "C:\\Windows\\system32\\rsaenh.dll",
                "dwmapi.dll",
                "ADVAPI32.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\culture.dll",
                "C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\uxtheme.dll",
                "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
                "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll",
                "advapi32.dll",
                "ole32.dll",
                "SHLWAPI.dll",
                "CRYPTSP.dll",
                "C:\\Windows\\system32\\IMM32.DLL",
                "shell32.dll",
                "uxtheme.dll",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll",
                "mscoree.dll",
                "RpcRtRemote.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ole32.dll",
                "AdvApi32.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\System.Windows.Forms.ni.dll",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Gdiplus.dll",
                "user32.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll"
            ],
            "file_opened": [
                "C:\\Windows\\Fonts\\msyh.ttf",
                "C:\\",
                "C:\\Windows\\Fonts\\tahoma.ttf",
                "C:\\Users\\cuck\\",
                "C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\",
                "C:\\Windows\\Fonts\\msjh.ttf",
                "C:\\Windows\\",
                "C:\\Windows\\assembly\\pubpol4.dat",
                "C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp",
                "C:\\Users\\",
                "C:\\Windows\\System32\\l_intl.nls",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index143.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\",
                "C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\",
                "C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\",
                "C:\\Windows\\Fonts\\malgun.ttf",
                "C:\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\\",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\",
                "C:\\Users\\cuck\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
                "C:\\Users\\cuck\\AppData\\Local\\",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\",
                "C:\\Windows\\Fonts\\micross.ttf",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
                "C:\\Windows\\Fonts\\segoeui.ttf",
                "C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\",
                "C:\\Windows\\System32\\rsaenh.dll",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config",
                "C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp",
                "C:\\Users\\cuck\\AppData\\"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.Accessibility__b03f5f7f11d50a3a",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Assemblies\\Global",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|7zS574B.tmp|Aero.exe",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Drawing__b03f5f7f11d50a3a",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\index143",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Deployment__b03f5f7f11d50a3a",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Configuration__b03f5f7f11d50a3a",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets\\LocalIntranet",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\GACChangeNotification\\Default",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\534352c2\\15994281",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework\\Policy\\Standards",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Assemblies\\Global",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Windows.Forms__b77a5c561934e089",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\628eab58\\4bde540b",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Security__b03f5f7f11d50a3a",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Assemblies\\Global",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\standards",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Fusion",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\Upgrades",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\standards\\v2.0.50727",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\v2.0.50727\\Security\\Policy",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System__b77a5c561934e089",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\StrongName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\PublisherPolicy\\Default",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Xml__b77a5c561934e089",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v2.0",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|7zS574B.tmp|Aero.exe",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets\\Internet",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|7zS574B.tmp|Aero.exe",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\internal\\jit\\Perf",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Aero.exe",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\628eab58\\6715aae0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\APTCA",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\AppPatch",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\Standards",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e"
            ],
            "file_deleted": [
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1132.22898000",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1132.22898000",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1132.22898296"
            ],
            "file_exists": [
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config",
                "C:\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\\msvcr80.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en\\Aero.resources\\Aero.resources.dll",
                "C:\\Windows\\System32\\MSCOREE.DLL.local",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en-US\\Aero.resources\\Aero.resources.exe",
                "C:\\Windows\\Globalization\\en-us.nlp",
                "C:\\Windows\\Fonts\\ahronbd.ttf",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\fusion.localgac",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en\\Aero.resources.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en-US\\Aero.resources\\Aero.resources.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
                "C:\\Windows\\Globalization\\en.nlp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en-US\\Aero.resources.exe",
                "C:\\Windows\\assembly\\GAC\\PublisherPolicy.tme",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.config",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en\\Aero.resources\\Aero.resources.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en-US\\Aero.resources.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\en\\Aero.resources.dll"
            ],
            "file_failed": [
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch",
                "C:\\Windows\\Microsoft.NET\\Framework64\\Upgrades.2.0.50727\\",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe.config",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config",
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch"
            ],
            "file_read": [
                "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\PInvokeInline",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\NIDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\NIDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\TailCallOpt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\Modules",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\GDIPlus\\FontCachePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\ConfigMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\DbgJITDebugLaunchSetting",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\RemoteRpcDll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\DisableHotCold",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\ILDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\index143\\ILUsageMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\MVID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\DevOverrideEnable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\EvalationData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NoClientChecks",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\ConfigMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\475dce40\\2d382ce6\\8d\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\OnlyUseLatestCLR",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LoggingLevel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\ForceLog",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LogFailures",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\ConfigMask",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSUserEnabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\MVID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\DownloadCacheQuotaInKB",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\UseLegacyIdentityFormat",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\mscorlib,2.0.0.0,,b77a5c561934e089,AMD64",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Cryptography\\PrivateKeyLifetimeSeconds",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SESSION MANAGER\\SafeProcessSearchMode",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\index143\\NIUsageMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Cryptography\\PrivKeyCacheMaxItems",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\ConfigString",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\C187F7CB",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\MissingDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\GCStressStart",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\424bd4d8\\1c83327b\\8e\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\ConfigString",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\GCStressStartAtJit",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\CacheLocation",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\ILDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\LegacyPolicyTimeStamp",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\CLRLoadLogDir",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\MVID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\DbgManagedDebugger",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\MissingDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\NewGCCalc",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\InstallRoot",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\ConfigString",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3ced59c5\\1b2590b1\\85\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\Latest",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\TURNOFFDEBUGINFO",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\ConfigMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\7950e2c5\\19b8f67f\\82\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\c991064\\2bd33e1c\\81\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\DisableConfigCache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\EvalationData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\EvalationData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\LatestIndex",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\NIDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\ConfigString",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\NIDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\19ab8d57\\1bd7b0d8\\8f\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\ILDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LogResourceBinds",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System,2.0.0.0,,b77a5c561934e089,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\EnableLog",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\TSAppCompat",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\3cca06a0\\6dc7d4c0\\84\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\181938c6\\7950e2c5\\82\\MissingDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\PInvokeCalliOpt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\CseOn",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\41c04c7e\\7f3b6ac4\\80\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\2dd6ac50\\163e1f5e\\8a\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Cryptography\\PrivKeyCachePurgeIntervalSeconds",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\EvalationData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Strong Cryptographic Provider\\Image Path",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\ILDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\3f50fe4f\\6f1da7aa\\90\\SIG",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\VersioningLog",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\DisableMSIPeek",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\61e7e666\\c991064\\83\\MissingDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\IL\\6dc7d4c0\\a5cd4db\\87\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_64\\NI\\30bc7c4f\\3f50fe4f\\90\\MVID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\index4",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Strong Cryptographic Provider\\Type"
            ]
        },
        "first_seen": 1563331985.7188,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\reg.exe",
        "process_name": "reg.exe",
        "pid": 1676,
        "summary": {
            "file_opened": [
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "dll_loaded": [
                "kernel32.dll"
            ]
        },
        "first_seen": 1563331991.3898,
        "ppid": 312
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1563331984.3281,
        "ppid": 376
    },
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\winvnc.exe",
        "process_name": "winvnc.exe",
        "pid": 1744,
        "summary": {
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\background.bmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\logo.bmp",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
                "HKEY_CURRENT_USER\\Control Panel\\Desktop",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\winvnc.exe",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt"
            ],
            "regkey_read": [
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewShadow",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewAlphaSelect",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AccListViewV6",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\EnableBalloonTips",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Sans Serif",
                "HKEY_CURRENT_USER\\Control Panel\\Desktop\\SmoothScroll"
            ],
            "dll_loaded": [
                "C:\\Windows\\system32\\uxtheme.dll",
                "C:\\Windows\\syswow64\\MSCTF.dll",
                "kernel32.dll",
                "UxTheme.dll",
                "OLEAUT32.DLL",
                "C:\\Windows\\system32\\ole32.dll",
                "dwmapi.dll",
                "comctl32",
                "comctl32.dll",
                "IMM32.dll"
            ]
        },
        "first_seen": 1563331988.7491,
        "ppid": 2244
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\reg.exe",
        "process_name": "reg.exe",
        "pid": 2792,
        "summary": {
            "file_opened": [
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
            ],
            "dll_loaded": [
                "kernel32.dll"
            ]
        },
        "first_seen": 1563331985.5781,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
        "process_name": "nircmdc.exe",
        "pid": 2804,
        "summary": {
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "dll_loaded": [
                "WINMM.dll",
                "GDI32.dll",
                "SHELL32.dll",
                "KERNEL32.DLL",
                "msvcrt.dll",
                "ADVAPI32.dll",
                "ole32.dll",
                "USER32.dll"
            ]
        },
        "first_seen": 1563331985.3594,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\cmd.exe",
        "process_name": "cmd.exe",
        "pid": 2820,
        "summary": {
            "dll_loaded": [
                "ADVAPI32.dll",
                "kernel32.dll"
            ],
            "file_opened": [
                "",
                "\\Device\\NamedPipe\\",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor"
            ],
            "file_exists": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
                "C:\\Windows\\System32\\cmd.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\\"C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd\""
            ],
            "command_line": [
                "reg  query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v PromptOnSecureDesktop_VNC",
                "reg  add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop \/t REG_DWORD \/d 0 \/f",
                "C:\\Windows\\system32\\cmd.exe \/c REG QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC",
                "reg  add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC \/t REG_DWORD \/d 0x0",
                "reg  delete \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC \/f",
                "reg  query HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v PromptOnSecureDesktop",
                "taskkill  \/IM aero.exe",
                "winvnc.exe ",
                "reg  add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop \/t REG_DWORD \/d 0x0 \/f",
                "Aero.exe ",
                "nircmdc.exe  win hide ititle \"scvnc_start\"",
                "C:\\Windows\\system32\\cmd.exe \/c REG QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DisableUNCCheck",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\LogFileName",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DelayedExpansion",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\CompletionChar",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DefaultColor",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DelayedExpansion",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\EnableExtensions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\DefaultLevel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\PathCompletionChar",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\CompletionChar",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\EnableExtensions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\SaferFlags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\PolicyScope",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Srp\\GP\\RuleCount",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\PathCompletionChar",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\Levels",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DisableUNCCheck",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DefaultColor",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\AutoRun"
            ],
            "directory_enumerated": [
                "C:\\Python27\\taskkill.*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Python27\\reg.*",
                "C:\\Python27\\Scripts\\reg.*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
                "C:\\Python27\\Scripts\\taskkill.*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\reg.*",
                "C:\\Windows\\System32\\reg.*",
                "C:\\Users\\cuck\\AppData\\Local",
                "C:\\Users\\cuck\\AppData",
                "C:\\Windows\\System32\\taskkill.COM",
                "C:\\Users",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
                "C:\\Windows\\System32\\reg.COM",
                "C:\\Windows\\System32\\taskkill.*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\taskkill",
                "C:\\Python27\\Scripts\\taskkill",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\taskkill.*",
                "C:\\Python27\\Scripts\\reg",
                "C:\\Windows\\System32\\taskkill.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\reg",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
                "C:\\Users\\cuck",
                "C:\\Python27\\reg",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
                "C:\\Python27\\taskkill",
                "C:\\Windows\\System32\\reg.exe"
            ]
        },
        "first_seen": 1563331985.1406,
        "ppid": 2308
    },
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
        "process_name": "winvnc.exe",
        "pid": 2244,
        "summary": {
            "file_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\winvnc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon3.ico",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon2.ico",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\background.bmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\logo.bmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon1.ico"
            ],
            "directory_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp"
            ],
            "dll_loaded": [
                "comctl32.dll",
                "C:\\Windows\\syswow64\\MSCTF.dll",
                "kernel32.dll",
                "dwmapi.dll",
                "KERNEL32.DLL",
                "OLEAUT32.dll",
                "C:\\Windows\\system32\\ole32.dll",
                "SHELL32.dll",
                "OLEAUT32.DLL",
                "COMCTL32.dll",
                "USER32.dll",
                "C:\\Windows\\system32\\uxtheme.dll"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\winvnc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon2.ico",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon3.ico",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\background.bmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\logo.bmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon1.ico"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\winvnc.exe",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Shell Dlg",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}"
            ],
            "file_written": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\winvnc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon3.ico",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon2.ico",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\logo.bmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon1.ico"
            ],
            "directory_removed": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp"
            ],
            "file_failed": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp"
            ],
            "command_line": [
                ".\\winvnc.exe"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe"
            ],
            "regkey_read": [
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "directory_enumerated": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\winvnc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon3.ico",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\helpdesk.txt",
                "C:\\Users\\cuck\\AppData",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp",
                "C:\\Users\\cuck",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon2.ico",
                "C:\\Users",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\background.bmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\icon1.ico",
                "C:\\Users\\cuck\\AppData\\Local",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS6594.tmp\\logo.bmp"
            ]
        },
        "first_seen": 1563331988.4523,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\cmd.exe",
        "process_name": "cmd.exe",
        "pid": 312,
        "summary": {
            "dll_loaded": [
                "kernel32.dll"
            ],
            "file_opened": [
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor"
            ],
            "file_exists": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp"
            ],
            "command_line": [
                "REG  QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DefaultColor",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DelayedExpansion",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DisableUNCCheck",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\EnableExtensions",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\CompletionChar",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\EnableExtensions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\PathCompletionChar",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\PathCompletionChar",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DisableUNCCheck",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DelayedExpansion",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\AutoRun",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DefaultColor",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\CompletionChar"
            ],
            "directory_enumerated": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\REG.*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
                "C:\\Users\\cuck\\AppData",
                "C:\\Windows\\System32\\reg.COM",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\REG",
                "C:\\Windows\\System32\\REG.*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Python27\\REG.*",
                "C:\\Users\\cuck",
                "C:\\Python27\\Scripts\\REG",
                "C:\\Python27\\Scripts\\REG.*",
                "C:\\Users",
                "C:\\Python27\\REG",
                "C:\\Users\\cuck\\AppData\\Local",
                "C:\\Windows\\System32\\reg.exe"
            ]
        },
        "first_seen": 1563331991.1866,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin",
        "process_name": "c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin",
        "pid": 2308,
        "summary": {
            "file_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\vnchooks.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe"
            ],
            "directory_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp"
            ],
            "dll_loaded": [
                "SETUPAPI.dll",
                "C:\\Windows\\syswow64\\MSCTF.dll",
                "kernel32.dll",
                "OLEAUT32.DLL",
                "C:\\Windows\\system32\\ole32.dll",
                "dwmapi.dll",
                "rpcrt4.dll",
                "C:\\Windows\\system32\\uxtheme.dll",
                "comctl32.dll"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Shell Dlg",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}"
            ],
            "file_written": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\vnchooks.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe"
            ],
            "file_failed": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp"
            ],
            "command_line": [
                "winvnc.cmd",
                "\"C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd\" "
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin"
            ],
            "regkey_read": [
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName"
            ],
            "directory_enumerated": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.cmd",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
                "C:\\Users\\cuck\\AppData",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504.bin",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\vnchooks.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\Aero.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Users\\cuck",
                "C:\\Users",
                "C:\\Users\\cuck\\AppData\\Local",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe"
            ]
        },
        "first_seen": 1563331984.7969,
        "ppid": 3040
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\reg.exe",
        "process_name": "reg.exe",
        "pid": 2184,
        "summary": {
            "file_opened": [
                "C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
            ],
            "dll_loaded": [
                "kernel32.dll"
            ],
            "regkey_written": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
            ]
        },
        "first_seen": 1563331991.5929,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\cmd.exe",
        "process_name": "cmd.exe",
        "pid": 2684,
        "summary": {
            "dll_loaded": [
                "kernel32.dll"
            ],
            "file_opened": [
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor"
            ],
            "file_exists": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp"
            ],
            "command_line": [
                "REG  QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DefaultColor",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DelayedExpansion",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DisableUNCCheck",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\EnableExtensions",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\CompletionChar",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\EnableExtensions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\PathCompletionChar",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\PathCompletionChar",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DisableUNCCheck",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DelayedExpansion",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\AutoRun",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DefaultColor",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\CompletionChar"
            ],
            "directory_enumerated": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\REG.*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp",
                "C:\\Users\\cuck\\AppData",
                "C:\\Windows\\System32\\reg.COM",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\REG",
                "C:\\Windows\\System32\\REG.*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Python27\\REG.*",
                "C:\\Users\\cuck",
                "C:\\Python27\\Scripts\\REG",
                "C:\\Python27\\Scripts\\REG.*",
                "C:\\Users",
                "C:\\Python27\\REG",
                "C:\\Users\\cuck\\AppData\\Local",
                "C:\\Windows\\System32\\reg.exe"
            ]
        },
        "first_seen": 1563331986.8898,
        "ppid": 2820
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\reg.exe",
        "process_name": "reg.exe",
        "pid": 2312,
        "summary": {
            "file_opened": [
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
            ],
            "dll_loaded": [
                "kernel32.dll"
            ]
        },
        "first_seen": 1563331987.4523,
        "ppid": 2684
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\reg.exe",
        "process_name": "reg.exe",
        "pid": 3036,
        "summary": {
            "file_opened": [
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "dll_loaded": [
                "kernel32.dll"
            ]
        },
        "first_seen": 1563331986.546,
        "ppid": 2820
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "Queries for the computername",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GetComputerNameW",
                    "return_value": 1,
                    "arguments": {
                        "computer_name": "CUCKPC"
                    },
                    "time": 1563331992.1085,
                    "tid": 528,
                    "flags": {}
                },
                "pid": 2472,
                "type": "call",
                "cid": 89
            }
        ],
        "references": [],
        "name": "antivm_queries_computername"
    },
    {
        "markcount": 4,
        "families": [],
        "description": "Checks if process is being debugged by a debugger",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "system",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 0,
                    "nt_status": -1073741771,
                    "api": "IsDebuggerPresent",
                    "return_value": 0,
                    "arguments": {},
                    "time": 1563331984.9069,
                    "tid": 1664,
                    "flags": {}
                },
                "pid": 2308,
                "type": "call",
                "cid": 208
            },
            {
                "call": {
                    "category": "system",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 0,
                    "nt_status": -1073741700,
                    "api": "IsDebuggerPresent",
                    "return_value": 0,
                    "arguments": {},
                    "time": 1563331556.519,
                    "tid": 2964,
                    "flags": {}
                },
                "pid": 1132,
                "type": "call",
                "cid": 374
            },
            {
                "call": {
                    "category": "system",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 0,
                    "nt_status": -1073741771,
                    "api": "IsDebuggerPresent",
                    "return_value": 0,
                    "arguments": {},
                    "time": 1563331988.5622,
                    "tid": 300,
                    "flags": {}
                },
                "pid": 2244,
                "type": "call",
                "cid": 317
            },
            {
                "call": {
                    "category": "system",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 0,
                    "nt_status": -1073741816,
                    "api": "IsDebuggerPresent",
                    "return_value": 0,
                    "arguments": {},
                    "time": 1563331988.8271,
                    "tid": 2472,
                    "flags": {}
                },
                "pid": 1744,
                "type": "call",
                "cid": 88
            }
        ],
        "references": [],
        "name": "checks_debugger"
    },
    {
        "markcount": 15,
        "families": [],
        "description": "Command line console output was observed",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\n",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331985.6411,
                    "tid": 1496,
                    "flags": {}
                },
                "pid": 2792,
                "type": "call",
                "cid": 21
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "PromptOnSecureDesktop",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331985.6411,
                    "tid": 1496,
                    "flags": {}
                },
                "pid": 2792,
                "type": "call",
                "cid": 25
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "REG_DWORD",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331985.6411,
                    "tid": 1496,
                    "flags": {}
                },
                "pid": 2792,
                "type": "call",
                "cid": 29
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "0x0",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331985.6411,
                    "tid": 1496,
                    "flags": {}
                },
                "pid": 2792,
                "type": "call",
                "cid": 33
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "ERROR: ",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1563331986.671,
                    "tid": 2868,
                    "flags": {}
                },
                "pid": 3036,
                "type": "call",
                "cid": 24
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "The system was unable to find the specified registry key or value.\n",
                        "console_handle": "0x0000000b"
                    },
                    "time": 1563331986.671,
                    "tid": 2868,
                    "flags": {}
                },
                "pid": 3036,
                "type": "call",
                "cid": 26
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "The operation completed successfully.\r\n",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331987.7484,
                    "tid": 2732,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 24
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "The operation completed successfully.\r\n",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331988.2015,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 2800,
                "type": "call",
                "cid": 26
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\n",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331991.0765,
                    "tid": 2668,
                    "flags": {}
                },
                "pid": 608,
                "type": "call",
                "cid": 21
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "PromptOnSecureDesktop_VNC",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331991.0765,
                    "tid": 2668,
                    "flags": {}
                },
                "pid": 608,
                "type": "call",
                "cid": 25
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "REG_DWORD",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331991.0765,
                    "tid": 2668,
                    "flags": {}
                },
                "pid": 608,
                "type": "call",
                "cid": 29
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "0x0",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331991.0765,
                    "tid": 2668,
                    "flags": {}
                },
                "pid": 608,
                "type": "call",
                "cid": 33
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "The operation completed successfully.\r\n",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331991.6559,
                    "tid": 3052,
                    "flags": {}
                },
                "pid": 2184,
                "type": "call",
                "cid": 26
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "The operation completed successfully.\r\n",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331991.8428,
                    "tid": 2332,
                    "flags": {}
                },
                "pid": 2292,
                "type": "call",
                "cid": 25
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteConsoleW",
                    "return_value": 1,
                    "arguments": {
                        "buffer": "SUCCESS: Sent termination signal to the process \"Aero.exe\" with PID 1132.\n",
                        "console_handle": "0x00000007"
                    },
                    "time": 1563331992.1555,
                    "tid": 528,
                    "flags": {}
                },
                "pid": 2472,
                "type": "call",
                "cid": 261
            }
        ],
        "references": [],
        "name": "console_output"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate)",
        "severity": 1,
        "marks": [
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "recon_fingerprint"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "system",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GlobalMemoryStatusEx",
                    "return_value": 1,
                    "arguments": {},
                    "time": 1563331984.9999,
                    "tid": 1948,
                    "flags": {}
                },
                "pid": 2308,
                "type": "call",
                "cid": 650
            }
        ],
        "references": [],
        "name": "antivm_memory_available"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "The executable uses a known packer",
        "severity": 1,
        "marks": [
            {
                "category": "packer",
                "ioc": "Armadillo v1.71",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "peid_packer"
    },
    {
        "markcount": 66,
        "families": [],
        "description": "Allocates read-write-execute memory (usually to unpack itself)",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef1b1000"
                    },
                    "time": 1563331556.425,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 258
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42e000"
                    },
                    "time": 1563331556.472,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 333
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42e000"
                    },
                    "time": 1563331556.488,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 335
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42f000"
                    },
                    "time": 1563331556.519,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 385
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42f000"
                    },
                    "time": 1563331556.519,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 387
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42f000"
                    },
                    "time": 1563331556.519,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 389
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42f000"
                    },
                    "time": 1563331556.519,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 391
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42f000"
                    },
                    "time": 1563331556.519,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 393
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42f000"
                    },
                    "time": 1563331556.519,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 395
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42f000"
                    },
                    "time": 1563331556.519,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 397
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42f000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 399
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef430000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 401
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef430000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 403
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef430000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 405
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef430000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 407
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef430000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 409
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef431000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 411
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef431000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 413
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef431000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 415
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef431000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 417
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feef42e000"
                    },
                    "time": 1563331556.535,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 419
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00022000"
                    },
                    "time": 1563331556.878,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 539
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 589824,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 1056768,
                        "base_address": "0x000007fffff20000"
                    },
                    "time": 1563331556.925,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_RESERVE|MEM_TOP_DOWN"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 589
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007fffff20000"
                    },
                    "time": 1563331556.925,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 590
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007fffff20000"
                    },
                    "time": 1563331556.925,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 591
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 65536,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 1056768,
                        "base_address": "0x000007fffff10000"
                    },
                    "time": 1563331556.925,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_RESERVE|MEM_TOP_DOWN"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 592
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007fffff10000"
                    },
                    "time": 1563331556.925,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 593
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff000da000"
                    },
                    "time": 1563331556.925,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 594
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00012000"
                    },
                    "time": 1563331556.925,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 595
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00023000"
                    },
                    "time": 1563331556.988,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 613
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff000ea000"
                    },
                    "time": 1563331557.019,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 622
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00112000"
                    },
                    "time": 1563331557.019,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 623
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff000ed000"
                    },
                    "time": 1563331557.019,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 624
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff0002c000"
                    },
                    "time": 1563331557.066,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 665
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 8192,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00024000"
                    },
                    "time": 1563331557.378,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 912
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00026000"
                    },
                    "time": 1563331557.378,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 913
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00027000"
                    },
                    "time": 1563331557.378,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 917
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00160000"
                    },
                    "time": 1563331557.378,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 920
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff0002a000"
                    },
                    "time": 1563331557.41,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 947
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff0003f000"
                    },
                    "time": 1563331557.425,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 948
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00074000"
                    },
                    "time": 1563331557.425,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 951
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff00043000"
                    },
                    "time": 1563331557.425,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 952
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff0002b000"
                    },
                    "time": 1563331557.425,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 953
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff001a0000"
                    },
                    "time": 1563331557.425,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 955
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff001a1000"
                    },
                    "time": 1563331557.441,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 963
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff000db000"
                    },
                    "time": 1563331557.55,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 1005
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff001a2000"
                    },
                    "time": 1563331557.581,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 1020
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 16384,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x0000000000362000"
                    },
                    "time": 1563331557.628,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 1038
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 53248,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x0000000000366000"
                    },
                    "time": 1563331557.628,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 1039
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1132,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x000007ff0001a000"
                    },
                    "time": 1563331557.628,
                    "tid": 2964,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1132,
                "type": "call",
                "cid": 1046
            }
        ],
        "references": [],
        "name": "allocates_rwx"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Creates a suspicious process",
        "severity": 2,
        "marks": [
            {
                "category": "cmdline",
                "ioc": "C:\\Windows\\system32\\cmd.exe \/c REG QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "C:\\Windows\\system32\\cmd.exe \/c REG QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "suspicious_process"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Drops a binary and executes it",
        "severity": 2,
        "marks": [
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
                "type": "ioc",
                "description": null
            },
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "dropper"
    },
    {
        "markcount": 3,
        "families": [],
        "description": "Drops an executable to the user AppData folder",
        "severity": 2,
        "marks": [
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\nircmdc.exe",
                "type": "ioc",
                "description": null
            },
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\winvnc.exe",
                "type": "ioc",
                "description": null
            },
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\7zS574B.tmp\\vnchooks.dll",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "exe_appdata"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Executes one or more WMI queries",
        "severity": 2,
        "marks": [
            {
                "category": "wmi",
                "ioc": "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE (  Caption = \"aero.exe\")",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "has_wmi"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks for the Locally Unique Identifier on the system for a suspicious privilege",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "system",
                    "status": 1,
                    "stacktrace": [],
                    "api": "LookupPrivilegeValueW",
                    "return_value": 1,
                    "arguments": {
                        "system_name": "",
                        "privilege_name": "SeDebugPrivilege"
                    },
                    "time": 1563331992.0925,
                    "tid": 528,
                    "flags": {}
                },
                "pid": 2472,
                "type": "call",
                "cid": 70
            }
        ],
        "references": [],
        "name": "privilege_luid_check"
    },
    {
        "markcount": 495,
        "families": [],
        "description": "Potentially malicious URLs were found in the process memory dump",
        "severity": 2,
        "marks": [
            {
                "category": "url",
                "ioc": "http:\/\/www.expedia.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/uk.ask.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.priceminister.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.iask.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/ocsp.infonotary.com\/responder.cgi0V",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.merlin.com.pl\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.cnet.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.certificadodigital.com.br\/repositorio\/serasaca\/crl\/SerasaCAII.crl0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.nifty.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/ns.adobe.com\/exif\/1.0\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.etmall.com.tw\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/crl.chambersign.org\/publicnotaryroot.crl0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.goo.ne.jp\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/fr.wikipedia.org\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/busca.estadao.com.br\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.hanafos.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.chol.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/purl.org\/rss\/1.0\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/amazon.fr\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.amazon.co.jp\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.mtv.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/busqueda.aol.com.mx\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.live.com\/results.aspx?FORM=SOLTDF",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/msdn.microsoft.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/msdn.microsoft.com\/workshop\/security\/privacy\/overview\/privacyimportxml.asp)",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.sify.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/yellowpages.superpages.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/suche.freenet.de\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/crl.chambersign.org\/chambersroot.crl0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.aol.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/browse.guardian.co.uk\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.mercadolibre.com.mx\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.asharqalawsat.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.facebook.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/si.wikipedia.org\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.rtl.de\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.msn.com\/results.aspx?q=",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.microsoft.com.",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.naver.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/fedir.comsign.co.il\/cacert\/ComSignAdvancedSecurityCA.crt0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/crl.usertrust.com\/UTN-USERFirst-NetworkApplications.crl0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "https:\/\/www.netlock.net\/docs",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/en.wikipedia.org\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/si.wikipedia.org\/w\/api.php?action=opensearch",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.signatur.rtr.at\/de\/directory\/cps.html0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/udn.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/rover.ebay.com",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.ebay.fr\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.univision.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/pt.wikipedia.org\/w\/api.php?action=opensearch",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "memdump_urls"
    },
    {
        "markcount": 11,
        "families": [],
        "description": "Uses Windows utilities for basic Windows functionality",
        "severity": 2,
        "marks": [
            {
                "category": "cmdline",
                "ioc": "reg  query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v PromptOnSecureDesktop_VNC",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "reg  add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop \/t REG_DWORD \/d 0 \/f",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "C:\\Windows\\system32\\cmd.exe \/c REG QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "REG  QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "reg  delete \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC \/f",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "reg  query HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v PromptOnSecureDesktop",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "taskkill  \/IM aero.exe",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "REG  QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "reg  add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop \/t REG_DWORD \/d 0x0 \/f",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "reg  add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop_VNC \/t REG_DWORD \/d 0x0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "cmdline",
                "ioc": "C:\\Windows\\system32\\cmd.exe \/c REG QUERY \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" \/v PromptOnSecureDesktop",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [
            "http:\/\/blog.jpcert.or.jp\/2016\/01\/windows-commands-abused-by-attackers.html"
        ],
        "name": "uses_windows_utilities"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Attempts to modify UAC prompt behavior",
        "severity": 3,
        "marks": [
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop_VNC",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "modify_uac_prompt"
    },
    {
        "markcount": 4,
        "families": [],
        "description": "Resumed a suspended thread in a remote process potentially indicative of process injection",
        "severity": 3,
        "marks": [
            {
                "category": "Process injection",
                "ioc": "Process 2820 resumed a thread in remote process 1132",
                "type": "ioc",
                "description": null
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtResumeThread",
                    "return_value": 0,
                    "arguments": {
                        "thread_handle": "0x00000120",
                        "suspend_count": 0,
                        "process_identifier": 1132
                    },
                    "time": 1563331986.2816,
                    "tid": 2952,
                    "flags": {}
                },
                "pid": 2820,
                "type": "call",
                "cid": 380
            },
            {
                "category": "Process injection",
                "ioc": "Process 2820 resumed a thread in remote process 2244",
                "type": "ioc",
                "description": null
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtResumeThread",
                    "return_value": 0,
                    "arguments": {
                        "thread_handle": "0x0000012c",
                        "suspend_count": 0,
                        "process_identifier": 2244
                    },
                    "time": 1563331989.5316,
                    "tid": 2952,
                    "flags": {}
                },
                "pid": 2820,
                "type": "call",
                "cid": 697
            }
        ],
        "references": [
            "www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
        ],
        "name": "injection_resumethread"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 662,
            "time": 6.3174481391907,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 5342,
            "time": 12.344021081924,
            "dport": 138,
            "sport": 138
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 7186,
            "time": 6.2029449939728,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 7514,
            "time": 4.1858410835266,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 7842,
            "time": 6.2427821159363,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 8170,
            "time": 4.7375321388245,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 8498,
            "time": 3.0586359500885,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 8826,
            "time": 4.7251219749451,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 28236,
            "time": 4.2291719913483,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 36620,
            "time": 6.2871830463409,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "bdf5ab257edb25921bd78d62bd3a05f9a2f3959bf595d77172a5a4b261d63703",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "190029b332309ba0d62449349a0be5f1d45f81d1ad8c3c2279260dd41f0081a0",
    "irc": [],
    "https_ex": []
}

Screenshots

NetzFix.exe removal instructions

The instructions below shows how to remove NetzFix.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the NetzFix.exe file for removal, restart your computer and scan it again to verify that NetzFix.exe has been successfully removed. Here are the removal instructions in more detail:

Download and install FreeFixer: http://www.freefixer.com/download.html
Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
When the scan is finished, locate NetzFix.exe in the scan result and tick the checkbox next to the NetzFix.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate NetzFix.exe in the scan result.

c:\downloads\NetzFix.exe
Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the NetzFix.exe file.
Restart your computer.
Start FreeFixer and scan your computer again. If NetzFix.exe still remains in the scan result, proceed with the next step. If NetzFix.exe is gone from the scan result you're done.
If NetzFix.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
Restart your computer.
Start FreeFixer and scan your computer again. Verify that NetzFix.exe no longer appear in the scan result.

Free Questionnaires

Hashes [?]

Property	Value
MD5	2199c8338bb5e5f1ac25131c34cc909c
SHA256	c9a942164eb3b1dd370d09716e7ef0a85c8271302e41c3b5b33f88c70a91f504

Error Messages

These are some of the error messages that can appear related to netzfix.exe:

netzfix.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

netzfix.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.

7z Setup SFX has stopped working.

End Program - netzfix.exe. This program is not responding.

netzfix.exe is not a valid Win32 application.

netzfix.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.

What will you do with NetzFix.exe?

To help other users, please let us know what you will do with NetzFix.exe:

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

No comments posted yet.

What is NetzFix.exe?

Vendor and version information [?]

Digital signatures [?]

VirusTotal report

Sandbox Report

Summary

Summary

Dropped

Generic

Signatures

Yara

Network

Screenshots

NetzFix.exe removal instructions

Hashes [?]

Error Messages

What will you do with NetzFix.exe?

Comments

Leave a reply