What is PTracker.exe?

PTracker.exe is part of Print Tracker and developed by Print Tracker (866) 629-3342 according to the PTracker.exe version information.

PTracker.exe's description is "Print Tracker"

PTracker.exe is digitally signed by Print Tracker.

PTracker.exe is usually located in the 'c:\downloads\' folder.

Some of the anti-virus scanners at VirusTotal detected PTracker.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on PTracker.exe:

Property	Value
Product name	Print Tracker
Company name	Print Tracker (866) 629-3342
File description	Print Tracker
Internal name	PTracker
Original filename	PTracker.exe
Comments	Monitors local printing and gathers network printer meter reads
Legal copyright	Copyright 2003-2019 Print Tracker. All rights reserved.
Product version	8.00.0018
File version	8.00.0018

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product name	Print Tracker
Company name	Print Tracker (866) 629-3342
File description	Print Tracker
Internal name	PTracker
Original filename	PTracker.exe
Comments	Monitors local printing and gathers ..
Legal copyright	Copyright 2003-2019 Print Tracker. ..
Product version	8.00.0018
File version	8.00.0018

Digital signatures [?]

PTracker.exe has a valid digital signature.

Property	Value
Signer name	Print Tracker
Certificate issuer name	COMODO RSA Code Signing CA
Certificate serial number	60e24cd48e6202d2ca57397530add2cf

VirusTotal report

2 of the 70 anti-virus programs at VirusTotal detected the PTracker.exe file. That's a 3% detection rate.

Scanner	Detection Name
Cylance	Unsafe
eGambit	Unsafe.AI_Score_64%

2 of the 70 anti-virus programs detected the PTracker.exe file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "file_created": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7279.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6C6E.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7335.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET717F.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET740F.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6DC6.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6E53.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7066.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6C9D.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6E81.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6E24.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET70C4.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6CFB.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET71AE.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7095.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7548.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6EDF.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6BE2.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET744E.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET72F6.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET73D1.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET71FC.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6C10.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF4E5206BAEF533787.TMP",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6FBA.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET74FA.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6CCC.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\PTracker.log",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6EB0.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7131.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6FE9.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6D2A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7392.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7102.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\Error.log",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6DF5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET723B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6B84.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET74BB.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6F6C.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6D68.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET72B8.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6D97.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7027.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET748C.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7363.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6C3F.tmp"
    ],
    "directory_created": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\temp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs"
    ],
    "dll_loaded": [
        "C:\\Windows\\System32\\mswsock.dll",
        "kernel32",
        "credssp.dll",
        "CRYPT32.dll",
        "DNSAPI.dll",
        "C:\\Windows\\system32\\netbios.dll",
        "kernel32.dll",
        "UxTheme.dll",
        "C:\\Windows\\system32\\ole32.dll",
        "dwmapi.dll",
        "C:\\Windows\\system32\\napinsp.dll",
        "cryptsp.dll",
        "winhttp.dll",
        "API-MS-WIN-Service-Management-L1-1-0.dll",
        "SspiCli.dll",
        "C:\\Windows\\syswow64\\MSCTF.dll",
        "IMM32.dll",
        "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
        "user32",
        "OLEAUT32.DLL",
        "RASMAN.DLL",
        "IPHLPAPI.DLL",
        "advapi32.dll",
        "ole32.dll",
        "SHLWAPI.dll",
        "CRYPTSP.dll",
        "C:\\Program Files (x86)\\Common Files\\System\\ado\\msader15.dll",
        "API-MS-Win-Security-SDDL-L1-1-0.dll",
        "API-MS-WIN-Service-winsvc-L1-1-0.dll",
        "wsock32",
        "rtutils.dll",
        "VERSION.DLL",
        "wininet.dll",
        "ADVAPI32.dll",
        "uxtheme.dll",
        "OLEAUT32.dll",
        "C:\\Windows\\system32\\pnrpnsp.dll",
        "DHCPCSVC.DLL",
        "RPCRT4.dll",
        "MSVBVM60.DLL",
        "C:\\Windows\\System32\\winrnr.dll",
        "comctl32.dll",
        "C:\\Windows\\system32\\kernel32.dll",
        "C:\\Windows\\system32\\NLAapi.dll",
        "C:\\Windows\\system32\\asycfilt.dll",
        "SXS.DLL",
        "RpcRtRemote.dll",
        "netbios.dll",
        "Kernel32.dll",
        "netapi32",
        "C:\\Windows\\SysWOW64\\oleaut32.dll",
        "shell32.dll",
        "rpcrt4.dll",
        "WINHTTP.dll",
        "WS2_32.dll",
        "C:\\Windows\\system32\\comsvcs.dll"
    ],
    "file_failed": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\PTracker.log",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\system.mdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\data\\PMonitor.mdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini"
    ],
    "regkey_opened": [
        "HKEY_CURRENT_USER\\WinHttp.WinHttpRequest.5.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient",
        "HKEY_CURRENT_USER\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}",
        "HKEY_CLASSES_ROOT\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\ExtendedErrors",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\VBA\\Monitors",
        "HKEY_CURRENT_USER\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocHandler",
        "HKEY_CURRENT_USER\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}",
        "HKEY_CURRENT_USER\\CLSID\\{0002DF01-0000-0000-C000-000000000046}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\0\\win32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\Progid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\BFE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00020420-0000-0000-C000-000000000046}\\Progid",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\TreatAs",
        "HKEY_CURRENT_USER\\MSDataGridLib.DataGrid.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WinHttp.WinHttpRequest.5.1\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32",
        "HKEY_CURRENT_USER\\MSBind.BindingCollection.1",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SspiCache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LsaExtensionConfig\\SspiCli",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Microsoft.Jet.OLEDB.4.0\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Jet\\4.0\\Engines",
        "HKEY_CURRENT_USER\\Interface\\{00000134-0000-0000-C000-000000000046}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\MSXML2.ServerXMLHTTP.6.0",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\Progid",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
        "HKEY_CURRENT_USER\\MSWinsock.Winsock.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing",
        "HKEY_CURRENT_USER\\MSMask.MaskEdBox.1",
        "HKEY_CURRENT_USER\\DERuntime.DERuntime.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{00020400-0000-0000-C000-000000000046}\\ProxyStubClsid32",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0000051A-0000-0010-8000-00AA006D2EA4}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}",
        "HKEY_CURRENT_USER\\ADOX.Catalog",
        "HKEY_CURRENT_USER\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\InternetExplorer.Application\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
        "HKEY_CURRENT_USER\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}",
        "HKEY_CURRENT_USER\\MSComctlLib.ImageListCtrl.2",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASMANCS",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InprocServer32",
        "HKEY_CURRENT_USER\\Interface\\{00020400-0000-0000-C000-000000000046}",
        "HKEY_CURRENT_USER\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT\\UserEra",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\Progid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ADOX.Catalog\\CLSID",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CLASSES_ROOT\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\Progid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32",
        "HKEY_CURRENT_USER\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\409",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\System",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Msxml2.ServerXMLHTTP.6.0\\CLSID",
        "HKEY_CURRENT_USER\\Microsoft.Jet.OLEDB.4.0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Sans Serif",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\9",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32",
        "HKEY_CURRENT_USER\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut",
        "HKEY_CLASSES_ROOT\\CLSID\\{0000051A-0000-0010-8000-00AA006D2EA4}\\ExtendedErrors",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\PrintTracker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\MSSTDFMT.StdDataFormat.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\CLSID\\{00020420-0000-0000-C000-000000000046}",
        "HKEY_CURRENT_USER\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\Progid",
        "HKEY_CURRENT_USER\\InternetExplorer.Application"
    ],
    "resolves_host": [
        "secure.tc101.com",
        "wpad",
        "cuckpc",
        "secure.nexation.com"
    ],
    "file_written": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\PTracker.log",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\Error.log",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini"
    ],
    "file_exists": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSSTDFMT.StdDataFormat.1",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSMask.MaskEdBox.1",
        "C:\\Windows\\System32\\C_936.NLS",
        "C:\\Windows\\System32\\C_932.NLS",
        "C:\\Users\\cuck\\AppData\\Local\\Temp",
        "C:\\Windows\\System32\\C_949.NLS",
        "C:\\Windows\\System32\\C_950.NLS",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSBind.BindingCollection.1",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSComctlLib.ImageListCtrl.2",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\DERuntime.DERuntime.1",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSDataGridLib.DataGrid.1",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSWinsock.Winsock.1"
    ],
    "mutex": [
        "IESQMMUTEX_0_208"
    ],
    "fetches_url": [
        "https:\/\/secure.tc101.com\/rdebug.php?r=pd&sn=1073-042-7172-cuckpc-C1882777&d=Error%3APT%208%2E0%2E18%3B%20Component%20%27mscomctl%2Eocx%27%20or%20one%20of%20its%20dependencies%20not%20correctly%20registered%3A%20a%20file%20is%20missing%20or%20invalid%3B%20Num%3A339%3B%20Src%3AModule1%2EMain%2C%20line%20119%3B%20Err%3A0%3B%20%2A%2A%20variables%20%2A%2A%3B%20gstrDealer%20%20%20%3A%20evaluation%3B%20gstrSiteID%20%20%20%3A%20NULL%3B%20gstrEmail%20%20%20%3A%20NULL%3B%20glTimeout%20%20%20%3A%20450%3B%20glRetries%20%20%20%3A%200%3B%20gbStopSearchingOrDownloading%3A%20False%3B%20%2A%2A%20variables%20%2A%2A%3B%20strParam%20%20%20%3A%203%3A47%3A00%20PM%3B%20dEndTime%20%20%20%3A%2023587%2E906%3B%20sTemp%20%20%20%20%3A%20NULL%3B%20lHWnd%20%20%20%20%3A%200%3B%20%2A%2A%20call%20stack%20%2A%2A%3B",
        "https:\/\/secure.nexation.com\/compassprinttracker\/rdebug.php?r=pd&sn=1073-042-7172-cuckpc-C1882777&d=Error%3APT%208%2E0%2E18%3B%20Component%20%27mscomctl%2Eocx%27%20or%20one%20of%20its%20dependencies%20not%20correctly%20registered%3A%20a%20file%20is%20missing%20or%20invalid%3B%20Num%3A339%3B%20Src%3AModule1%2EMain%2C%20line%20119%3B%20Err%3A0%3B%20%2A%2A%20variables%20%2A%2A%3B%20gstrDealer%20%20%20%3A%20evaluation%3B%20gstrSiteID%20%20%20%3A%20NULL%3B%20gstrEmail%20%20%20%3A%20NULL%3B%20glTimeout%20%20%20%3A%20450%3B%20glRetries%20%20%20%3A%200%3B%20gbStopSearchingOrDownloading%3A%20False%3B%20%2A%2A%20variables%20%2A%2A%3B%20strParam%20%20%20%3A%203%3A47%3A00%20PM%3B%20dEndTime%20%20%20%3A%2023587%2E906%3B%20sTemp%20%20%20%20%3A%20NULL%3B%20lHWnd%20%20%20%20%3A%200%3B%20%2A%2A%20call%20stack%20%2A%2A%3B"
    ],
    "file_opened": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\PTracker.log",
        "C:\\",
        "C:\\Windows\\Fonts\\staticcache.dat",
        "\\Device\\Netbios",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
        "C:\\Windows\\System32\\en-US\\winhttp.dll.mui",
        "C:\\Users\\cuck\\AppData\\Local\\Temp",
        "C:\\Program Files (x86)\\Common Files\\System\\ado\\msadox.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini"
    ],
    "guid": [
        "{275c23e2-3747-11d0-9fea-00aa003f8646}",
        "{0c733a66-2a1c-11ce-ade5-00aa0044773d}",
        "{dee35071-506b-11cf-b1aa-00aa00b8de95}",
        "{00000514-0000-0010-8000-00aa006d2ea4}",
        "{c8b522cf-5cf3-11ce-ade5-00aa0044773d}",
        "{c8b522d1-5cf3-11ce-ade5-00aa0044773d}",
        "{d0074ffd-570f-4a9b-8d69-199fdba5723b}",
        "{3d5c6bf2-69a3-11d0-b393-00a0c9055d8e}",
        "{dcb00c01-570f-4a9b-8d69-199fdba5723b}",
        "{2087c2f4-2cef-4953-a8ab-66779b670495}",
        "{00000000-0000-0000-c000-000000000046}",
        "{00000542-0000-0010-8000-00aa006d2ea4}",
        "{6c736dc1-ab0d-11d0-a2ad-00a0c90f27e8}",
        "{2c247f23-8591-11d1-b16a-00c0f0283628}",
        "{88d96a0b-f192-11d4-a65f-0040963251e5}",
        "{dee35070-506b-11cf-b1aa-00aa00b8de95}",
        "{00000001-0000-0000-c000-000000000046}",
        "{00000602-0000-0010-8000-00aa006d2ea4}",
        "{2206cdb0-19c1-11d1-89e0-00c04fd7a829}",
        "{0002df01-0000-0000-c000-000000000046}",
        "{dcb00000-570f-4a9b-8d69-199fdba5723b}",
        "{1cf2b120-547d-101b-8e65-08002b2bd119}",
        "{5cb31e10-2b5f-11cf-be10-00aa00a2fa25}",
        "{a47979d2-c419-11d9-a5b4-001185ad2b89}",
        "{2206ccb1-19c1-11d1-89e0-00c04fd7a829}",
        "{275c23e1-3747-11d0-9fea-00aa003f8646}",
        "{6c736db1-bd94-11d0-8a23-00aa00b58e10}",
        "{ecabb0c0-7f19-11d2-978e-0000f8757e2a}",
        "{0c733a8d-2a1c-11ce-ade5-00aa0044773d}"
    ],
    "file_read": [
        "C:\\Windows\\Fonts\\staticcache.dat",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini",
        "C:\\Program Files (x86)\\Common Files\\System\\ado\\msadox.dll"
    ],
    "regkey_read": [
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Msxml2.ServerXMLHTTP.6.0\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\0\\win32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{00020400-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SecurityProviders",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\PagesLockedToTableLock",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\FatBlastTimeout",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\InternetExplorer.Application\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\AttachableObjects",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\RemoteRpcDll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\ImplicitCommitSync",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableImprovedZoneCheck",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\PageTimeout",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\CompactByPKey",
        "\\ObjectName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\ConnectionTimeout",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\JetDisabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International\\AcceptLanguage",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\SystemDB",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\MaxLocksPerFile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\LockRetry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\PreparedInsert",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\MaxBufferSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\LockDelay",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\UserCommitSync",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Comment",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\TraceODBCAPI",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\ExclusiveAsyncDelay",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ADOX.Catalog\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\Threads",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\SharedAsyncDelay",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Microsoft.Jet.OLEDB.4.0\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Type",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\PrevFormatCompactWithUNICODECompression",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\OLEDB_SERVICES",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\SnapshotOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\AsyncRetryInterval",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\FastRequery",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\SPTimeOut",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\TraceSQLMode",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\949",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\ProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\RecycleLVs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\SQLTraceMode",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\71314D5E",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureRoutine",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\ProgID\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\950",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\TryJetAuth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\ODBCISAMAttach",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\DisableAsync",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\FlushTransactionTimeout",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\TokenSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WinHttp.WinHttpRequest.5.1\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\LoginTimeout",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Capabilities",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureDll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing\\Enabled",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\ProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\ProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\QueryTimeout",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\ProductName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\PreparedUpdate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\AttachCaseSensitive",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\DisableBranchCache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\FatBlastRows",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DebugHeapFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\932",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\936",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\RpcId",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize"
    ],
    "directory_enumerated": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSCOMCTL.OCX",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\system.mdb",
        "C:\\Windows\\System32\\MSCOMCTL.OCX",
        "C:\\Program Files (x86)\\Common Files\\designer\\MSWINSCK.OCX",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSBIND.DLL",
        "C:\\ProgramData\\Print Tracker\\PMonitor.mdb",
        "C:\\Windows\\System32\\ras\\*.pbk",
        "C:\\Windows\\System32\\MSWINSCK.OCX",
        "C:\\Program Files (x86)\\Common Files\\designer\\MSBIND.DLL",
        "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
        "C:\\Windows\\System32\\MSMASK32.OCX",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.exe",
        "C:\\Program Files (x86)\\Common Files\\designer\\MSCOMCTL.OCX",
        "C:\\Windows\\System32\\MSDATGRD.OCX",
        "C:\\Windows\\System32\\MSSTDFMT.DLL",
        "C:\\Windows\\System32\\MSDERUN.DLL",
        "C:\\Program Files (x86)\\Common Files\\designer\\MSMASK32.OCX",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSWINSCK.OCX",
        "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSMASK32.OCX",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\data\\PMonitor.mdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSDERUN.DLL",
        "C:\\Program Files (x86)\\Common Files\\designer\\MSSTDFMT.DLL",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\trace.ini",
        "C:\\Windows\\System32\\MSBIND.DLL",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\temp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
        "C:\\Program Files (x86)\\Common Files\\designer\\MSDATGRD.OCX",
        "C:\\Program Files (x86)\\Common Files\\designer\\MSDERUN.DLL",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSDATGRD.OCX",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSSTDFMT.DLL"
    ],
    "regkey_written": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory"
    ]
}

Dropped

[
    {
        "yara": [],
        "sha1": "a6c9f0b19f61ef1e7369fd0263662b1a0e9d960b",
        "name": "2d78d332b871dca0_ptracker.log",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\PTracker.log",
        "type": "ASCII text, with CRLF line terminators",
        "sha256": "2d78d332b871dca0ee476fb44e37c95cac64e0d7944eed433dcb726ba53b86e6",
        "urls": [],
        "crc32": "65F4273E",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/9902\/files\/2d78d332b871dca0_ptracker.log",
        "ssdeep": null,
        "size": 1717,
        "sha512": "e483c46e5d23b0377a93babe207b52bccaa2929add921050adc164a2e7659246ad0df2aadeb39dbfc62222c772cd8e7775b736aaec4b5a4eac26ff44478a6023",
        "pids": [
            2676
        ],
        "md5": "7f769bd69ed0a65f551ed8e675d742a9"
    },
    {
        "yara": [],
        "sha1": "ab179ba0b7cc211b93ff8c2191af6d58498ecced",
        "name": "ae0fc74b87cc1c82_error.log",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\Error.log",
        "type": "ASCII text, with CRLF line terminators",
        "sha256": "ae0fc74b87cc1c8254ba93a930f68d4686252753213ef2d3aa5a8502544c46bf",
        "urls": [],
        "crc32": "C092C10D",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/9902\/files\/ae0fc74b87cc1c82_error.log",
        "ssdeep": null,
        "size": 958,
        "sha512": "6fbc678f2d496ff03d9b686ace2e96467172429e2196e3eb1a7b058bb6aaba8667d003e1038185f445d16ae4c78f881b17900c70a2cb2a39dab96db9f7f59907",
        "pids": [
            2676
        ],
        "md5": "0e07f260f3e4d6101aaf3dab54636de8"
    },
    {
        "yara": [],
        "sha1": "d15c245f4d765546267b5249aa49a451a87101b8",
        "name": "19983ea6d7ff8aa4_pmonitor.ini",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini",
        "type": "ASCII text, with CRLF line terminators",
        "sha256": "19983ea6d7ff8aa430de2f0771fa69ba94b49121c2e5088fb02218cd743468d5",
        "urls": [],
        "crc32": "E7165C75",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/9902\/files\/19983ea6d7ff8aa4_pmonitor.ini",
        "ssdeep": null,
        "size": 76,
        "sha512": "71e185be5d6158889eaaf4b1658881e63b096686c14330a7971cfd58c7fe6409e700762f9bcc7c39736b22776cfdca2f8f502c873d7e4512451d05eb782fd77c",
        "pids": [
            2676
        ],
        "md5": "8dd6c545b185aa0b86f6b2792f85c81c"
    },
    {
        "yara": [],
        "sha1": "f81ab807653f63644c0c665bfbd5d98156231eff",
        "name": "1d37b43b2adedab0_license.dat",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
        "type": "ASCII text, with CRLF line terminators",
        "sha256": "1d37b43b2adedab04ddf1b554f3e1f0200da1a3e4a2f00415ff9933456324852",
        "urls": [],
        "crc32": "5382B7DB",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/9902\/files\/1d37b43b2adedab0_license.dat",
        "ssdeep": null,
        "size": 48,
        "sha512": "82b31e5f82414efd27274de76a5e730c4ae82d06d7531dcef597ff5332ba001290e2dc4676a07e58528513e1be46fd5857b8550f89dd1ac1bb39602555b55107",
        "pids": [
            2676
        ],
        "md5": "a78caa05b233df6cd71ac27247dad7e9"
    }
]

Generic

[
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1602053586.359375,
        "ppid": 376
    },
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
        "process_name": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
        "pid": 2676,
        "summary": {
            "file_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7279.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6C6E.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7335.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET717F.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET740F.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6DC6.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6E53.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7066.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6C9D.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6E81.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6E24.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET70C4.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6CFB.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET71AE.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7095.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7548.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6EDF.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6BE2.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET744E.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET72F6.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET73D1.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET71FC.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6C10.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF4E5206BAEF533787.TMP",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6FBA.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET74FA.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6CCC.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\PTracker.log",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6EB0.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7131.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6FE9.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6D2A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7392.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7102.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\Error.log",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6DF5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET723B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6B84.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET74BB.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6F6C.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6D68.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET72B8.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6D97.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7027.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET748C.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET7363.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\JET6C3F.tmp"
            ],
            "directory_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\temp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs"
            ],
            "dll_loaded": [
                "C:\\Windows\\System32\\mswsock.dll",
                "kernel32",
                "credssp.dll",
                "CRYPT32.dll",
                "DNSAPI.dll",
                "C:\\Windows\\system32\\netbios.dll",
                "kernel32.dll",
                "UxTheme.dll",
                "C:\\Windows\\system32\\ole32.dll",
                "dwmapi.dll",
                "C:\\Windows\\system32\\napinsp.dll",
                "cryptsp.dll",
                "winhttp.dll",
                "API-MS-WIN-Service-Management-L1-1-0.dll",
                "SspiCli.dll",
                "C:\\Windows\\syswow64\\MSCTF.dll",
                "IMM32.dll",
                "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
                "user32",
                "OLEAUT32.DLL",
                "RASMAN.DLL",
                "IPHLPAPI.DLL",
                "advapi32.dll",
                "ole32.dll",
                "SHLWAPI.dll",
                "CRYPTSP.dll",
                "C:\\Program Files (x86)\\Common Files\\System\\ado\\msader15.dll",
                "API-MS-Win-Security-SDDL-L1-1-0.dll",
                "API-MS-WIN-Service-winsvc-L1-1-0.dll",
                "wsock32",
                "rtutils.dll",
                "VERSION.DLL",
                "wininet.dll",
                "ADVAPI32.dll",
                "uxtheme.dll",
                "OLEAUT32.dll",
                "C:\\Windows\\system32\\pnrpnsp.dll",
                "DHCPCSVC.DLL",
                "RPCRT4.dll",
                "MSVBVM60.DLL",
                "C:\\Windows\\System32\\winrnr.dll",
                "comctl32.dll",
                "C:\\Windows\\system32\\kernel32.dll",
                "C:\\Windows\\system32\\NLAapi.dll",
                "C:\\Windows\\system32\\asycfilt.dll",
                "SXS.DLL",
                "RpcRtRemote.dll",
                "netbios.dll",
                "Kernel32.dll",
                "netapi32",
                "C:\\Windows\\SysWOW64\\oleaut32.dll",
                "shell32.dll",
                "rpcrt4.dll",
                "WINHTTP.dll",
                "WS2_32.dll",
                "C:\\Windows\\system32\\comsvcs.dll"
            ],
            "file_failed": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\PTracker.log",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\system.mdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\data\\PMonitor.mdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini"
            ],
            "regkey_opened": [
                "HKEY_CURRENT_USER\\WinHttp.WinHttpRequest.5.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocHandler32",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient",
                "HKEY_CURRENT_USER\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}",
                "HKEY_CLASSES_ROOT\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\ExtendedErrors",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\VBA\\Monitors",
                "HKEY_CURRENT_USER\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\TreatAs",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocHandler",
                "HKEY_CURRENT_USER\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}",
                "HKEY_CURRENT_USER\\CLSID\\{0002DF01-0000-0000-C000-000000000046}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\0\\win32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\Progid",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\BFE",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00020420-0000-0000-C000-000000000046}\\Progid",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\TreatAs",
                "HKEY_CURRENT_USER\\MSDataGridLib.DataGrid.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WinHttp.WinHttpRequest.5.1\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32",
                "HKEY_CURRENT_USER\\MSBind.BindingCollection.1",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SspiCache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LsaExtensionConfig\\SspiCli",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\TreatAs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Microsoft.Jet.OLEDB.4.0\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Jet\\4.0\\Engines",
                "HKEY_CURRENT_USER\\Interface\\{00000134-0000-0000-C000-000000000046}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\MSXML2.ServerXMLHTTP.6.0",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\Progid",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
                "HKEY_CURRENT_USER\\MSWinsock.Winsock.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing",
                "HKEY_CURRENT_USER\\MSMask.MaskEdBox.1",
                "HKEY_CURRENT_USER\\DERuntime.DERuntime.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\InprocHandler32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{00020400-0000-0000-C000-000000000046}\\ProxyStubClsid32",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0000051A-0000-0010-8000-00AA006D2EA4}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InprocHandler32",
                "HKEY_CURRENT_USER\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}",
                "HKEY_CURRENT_USER\\ADOX.Catalog",
                "HKEY_CURRENT_USER\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\InternetExplorer.Application\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
                "HKEY_CURRENT_USER\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}",
                "HKEY_CURRENT_USER\\MSComctlLib.ImageListCtrl.2",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASMANCS",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InprocServer32",
                "HKEY_CURRENT_USER\\Interface\\{00020400-0000-0000-C000-000000000046}",
                "HKEY_CURRENT_USER\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT\\UserEra",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\Progid",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocHandler",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocHandler32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ADOX.Catalog\\CLSID",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CLASSES_ROOT\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\Progid",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32",
                "HKEY_CURRENT_USER\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\409",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocHandler32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InprocHandler",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\System",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\TreatAs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Msxml2.ServerXMLHTTP.6.0\\CLSID",
                "HKEY_CURRENT_USER\\Microsoft.Jet.OLEDB.4.0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\InprocHandler",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Sans Serif",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\9",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32",
                "HKEY_CURRENT_USER\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut",
                "HKEY_CLASSES_ROOT\\CLSID\\{0000051A-0000-0010-8000-00AA006D2EA4}\\ExtendedErrors",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocHandler",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\PrintTracker",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\TreatAs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\MSSTDFMT.StdDataFormat.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\CLSID\\{00020420-0000-0000-C000-000000000046}",
                "HKEY_CURRENT_USER\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\Progid",
                "HKEY_CURRENT_USER\\InternetExplorer.Application"
            ],
            "resolves_host": [
                "secure.tc101.com",
                "wpad",
                "cuckpc",
                "secure.nexation.com"
            ],
            "file_written": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\PTracker.log",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\Error.log",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini"
            ],
            "file_exists": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSSTDFMT.StdDataFormat.1",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSMask.MaskEdBox.1",
                "C:\\Windows\\System32\\C_936.NLS",
                "C:\\Windows\\System32\\C_932.NLS",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Windows\\System32\\C_949.NLS",
                "C:\\Windows\\System32\\C_950.NLS",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSBind.BindingCollection.1",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSComctlLib.ImageListCtrl.2",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\DERuntime.DERuntime.1",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSDataGridLib.DataGrid.1",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSWinsock.Winsock.1"
            ],
            "mutex": [
                "IESQMMUTEX_0_208"
            ],
            "fetches_url": [
                "https:\/\/secure.tc101.com\/rdebug.php?r=pd&sn=1073-042-7172-cuckpc-C1882777&d=Error%3APT%208%2E0%2E18%3B%20Component%20%27mscomctl%2Eocx%27%20or%20one%20of%20its%20dependencies%20not%20correctly%20registered%3A%20a%20file%20is%20missing%20or%20invalid%3B%20Num%3A339%3B%20Src%3AModule1%2EMain%2C%20line%20119%3B%20Err%3A0%3B%20%2A%2A%20variables%20%2A%2A%3B%20gstrDealer%20%20%20%3A%20evaluation%3B%20gstrSiteID%20%20%20%3A%20NULL%3B%20gstrEmail%20%20%20%3A%20NULL%3B%20glTimeout%20%20%20%3A%20450%3B%20glRetries%20%20%20%3A%200%3B%20gbStopSearchingOrDownloading%3A%20False%3B%20%2A%2A%20variables%20%2A%2A%3B%20strParam%20%20%20%3A%203%3A47%3A00%20PM%3B%20dEndTime%20%20%20%3A%2023587%2E906%3B%20sTemp%20%20%20%20%3A%20NULL%3B%20lHWnd%20%20%20%20%3A%200%3B%20%2A%2A%20call%20stack%20%2A%2A%3B",
                "https:\/\/secure.nexation.com\/compassprinttracker\/rdebug.php?r=pd&sn=1073-042-7172-cuckpc-C1882777&d=Error%3APT%208%2E0%2E18%3B%20Component%20%27mscomctl%2Eocx%27%20or%20one%20of%20its%20dependencies%20not%20correctly%20registered%3A%20a%20file%20is%20missing%20or%20invalid%3B%20Num%3A339%3B%20Src%3AModule1%2EMain%2C%20line%20119%3B%20Err%3A0%3B%20%2A%2A%20variables%20%2A%2A%3B%20gstrDealer%20%20%20%3A%20evaluation%3B%20gstrSiteID%20%20%20%3A%20NULL%3B%20gstrEmail%20%20%20%3A%20NULL%3B%20glTimeout%20%20%20%3A%20450%3B%20glRetries%20%20%20%3A%200%3B%20gbStopSearchingOrDownloading%3A%20False%3B%20%2A%2A%20variables%20%2A%2A%3B%20strParam%20%20%20%3A%203%3A47%3A00%20PM%3B%20dEndTime%20%20%20%3A%2023587%2E906%3B%20sTemp%20%20%20%20%3A%20NULL%3B%20lHWnd%20%20%20%20%3A%200%3B%20%2A%2A%20call%20stack%20%2A%2A%3B"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs\\PTracker.log",
                "C:\\",
                "C:\\Windows\\Fonts\\staticcache.dat",
                "\\Device\\Netbios",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
                "C:\\Windows\\System32\\en-US\\winhttp.dll.mui",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Program Files (x86)\\Common Files\\System\\ado\\msadox.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini"
            ],
            "guid": [
                "{275c23e2-3747-11d0-9fea-00aa003f8646}",
                "{0c733a66-2a1c-11ce-ade5-00aa0044773d}",
                "{dee35071-506b-11cf-b1aa-00aa00b8de95}",
                "{00000514-0000-0010-8000-00aa006d2ea4}",
                "{c8b522cf-5cf3-11ce-ade5-00aa0044773d}",
                "{c8b522d1-5cf3-11ce-ade5-00aa0044773d}",
                "{d0074ffd-570f-4a9b-8d69-199fdba5723b}",
                "{3d5c6bf2-69a3-11d0-b393-00a0c9055d8e}",
                "{dcb00c01-570f-4a9b-8d69-199fdba5723b}",
                "{2087c2f4-2cef-4953-a8ab-66779b670495}",
                "{00000000-0000-0000-c000-000000000046}",
                "{00000542-0000-0010-8000-00aa006d2ea4}",
                "{6c736dc1-ab0d-11d0-a2ad-00a0c90f27e8}",
                "{2c247f23-8591-11d1-b16a-00c0f0283628}",
                "{88d96a0b-f192-11d4-a65f-0040963251e5}",
                "{dee35070-506b-11cf-b1aa-00aa00b8de95}",
                "{00000001-0000-0000-c000-000000000046}",
                "{00000602-0000-0010-8000-00aa006d2ea4}",
                "{2206cdb0-19c1-11d1-89e0-00c04fd7a829}",
                "{0002df01-0000-0000-c000-000000000046}",
                "{dcb00000-570f-4a9b-8d69-199fdba5723b}",
                "{1cf2b120-547d-101b-8e65-08002b2bd119}",
                "{5cb31e10-2b5f-11cf-be10-00aa00a2fa25}",
                "{a47979d2-c419-11d9-a5b4-001185ad2b89}",
                "{2206ccb1-19c1-11d1-89e0-00c04fd7a829}",
                "{275c23e1-3747-11d0-9fea-00aa003f8646}",
                "{6c736db1-bd94-11d0-8a23-00aa00b58e10}",
                "{ecabb0c0-7f19-11d2-978e-0000f8757e2a}",
                "{0c733a8d-2a1c-11ce-ade5-00aa0044773d}"
            ],
            "file_read": [
                "C:\\Windows\\Fonts\\staticcache.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\license.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.ini",
                "C:\\Program Files (x86)\\Common Files\\System\\ado\\msadox.dll"
            ],
            "regkey_read": [
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Msxml2.ServerXMLHTTP.6.0\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{00000600-0000-0010-8000-00AA006D2EA4}\\6.0\\0\\win32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{00020400-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SecurityProviders",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\PagesLockedToTableLock",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\FatBlastTimeout",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\InternetExplorer.Application\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\AttachableObjects",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\RemoteRpcDll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\ImplicitCommitSync",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableImprovedZoneCheck",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\PageTimeout",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocServer32\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\CompactByPKey",
                "\\ObjectName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\ConnectionTimeout",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InProcServer32\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\JetDisabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\(Default)",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International\\AcceptLanguage",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\SystemDB",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\MaxLocksPerFile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\LockRetry",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\PreparedInsert",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\MaxBufferSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\LockDelay",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InProcServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\UserCommitSync",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Comment",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\TraceODBCAPI",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\ExclusiveAsyncDelay",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\ADOX.Catalog\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\Threads",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\SharedAsyncDelay",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Microsoft.Jet.OLEDB.4.0\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocServer32\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Type",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\PrevFormatCompactWithUNICODECompression",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\OLEDB_SERVICES",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\SnapshotOnly",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\AsyncRetryInterval",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\FastRequery",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\SPTimeOut",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\TraceSQLMode",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\949",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\ProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\RecycleLVs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\SQLTraceMode",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\71314D5E",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\InProcServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00000602-0000-0010-8000-00AA006D2EA4}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureRoutine",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\ProgID\\(Default)",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\950",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\TryJetAuth",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\ODBCISAMAttach",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\DisableAsync",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\Jet 4.0\\FlushTransactionTimeout",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\TokenSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WinHttp.WinHttpRequest.5.1\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\LoginTimeout",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Capabilities",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureDll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing\\Enabled",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{0002DF01-0000-0000-C000-000000000046}\\ProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{DEE35070-506B-11CF-B1AA-00AA00B8DE95}\\ProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{00020420-0000-0000-C000-000000000046}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\QueryTimeout",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\ProductName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\PreparedUpdate",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\AttachCaseSensitive",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\DisableBranchCache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Jet\\4.0\\Engines\\ODBC\\FatBlastRows",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DebugHeapFlags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\932",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CodePage\\936",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\RpcId",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize"
            ],
            "directory_enumerated": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSCOMCTL.OCX",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\system.mdb",
                "C:\\Windows\\System32\\MSCOMCTL.OCX",
                "C:\\Program Files (x86)\\Common Files\\designer\\MSWINSCK.OCX",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSBIND.DLL",
                "C:\\ProgramData\\Print Tracker\\PMonitor.mdb",
                "C:\\Windows\\System32\\ras\\*.pbk",
                "C:\\Windows\\System32\\MSWINSCK.OCX",
                "C:\\Program Files (x86)\\Common Files\\designer\\MSBIND.DLL",
                "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
                "C:\\Windows\\System32\\MSMASK32.OCX",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\PMonitor.exe",
                "C:\\Program Files (x86)\\Common Files\\designer\\MSCOMCTL.OCX",
                "C:\\Windows\\System32\\MSDATGRD.OCX",
                "C:\\Windows\\System32\\MSSTDFMT.DLL",
                "C:\\Windows\\System32\\MSDERUN.DLL",
                "C:\\Program Files (x86)\\Common Files\\designer\\MSMASK32.OCX",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSWINSCK.OCX",
                "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSMASK32.OCX",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\data\\PMonitor.mdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSDERUN.DLL",
                "C:\\Program Files (x86)\\Common Files\\designer\\MSSTDFMT.DLL",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\trace.ini",
                "C:\\Windows\\System32\\MSBIND.DLL",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\temp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Logs",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
                "C:\\Program Files (x86)\\Common Files\\designer\\MSDATGRD.OCX",
                "C:\\Program Files (x86)\\Common Files\\designer\\MSDERUN.DLL",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSDATGRD.OCX",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MSSTDFMT.DLL"
            ],
            "regkey_written": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory"
            ]
        },
        "first_seen": 1602053586.546875,
        "ppid": 2724
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "system",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GlobalMemoryStatusEx",
                    "return_value": 1,
                    "arguments": {},
                    "time": 1602053586.765875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 620
            }
        ],
        "references": [],
        "name": "antivm_memory_available"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "The executable uses a known packer",
        "severity": 1,
        "marks": [
            {
                "category": "packer",
                "ioc": "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "peid_packer"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "The file contains an unknown PE resource name possibly indicative of a packer",
        "severity": 1,
        "marks": [
            {
                "category": "resource name",
                "ioc": "CUSTOM",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "pe_unknown_resource_name"
    },
    {
        "markcount": 327,
        "families": [],
        "description": "One or more processes crashed",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634268,
                            "edi": 10395944,
                            "eax": 1634268,
                            "ebp": 1634348,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053586.734875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 480
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634540,
                            "edi": 10395944,
                            "eax": 1634540,
                            "ebp": 1634620,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053586.734875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 494
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1633880,
                            "edi": 10395944,
                            "eax": 1633880,
                            "ebp": 1633960,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053586.734875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 496
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634152,
                            "edi": 10395944,
                            "eax": 1634152,
                            "ebp": 1634232,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053586.749875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 497
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.031875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2466
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.046875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2480
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.046875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2488
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n2\n2\n4\n2\n0\na\n \n@\n \n0\nx\n6\n2\n4\n2\n0\na\n\n\nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n+\n0\nx\n1\n1\n6\n6\n \nD\nl\nl\nF\nu\nn\nc\nt\ni\no\nn\nC\na\nl\nl\n-\n0\nx\nb\n5\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\na\n0\n4\n8\n \n@\n \n0\nx\n7\n2\n9\n4\na\n0\n4\n8\n\n\nB\nA\nS\nI\nC\n_\nC\nL\nA\nS\nS\n_\nQ\nu\ne\nr\ny\nI\nn\nt\ne\nr\nf\na\nc\ne\n+\n0\nx\ne\nc\na\n \nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n-\n0\nx\n1\n3\na\n4\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n7\nb\n3\ne\n \n@\n \n0\nx\n7\n2\n9\n4\n7\nb\n3\ne\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n3\nd\nd\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n2\ne\n3\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n9\n8\n1\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n9\n8\n1\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n1\n5\n6\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n0\nb\nd\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\nf\na\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\nf\na\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n5\nc\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n1\nb\n7\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\n0\n0\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\n0\n0\n\n\n4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n4\n2\n4\n6\n6\n \n@\n \n0\nx\n4\n4\n2\n4\n6\n6\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
                        "registers": {
                            "esp": 1634784,
                            "edi": 1635232,
                            "eax": 0,
                            "ebp": 1635264,
                            "edx": 5,
                            "ebx": 6618771,
                            "esi": 4291688,
                            "ecx": 0
                        },
                        "exception": {
                            "instruction_r": "8b 08 8b 55 dc 52 ff 91 80 00 00 00 db e2 89 85",
                            "symbol": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1+0x250bb1",
                            "instruction": "mov ecx, dword ptr [eax]",
                            "module": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
                            "exception_code": "0xc0000005",
                            "offset": 2427825,
                            "address": "0x650bb1"
                        }
                    },
                    "time": 1602053587.046875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2489
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1632824,
                            "edi": 10395944,
                            "eax": 1632824,
                            "ebp": 1632904,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.046875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2490
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634372,
                            "edi": 1634656,
                            "eax": 1634372,
                            "ebp": 1634452,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634656,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.078875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2607
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634348,
                            "edi": 1634624,
                            "eax": 1634348,
                            "ebp": 1634428,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634624,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.078875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2635
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.078875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2646
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.124875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2801
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.124875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2809
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.124875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2817
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n2\n2\n4\n2\n8\n5\n \n@\n \n0\nx\n6\n2\n4\n2\n8\n5\n\n\nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n+\n0\nx\n1\n1\n6\n6\n \nD\nl\nl\nF\nu\nn\nc\nt\ni\no\nn\nC\na\nl\nl\n-\n0\nx\nb\n5\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\na\n0\n4\n8\n \n@\n \n0\nx\n7\n2\n9\n4\na\n0\n4\n8\n\n\nB\nA\nS\nI\nC\n_\nC\nL\nA\nS\nS\n_\nQ\nu\ne\nr\ny\nI\nn\nt\ne\nr\nf\na\nc\ne\n+\n0\nx\ne\nc\na\n \nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n-\n0\nx\n1\n3\na\n4\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n7\nb\n3\ne\n \n@\n \n0\nx\n7\n2\n9\n4\n7\nb\n3\ne\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n3\nd\nd\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n2\ne\n3\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n9\n8\n1\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n9\n8\n1\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n1\n5\n6\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n0\nb\nd\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\nf\na\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\nf\na\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n5\nc\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n1\nb\n7\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\n0\n0\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\n0\n0\n\n\n4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n4\n2\n4\n6\n6\n \n@\n \n0\nx\n4\n4\n2\n4\n6\n6\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
                        "registers": {
                            "esp": 1634784,
                            "edi": 1635232,
                            "eax": 0,
                            "ebp": 1635264,
                            "edx": 5,
                            "ebx": 6618771,
                            "esi": 4291688,
                            "ecx": 0
                        },
                        "exception": {
                            "instruction_r": "8b 08 8b 55 dc 52 ff 91 80 00 00 00 db e2 89 85",
                            "symbol": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1+0x250bb1",
                            "instruction": "mov ecx, dword ptr [eax]",
                            "module": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
                            "exception_code": "0xc0000005",
                            "offset": 2427825,
                            "address": "0x650bb1"
                        }
                    },
                    "time": 1602053587.124875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2818
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1632824,
                            "edi": 10395944,
                            "eax": 1632824,
                            "ebp": 1632904,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.124875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2819
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634372,
                            "edi": 1634656,
                            "eax": 1634372,
                            "ebp": 1634452,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634656,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.124875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2886
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634348,
                            "edi": 1634624,
                            "eax": 1634348,
                            "ebp": 1634428,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634624,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.124875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2914
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.124875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 2925
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.171875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3079
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.171875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3087
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.171875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3095
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n2\n2\n4\n3\n0\n0\n \n@\n \n0\nx\n6\n2\n4\n3\n0\n0\n\n\nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n+\n0\nx\n1\n1\n6\n6\n \nD\nl\nl\nF\nu\nn\nc\nt\ni\no\nn\nC\na\nl\nl\n-\n0\nx\nb\n5\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\na\n0\n4\n8\n \n@\n \n0\nx\n7\n2\n9\n4\na\n0\n4\n8\n\n\nB\nA\nS\nI\nC\n_\nC\nL\nA\nS\nS\n_\nQ\nu\ne\nr\ny\nI\nn\nt\ne\nr\nf\na\nc\ne\n+\n0\nx\ne\nc\na\n \nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n-\n0\nx\n1\n3\na\n4\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n7\nb\n3\ne\n \n@\n \n0\nx\n7\n2\n9\n4\n7\nb\n3\ne\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n3\nd\nd\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n2\ne\n3\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n9\n8\n1\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n9\n8\n1\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n1\n5\n6\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n0\nb\nd\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\nf\na\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\nf\na\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n5\nc\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n1\nb\n7\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\n0\n0\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\n0\n0\n\n\n4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n4\n2\n4\n6\n6\n \n@\n \n0\nx\n4\n4\n2\n4\n6\n6\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
                        "registers": {
                            "esp": 1634784,
                            "edi": 1635232,
                            "eax": 0,
                            "ebp": 1635264,
                            "edx": 5,
                            "ebx": 6618771,
                            "esi": 4291688,
                            "ecx": 4
                        },
                        "exception": {
                            "instruction_r": "8b 08 8b 55 dc 52 ff 91 80 00 00 00 db e2 89 85",
                            "symbol": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1+0x250bb1",
                            "instruction": "mov ecx, dword ptr [eax]",
                            "module": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
                            "exception_code": "0xc0000005",
                            "offset": 2427825,
                            "address": "0x650bb1"
                        }
                    },
                    "time": 1602053587.171875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3096
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1632824,
                            "edi": 10395944,
                            "eax": 1632824,
                            "ebp": 1632904,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.171875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3097
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634372,
                            "edi": 1634656,
                            "eax": 1634372,
                            "ebp": 1634452,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634656,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.171875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3164
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634348,
                            "edi": 1634624,
                            "eax": 1634348,
                            "ebp": 1634428,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634624,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.171875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3192
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.171875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3203
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.218875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3357
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.218875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3365
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.218875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3373
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n2\n2\n4\n3\n7\nb\n \n@\n \n0\nx\n6\n2\n4\n3\n7\nb\n\n\nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n+\n0\nx\n1\n1\n6\n6\n \nD\nl\nl\nF\nu\nn\nc\nt\ni\no\nn\nC\na\nl\nl\n-\n0\nx\nb\n5\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\na\n0\n4\n8\n \n@\n \n0\nx\n7\n2\n9\n4\na\n0\n4\n8\n\n\nB\nA\nS\nI\nC\n_\nC\nL\nA\nS\nS\n_\nQ\nu\ne\nr\ny\nI\nn\nt\ne\nr\nf\na\nc\ne\n+\n0\nx\ne\nc\na\n \nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n-\n0\nx\n1\n3\na\n4\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n7\nb\n3\ne\n \n@\n \n0\nx\n7\n2\n9\n4\n7\nb\n3\ne\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n3\nd\nd\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n2\ne\n3\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n9\n8\n1\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n9\n8\n1\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n1\n5\n6\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n0\nb\nd\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\nf\na\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\nf\na\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n5\nc\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n1\nb\n7\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\n0\n0\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\n0\n0\n\n\n4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n4\n2\n4\n6\n6\n \n@\n \n0\nx\n4\n4\n2\n4\n6\n6\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
                        "registers": {
                            "esp": 1634784,
                            "edi": 1635232,
                            "eax": 0,
                            "ebp": 1635264,
                            "edx": 5,
                            "ebx": 6618771,
                            "esi": 4291688,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "8b 08 8b 55 dc 52 ff 91 80 00 00 00 db e2 89 85",
                            "symbol": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1+0x250bb1",
                            "instruction": "mov ecx, dword ptr [eax]",
                            "module": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
                            "exception_code": "0xc0000005",
                            "offset": 2427825,
                            "address": "0x650bb1"
                        }
                    },
                    "time": 1602053587.218875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3374
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1632824,
                            "edi": 10395944,
                            "eax": 1632824,
                            "ebp": 1632904,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.218875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3375
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634372,
                            "edi": 1634656,
                            "eax": 1634372,
                            "ebp": 1634452,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634656,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.218875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3442
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634348,
                            "edi": 1634624,
                            "eax": 1634348,
                            "ebp": 1634428,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634624,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.218875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3470
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.218875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3481
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.265875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3636
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.265875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3644
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.265875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3652
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.265875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3660
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n2\n2\n4\n3\nf\n6\n \n@\n \n0\nx\n6\n2\n4\n3\nf\n6\n\n\nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n+\n0\nx\n1\n1\n6\n6\n \nD\nl\nl\nF\nu\nn\nc\nt\ni\no\nn\nC\na\nl\nl\n-\n0\nx\nb\n5\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\na\n0\n4\n8\n \n@\n \n0\nx\n7\n2\n9\n4\na\n0\n4\n8\n\n\nB\nA\nS\nI\nC\n_\nC\nL\nA\nS\nS\n_\nQ\nu\ne\nr\ny\nI\nn\nt\ne\nr\nf\na\nc\ne\n+\n0\nx\ne\nc\na\n \nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n-\n0\nx\n1\n3\na\n4\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n7\nb\n3\ne\n \n@\n \n0\nx\n7\n2\n9\n4\n7\nb\n3\ne\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n3\nd\nd\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n2\ne\n3\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n9\n8\n1\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n9\n8\n1\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n1\n5\n6\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n0\nb\nd\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\nf\na\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\nf\na\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n5\nc\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n1\nb\n7\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\n0\n0\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\n0\n0\n\n\n4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n4\n2\n4\n6\n6\n \n@\n \n0\nx\n4\n4\n2\n4\n6\n6\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
                        "registers": {
                            "esp": 1634784,
                            "edi": 1635232,
                            "eax": 0,
                            "ebp": 1635264,
                            "edx": 20,
                            "ebx": 6620237,
                            "esi": 4291688,
                            "ecx": 0
                        },
                        "exception": {
                            "instruction_r": "8b 08 8b 55 dc 52 ff 91 80 00 00 00 db e2 89 85",
                            "symbol": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1+0x250bb1",
                            "instruction": "mov ecx, dword ptr [eax]",
                            "module": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
                            "exception_code": "0xc0000005",
                            "offset": 2427825,
                            "address": "0x650bb1"
                        }
                    },
                    "time": 1602053587.265875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3661
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1632824,
                            "edi": 10395944,
                            "eax": 1632824,
                            "ebp": 1632904,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.265875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3662
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634372,
                            "edi": 1634656,
                            "eax": 1634372,
                            "ebp": 1634452,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634656,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.265875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3729
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634348,
                            "edi": 1634624,
                            "eax": 1634348,
                            "ebp": 1634428,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634624,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.265875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3757
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.265875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3768
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.312875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3923
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.312875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3931
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1634548,
                            "edi": 1634736,
                            "eax": 1634548,
                            "ebp": 1634628,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 1634736,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.312875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3939
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n2\n2\n4\n4\n7\n1\n \n@\n \n0\nx\n6\n2\n4\n4\n7\n1\n\n\nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n+\n0\nx\n1\n1\n6\n6\n \nD\nl\nl\nF\nu\nn\nc\nt\ni\no\nn\nC\na\nl\nl\n-\n0\nx\nb\n5\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\na\n0\n4\n8\n \n@\n \n0\nx\n7\n2\n9\n4\na\n0\n4\n8\n\n\nB\nA\nS\nI\nC\n_\nC\nL\nA\nS\nS\n_\nQ\nu\ne\nr\ny\nI\nn\nt\ne\nr\nf\na\nc\ne\n+\n0\nx\ne\nc\na\n \nE\nb\nL\no\na\nd\nR\nu\nn\nT\ni\nm\ne\n-\n0\nx\n1\n3\na\n4\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n7\nb\n3\ne\n \n@\n \n0\nx\n7\n2\n9\n4\n7\nb\n3\ne\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n3\nd\nd\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n2\ne\n3\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n9\n8\n1\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n9\n8\n1\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n1\n5\n6\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n0\nb\nd\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\nf\na\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\nf\na\n\n\nT\nh\nu\nn\nR\nT\nM\na\ni\nn\n+\n0\nx\n5\nc\n \nE\nb\nC\nr\ne\na\nt\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n3\n1\nb\n7\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\n3\n6\n0\n0\n \n@\n \n0\nx\n7\n2\n9\n4\n3\n6\n0\n0\n\n\n4\n7\n3\n9\n7\n0\n6\ne\n0\ne\n9\n6\nb\n7\n4\n7\n0\n4\n8\ne\na\n3\n1\nb\n1\n9\ne\nb\n7\n3\na\nc\n3\na\n4\n3\n3\n9\n8\n0\n3\n3\ne\na\nf\n4\nf\n1\n2\n7\nd\n3\n0\n6\na\na\n3\n4\n3\nf\na\n8\nc\n1\n+\n0\nx\n4\n2\n4\n6\n6\n \n@\n \n0\nx\n4\n4\n2\n4\n6\n6\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
                        "registers": {
                            "esp": 1634784,
                            "edi": 1635232,
                            "eax": 0,
                            "ebp": 1635264,
                            "edx": 5,
                            "ebx": 6618771,
                            "esi": 4291688,
                            "ecx": 0
                        },
                        "exception": {
                            "instruction_r": "8b 08 8b 55 dc 52 ff 91 80 00 00 00 db e2 89 85",
                            "symbol": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1+0x250bb1",
                            "instruction": "mov ecx, dword ptr [eax]",
                            "module": "4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1.bin",
                            "exception_code": "0xc0000005",
                            "offset": 2427825,
                            "address": "0x650bb1"
                        }
                    },
                    "time": 1602053587.312875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3940
            },
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "E\nb\nG\ne\nt\nH\na\nn\nd\nl\ne\nO\nf\nE\nx\ne\nc\nu\nt\ni\nn\ng\nP\nr\no\nj\ne\nc\nt\n+\n0\nx\n2\n2\nb\n3\n \nr\nt\nc\nP\na\nc\nk\nD\na\nt\ne\n-\n0\nx\nb\na\n9\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nd\n0\nd\nc\nf\n \n@\n \n0\nx\n7\n2\na\n1\n0\nd\nc\nf\n\n\nr\nt\nc\nD\no\nE\nv\ne\nn\nt\ns\n+\n0\nx\n1\n3\n1\n \n_\n_\nv\nb\na\nE\nr\nr\no\nr\n-\n0\nx\n6\n2\n6\n \nm\ns\nv\nb\nv\nm\n6\n0\n+\n0\nx\nc\ne\n2\n2\n8\n \n@\n \n0\nx\n7\n2\na\n0\ne\n2\n2\n8",
                        "registers": {
                            "esp": 1632824,
                            "edi": 10395944,
                            "eax": 1632824,
                            "ebp": 1632904,
                            "edx": 0,
                            "ebx": 10395944,
                            "esi": 10395944,
                            "ecx": 2
                        },
                        "exception": {
                            "instruction_r": "c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b",
                            "symbol": "RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727",
                            "instruction": "leave",
                            "module": "KERNELBASE.dll",
                            "exception_code": "0xc000008f",
                            "offset": 46887,
                            "address": "0x75dbb727"
                        }
                    },
                    "time": 1602053587.312875,
                    "tid": 1512,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 3941
            }
        ],
        "references": [],
        "name": "raises_exception"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2676,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "length": 24576,
                        "protection": 32,
                        "process_handle": "0xffffffff",
                        "base_address": "0x008a0000"
                    },
                    "time": 1602053586.703875,
                    "tid": 1512,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READ"
                    }
                },
                "pid": 2676,
                "type": "call",
                "cid": 307
            }
        ],
        "references": [],
        "name": "protection_rx"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks adapter addresses which can be used to detect virtual network interfaces",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "network",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 0,
                    "nt_status": -1073741772,
                    "api": "GetAdaptersAddresses",
                    "return_value": 111,
                    "arguments": {
                        "flags": 0,
                        "family": 0
                    },
                    "time": 1602053591.703875,
                    "tid": 3020,
                    "flags": {}
                },
                "pid": 2676,
                "type": "call",
                "cid": 13993
            }
        ],
        "references": [],
        "name": "antivm_network_adapters"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "The binary likely contains encrypted or compressed data indicative of a packer",
        "severity": 2,
        "marks": [
            {
                "entropy": 7.886345983961468,
                "section": {
                    "size_of_data": "0x000e9600",
                    "virtual_address": "0x003a8000",
                    "entropy": 7.886345983961468,
                    "name": "UPX1",
                    "virtual_size": "0x000ea000"
                },
                "type": "generic",
                "description": "A section with a high entropy has been found"
            },
            {
                "entropy": 0.9957333333333334,
                "type": "generic",
                "description": "Overall entropy of this PE file is high"
            }
        ],
        "references": [
            "http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
            "http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
        ],
        "name": "packer_entropy"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "The executable is compressed using UPX",
        "severity": 2,
        "marks": [
            {
                "section": "UPX0",
                "type": "generic",
                "description": "Section name indicates UPX"
            },
            {
                "section": "UPX1",
                "type": "generic",
                "description": "Section name indicates UPX"
            }
        ],
        "references": [],
        "name": "packer_upx"
    },
    {
        "markcount": 5,
        "families": [],
        "description": "Sets or modifies WPAD proxy autoconfiguration file for traffic interception",
        "severity": 3,
        "marks": [
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExA",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x000004a8",
                        "value": 1,
                        "regkey_r": "WpadDecisionReason",
                        "reg_type": 4,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason"
                    },
                    "time": 1602053594.281875,
                    "tid": 3020,
                    "flags": {
                        "reg_type": "REG_DWORD"
                    }
                },
                "pid": 2676,
                "type": "call",
                "cid": 14267
            },
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExA",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x000004a8",
                        "value": "\u0080BWh\u00ae\u009c\u00d6\u0001",
                        "regkey_r": "WpadDecisionTime",
                        "reg_type": 3,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime"
                    },
                    "time": 1602053594.281875,
                    "tid": 3020,
                    "flags": {
                        "reg_type": "REG_BINARY"
                    }
                },
                "pid": 2676,
                "type": "call",
                "cid": 14268
            },
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExA",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x000004a8",
                        "value": 3,
                        "regkey_r": "WpadDecision",
                        "reg_type": 4,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision"
                    },
                    "time": 1602053594.281875,
                    "tid": 3020,
                    "flags": {
                        "reg_type": "REG_DWORD"
                    }
                },
                "pid": 2676,
                "type": "call",
                "cid": 14269
            },
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExW",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x000004a8",
                        "value": "Unidentified network",
                        "regkey_r": "WpadNetworkName",
                        "reg_type": 1,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName"
                    },
                    "time": 1602053594.281875,
                    "tid": 3020,
                    "flags": {
                        "reg_type": "REG_SZ"
                    }
                },
                "pid": 2676,
                "type": "call",
                "cid": 14270
            },
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExW",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x000004a4",
                        "value": "{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
                        "regkey_r": "WpadLastNetwork",
                        "reg_type": 1,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork"
                    },
                    "time": 1602053594.312875,
                    "tid": 3020,
                    "flags": {
                        "reg_type": "REG_SZ"
                    }
                },
                "pid": 2676,
                "type": "call",
                "cid": 14338
            }
        ],
        "references": [],
        "name": "modifies_proxy_wpad"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 546,
            "time": 3.0782599449157715,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 8466,
            "time": 9.07819390296936,
            "dport": 138,
            "sport": 138
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 10310,
            "time": 7.145554065704346,
            "dport": 5355,
            "sport": 49840
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 10630,
            "time": 3.021644115447998,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 10958,
            "time": 1.0326969623565674,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 11286,
            "time": 3.0285730361938477,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 11614,
            "time": 1.6144580841064453,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 11942,
            "time": -0.09137606620788574,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 12270,
            "time": 7.051732063293457,
            "dport": 5355,
            "sport": 55880
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 12590,
            "time": 7.517460107803345,
            "dport": 5355,
            "sport": 64017
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 12910,
            "time": 1.5945250988006592,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 32320,
            "time": 1.0656039714813232,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 40704,
            "time": 3.1096439361572266,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "5af19ff6114e611290374f9f089922b6bcc9d13f5e54aa6cca321ca41b5aa8ea",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "8db1b41b8cc04be0767f9d45b372b9bfa5603a92b57d1ad6d714cbb7e70e879e",
    "irc": [],
    "https_ex": []
}

Screenshots

PTracker.exe removal instructions

The instructions below shows how to remove PTracker.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the PTracker.exe file for removal, restart your computer and scan it again to verify that PTracker.exe has been successfully removed. Here are the removal instructions in more detail:

Download and install FreeFixer: http://www.freefixer.com/download.html
Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
When the scan is finished, locate PTracker.exe in the scan result and tick the checkbox next to the PTracker.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate PTracker.exe in the scan result.

c:\downloads\PTracker.exe
Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the PTracker.exe file.
Restart your computer.
Start FreeFixer and scan your computer again. If PTracker.exe still remains in the scan result, proceed with the next step. If PTracker.exe is gone from the scan result you're done.
If PTracker.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
Restart your computer.
Start FreeFixer and scan your computer again. Verify that PTracker.exe no longer appear in the scan result.

Free Questionnaires

Hashes [?]

Property	Value
MD5	94d1a33446bdc86b058e428e966dc664
SHA256	4739706e0e96b747048ea31b19eb73ac3a43398033eaf4f127d306aa343fa8c1

Error Messages

These are some of the error messages that can appear related to ptracker.exe:

ptracker.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

ptracker.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.

Print Tracker has stopped working.

End Program - ptracker.exe. This program is not responding.

ptracker.exe is not a valid Win32 application.

ptracker.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.

What will you do with PTracker.exe?

To help other users, please let us know what you will do with PTracker.exe:

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

No comments posted yet.

What is PTracker.exe?

Vendor and version information [?]

Digital signatures [?]

VirusTotal report

Sandbox Report

Summary

Summary

Dropped

Generic

Signatures

Yara

Network

Screenshots

PTracker.exe removal instructions

Hashes [?]

Error Messages

What will you do with PTracker.exe?

Comments

Leave a reply