What is avira.servicehost.exe?

avira.servicehost.exe is part of Avira.OE.ServiceHost and developed by Avira Operations GmbH & Co. KG according to the avira.servicehost.exe version information.

avira.servicehost.exe's description is "Avira Service Host"

avira.servicehost.exe is digitally signed by Avira Operations GmbH & Co. KG.

avira.servicehost.exe is usually located in the 'c:\program files (x86)\avira\launcher\' folder.

None of the anti-virus scanners at VirusTotal reports anything malicious about avira.servicehost.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on avira.servicehost.exe:

PropertyValue
Product nameAvira.OE.ServiceHost
Company nameAvira Operations GmbH & Co. KG
File descriptionAvira Service Host
Internal nameAvira.ServiceHost.exe
Original filenameAvira.ServiceHost.exe
Legal copyrightCopyright © 2016 Avira Operations GmbH & Co. KG and its Licensors
Product version1.2.119.17994
File version1.2.119.17994

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product nameAvira.OE.ServiceHost
Company nameAvira Operations GmbH & Co. KG
File descriptionAvira Service Host
Internal nameAvira.ServiceHost.exe
Original filenameAvira.ServiceHost.exe
Legal copyrightCopyright © 2016 Avira Operations G..
Product version1.2.119.17994
File version1.2.119.17994

Digital signatures [?]

avira.servicehost.exe has a valid digital signature.

PropertyValue
Signer nameAvira Operations GmbH & Co. KG
Certificate issuer nameSymantec Class 3 Extended Validation Code Signing CA - G2
Certificate serial number1feb5456b9e0c2c68357c42975b98224

VirusTotal report

None of the 69 anti-virus programs at VirusTotal detected the avira.servicehost.exe file.

None of the 69 anti-virus programs detected the avira.servicehost.exe file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "file_created": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp.hdmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
    ],
    "file_recreated": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
        "\\Device\\KsecDD",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
    ],
    "regkey_written": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\\Blob",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob",
        "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\LanguageList"
    ],
    "dll_loaded": [
        "imagehlp.dll",
        "API-MS-Win-Security-LSALookup-L1-1-0.dll",
        "DNSAPI.dll",
        "UxTheme.dll",
        "C:\\Windows\\system32\\ole32.dll",
        "dwmapi.dll",
        "cryptsp.dll",
        "ncrypt.dll",
        "C:\\Windows\\system32\\RICHED20.DLL",
        "API-MS-WIN-Service-Management-L2-1-0.dll",
        "crypt32.dll",
        "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
        "SspiCli.dll",
        "advapi32.dll",
        "comctl32",
        "psapi.dll",
        "SHLWAPI.dll",
        "USER32.dll",
        "C:\\Windows\\syswow64\\CRYPT32.dll",
        "SHELL32.dll",
        "C:\\Windows\\System32\\wship6.dll",
        "setupapi.dll",
        "CFGMGR32.dll",
        "rpcrt4.dll",
        "C:\\Windows\\System32\\wshtcpip.dll",
        "ntdll",
        "kernel32.dll",
        "C:\\Windows\\system32\\IMM32.DLL",
        "SensApi.dll",
        "ntdll.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ole32.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\culture.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\VERSION.dll",
        "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
        "C:\\Windows\\system32\\wer.dll",
        "Comctl32.dll",
        "IPHLPAPI.DLL",
        "RichEd20.dll",
        "winhttp.dll",
        "profapi.dll",
        "comctl32.dll",
        "VERSION.dll",
        "WINTRUST.DLL",
        "C:\\Windows\\system32\\cryptnet.dll",
        "DEVRTL.dll",
        "Cabinet.dll",
        "user32.dll",
        "WINHTTP.dll",
        "gdi32.dll",
        "verifier.dll",
        "bcrypt.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
        "C:\\Windows\\syswow64\\MSCTF.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
        "CRYPTSP.dll",
        "credssp.dll",
        "API-MS-WIN-Service-winsvc-L1-1-0.dll",
        "C:\\Windows\\system32\\xmllite.dll",
        "ole32.dll",
        "DUser.dll",
        "NSI.dll",
        "mscorsec.dll",
        "C:\\Windows\\system32\\DUser.dll",
        "powrprof.dll",
        "ADVAPI32.dll",
        "WS2_32.dll",
        "dbghelp.dll",
        "werui.dll",
        "DUI70.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll",
        "imm32.dll",
        "API-MS-WIN-Service-Management-L1-1-0.dll",
        "cryptnet.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordacwks.dll",
        "OLEAUT32.DLL",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
        "API-MS-Win-Security-SDDL-L1-1-0.dll",
        "version.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll",
        "shell32.dll",
        "OLEAUT32.dll",
        "RPCRT4.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll",
        "mscoree.dll",
        "C:\\Windows\\system32\\mswsock.dll",
        "AdvApi32.dll"
    ],
    "file_failed": [
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\FA47BF11E3FC6DA7A80A2910535F021F",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0972B7C417F696E06E186AEB26286F01_EC6918D7CB4A54242E7A79500CDB31EB",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3D0AC26322348780E90E022EA217C58C",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_DC03E45EC7611F50ADAEBABE405A8C4C",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin.config",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A3D5BF1283C2E63D8C8A8C72F0051F5A",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0972B7C417F696E06E186AEB26286F01_8A7601FFF9878487CA80CB28D50438E2"
    ],
    "regkey_opened": [
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets\\LocalIntranet",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\index127",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\HeapControlledList\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Assemblies\\Global",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Fusion",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\Standards\\v2.0.50727",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\Upgrades",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ExcludedApplications",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\Standards",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LsaExtensionConfig\\SspiCli",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\Tracing",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79",
        "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting\\InclusionList",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\dw20.exe",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\CEIPRole\\RolesInWER",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\KnownManagedDebuggingDlls",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\v2.0.50727\\Security\\Policy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\StrongName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System__b77a5c561934e089",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Xml__b77a5c561934e089",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5f57882f\\7d473bb0",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\InclusionList",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4d36e972-e325-11ce-bfc1-08002be10318}",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SspiCache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Windows",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\ExclusionList",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\55b53053\\df39bd4",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting\\InclusionList",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Throttling\\CLR20r3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\ExclusionList",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Assemblies\\Global",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\Standards",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\ExcludedApplications",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Drawing__b03f5f7f11d50a3a",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\DirectUI",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\GACChangeNotification\\Default",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\InclusionList",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\APTCA",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\v2.0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Assemblies\\Global",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Reliability Analysis\\RAC",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\AppPatch",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting\\ExclusionList",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework\\Policy\\Standards",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Windows.Forms__b77a5c561934e089",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets\\Internet",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Configuration__b03f5f7f11d50a3a",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
        "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting\\ExclusionList",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\PublisherPolicy\\Default",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a",
        "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting"
    ],
    "resolves_host": [
        "sw.symcd.com",
        "watson.microsoft.com",
        "s.symcb.com",
        "s.symcd.com",
        "www.download.windowsupdate.com",
        "sw.symcb.com"
    ],
    "file_written": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp.hdmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
    ],
    "regkey_deleted": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE"
    ],
    "file_deleted": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp.hdmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
    ],
    "file_exists": [
        "C:\\Windows\\System32\\apphelp.dll",
        "C:\\Users\\cuck\\AppData\\LocalLow",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore.dll",
        "C:\\Windows\\Globalization\\en-us.nlp",
        "C:\\Windows\\SysWOW64\\user32.dll",
        "C:\\Windows\\SysWOW64\\crypt32.dll",
        "C:\\Windows\\SysWOW64\\advapi32.dll",
        "C:\\Windows\\SysWOW64\\msctf.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp",
        "C:\\Windows\\SysWOW64\\sspicli.dll",
        "C:\\Windows\\System32\\cabinet.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config",
        "C:\\Windows\\System32\\winhttp.dll",
        "C:\\Windows\\SysWOW64\\kernel32.dll",
        "C:\\Windows\\SysWOW64\\msvcrt.dll",
        "C:\\Windows\\System32\\winnsi.dll",
        "C:\\Windows\\SysWOW64\\shlwapi.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore\\Avira.OE.WinCore.dll",
        "C:\\Windows\\System32\\bcrypt.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
        "C:\\Windows\\System32\\cryptsp.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\fusion.localgac",
        "C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore\\Avira.OE.WinCore.exe",
        "C:\\Windows\\SysWOW64\\ole32.dll",
        "C:\\Windows\\System32\\devrtl.dll",
        "C:\\Windows\\System32\\profapi.dll",
        "C:\\Windows\\System32\\mscoree.dll",
        "C:\\Windows\\System32\\qagentrt.dll",
        "C:\\Windows\\SysWOW64\\msasn1.dll",
        "C:\\Windows\\System32\\IPHLPAPI.DLL",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
        "C:\\Windows\\SysWOW64\\shell32.dll",
        "C:\\Windows\\SysWOW64\\lpk.dll",
        "C:\\Windows\\System32\\version.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll",
        "C:\\Windows\\SysWOW64\\wintrust.dll",
        "C:\\Windows\\System32\\dhcpcsvc6.DLL",
        "C:\\Windows\\System32\\imm32.dll",
        "C:\\Windows\\inf\\",
        "C:\\Windows\\System32\\gpapi.dll",
        "C:\\Windows\\System32\\userenv.dll",
        "C:\\Windows\\System32\\MSCOREE.DLL.local",
        "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
        "C:\\Windows\\System32\\rasadhlp.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp.hdmp",
        "C:\\Windows\\System32\\dhcpcsvc.dll",
        "C:\\Windows\\System32\\en-US\\erofflps.txt",
        "C:\\Windows\\System32\\ncrypt.dll",
        "C:\\Windows\\SysWOW64\\ntdll.dll",
        "C:\\Windows\\SysWOW64\\usp10.dll",
        "C:\\Windows\\System32\\dnsapi.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "C:\\Windows\\SysWOW64\\ws2_32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml",
        "C:\\Windows\\System32\\webio.dll",
        "C:\\Windows\\SysWOW64\\sechost.dll",
        "C:\\Windows\\System32\\cryptnet.dll",
        "C:\\Windows\\System32\\wship6.dll",
        "C:\\Windows\\System32\\p2pcollab.dll",
        "C:\\Windows\\System32\\credssp.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.config",
        "C:\\Windows\\SysWOW64\\gdi32.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll",
        "C:\\Windows\\System32\\mswsock.dll",
        "C:\\Windows\\SysWOW64\\imagehlp.dll",
        "C:\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\msvcr80.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll",
        "C:\\Windows\\SysWOW64\\rpcrt4.dll",
        "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll",
        "C:\\Windows\\System32\\WSHTCPIP.DLL",
        "C:\\Windows\\System32\\rsaenh.dll",
        "C:\\Windows\\assembly\\GAC\\PublisherPolicy.tme",
        "C:\\Windows\\SysWOW64\\nsi.dll",
        "C:\\Windows\\SysWOW64\\Wldap32.dll",
        "C:\\Windows\\System32\\SensApi.dll",
        "C:\\Windows\\SysWOW64\\KERNELBASE.dll",
        "C:\\Windows\\SysWOW64\\cfgmgr32.dll"
    ],
    "mutex": [
        "Global\\037add7c-14af-11ea-8829-08002749d99b"
    ],
    "file_opened": [
        "C:\\Windows\\System32\\mscoree.dll",
        "C:\\Windows\\SysWOW64\\user32.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\index127.dat",
        "C:\\Windows\\SysWOW64\\sspicli.dll",
        "C:\\Windows\\System32\\cabinet.dll",
        "C:\\Windows\\System32\\WSHTCPIP.DLL",
        "C:\\Windows\\System32\\gpapi.dll",
        "C:\\Windows\\System32\\netmsg.dll",
        "C:\\Windows\\SysWOW64\\ole32.dll",
        "C:\\Windows\\System32\\profapi.dll",
        "C:\\Windows\\System32\\IPHLPAPI.DLL",
        "C:\\Windows\\System32\\en-US\\WINHTTP.dll.mui",
        "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
        "C:\\Windows\\SysWOW64\\wintrust.dll",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
        "C:\\Windows\\System32\\credssp.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
        "C:\\Windows\\System32\\rasadhlp.dll",
        "C:\\Windows\\SysWOW64\\usp10.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "C:\\Windows\\System32\\mswsock.dll",
        "C:\\Windows\\SysWOW64\\sechost.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
        "C:\\Windows\\System32\\wship6.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
        "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
        "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll",
        "C:\\Windows\\SysWOW64\\Wldap32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
        "C:\\Windows\\System32\\winnsi.dll",
        "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
        "C:\\Windows\\System32\\webio.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
        "C:\\Windows\\System32\\devrtl.dll",
        "C:\\Windows\\SysWOW64\\shell32.dll",
        "C:\\Windows\\SysWOW64\\lpk.dll",
        "C:\\Windows\\System32\\version.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
        "C:\\Windows\\System32\\dhcpcsvc.dll",
        "C:\\Windows\\System32\\dnsapi.dll",
        "C:\\Windows\\SysWOW64\\ws2_32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
        "C:\\Windows\\assembly\\pubpol4.dat",
        "C:\\Windows\\SysWOW64\\gdi32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
        "C:\\Windows\\System32\\rsaenh.dll",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
        "C:\\Windows\\System32\\SensApi.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
        "C:\\Windows\\System32\\cryptnet.dll",
        "C:\\Windows\\SysWOW64\\kernel32.dll",
        "C:\\Windows\\SysWOW64\\msvcrt.dll",
        "C:\\Windows\\SysWOW64\\shlwapi.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
        "C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
        "C:\\Windows\\System32\\dhcpcsvc6.DLL",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
        "C:\\Windows\\System32\\winhttp.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
        "C:\\Windows\\SysWOW64\\ntdll.dll",
        "C:\\Windows\\System32\\imm32.dll",
        "C:\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\msvcr80.dll",
        "C:\\Windows\\SysWOW64\\rpcrt4.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
        "C:\\Windows\\System32\\apphelp.dll",
        "C:\\Users\\cuck\\AppData\\LocalLow",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
        "C:\\Windows\\SysWOW64\\advapi32.dll",
        "C:\\Windows\\SysWOW64\\msctf.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
        "C:\\Windows\\System32\\userenv.dll",
        "C:\\Windows\\System32\\bcrypt.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
        "C:\\Windows\\System32\\cryptsp.dll",
        "C:\\Windows\\SysWOW64\\nsi.dll",
        "C:\\Windows\\System32\\l_intl.nls",
        "C:\\Windows\\SysWOW64\\crypt32.dll",
        "C:\\Windows\\SysWOW64\\msasn1.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll",
        "C:\\Windows\\win.ini",
        "C:\\Windows\\System32\\en-US\\erofflps.txt",
        "C:\\Windows\\System32\\ncrypt.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll",
        "C:\\Windows\\SysWOW64\\imagehlp.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
        "C:\\Windows\\SysWOW64\\KERNELBASE.dll"
    ],
    "guid": [
        "{713aacc8-3b71-435c-a3a1-be4e53621ab1}",
        "{22e4c895-8ab9-40bb-b81a-001dd9b1f449}"
    ],
    "command_line": [
        "dw20.exe -x -s 936"
    ],
    "file_read": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
        "C:\\Windows\\win.ini",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
    ],
    "regkey_read": [
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\LatestIndex",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\\Serial_Access_Num",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\wshtcpip.dll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableQueue",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\Modules",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SecurityProviders",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\ILDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\GPAPI.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorSystemHeapIsPrivate",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxAIAUrlRetrievalCertCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7\\Name",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagMatchAnyMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\profapi.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\apphelp.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WS2_32.dll",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\CLR20r3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\webio.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\wship6.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\MVID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\ntdll.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\44D72C57",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DEVRTL.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\BIOSVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\CLRLoadLogDir",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\NSI.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\LastModTime",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LastWatsonCabUploaded",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\ADVAPI32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\DevOverrideEnable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxAIAUrlRetrievalCountPerChain",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Disabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\LPK.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\shell32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rsaenh.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NoClientChecks",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\DownloadCacheQuotaInKB",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\MVID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\credssp.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Reliability Analysis\\RAC\\RacWerSampleTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\KERNELBASE.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LoggingLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\EvalationData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\MVID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\ConfigMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CurrentType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\imagehlp.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\COMCTL32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LogFailures",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\MissingDependencies",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DisableQueue",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CRYPT32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\NIDependencies",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SspiCli.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\MSASN1.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\NIDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxAIAUrlRetrievalByteCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\GDI32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetCachedOcspSwitchToCrlCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WINTRUST.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\index127\\ILUsageMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\UseLegacyIdentityFormat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SHLWAPI.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableUnsupportedCriticalExtensions",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Comment",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DebugFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\msvcrt.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WLDAP32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\SensApi.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\OnlyUseLatestCLR",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\Modules",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\KERNEL32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetMaxCachedOcspPerCrlCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\Status",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\index127\\NIUsageMask",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\sechost.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\ConfigString",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\Status",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\Mapping",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\NIDependencies",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Type",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\ncrypt.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DNSAPI.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\ole32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MaxSockaddrLength",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\cryptnet.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\ConfigString",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CRYPTBASE.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\KnownManagedDebuggingDlls\\C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordacwks.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\EnableInetUnknownAuth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProductName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\CacheLocation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\\Blob",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureRoutine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CFGMGR32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MachineID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableCANameConstraints",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\LegacyPolicyTimeStamp",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MinSockaddrLength",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\Modules",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
        "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\p2pcollab.dll,-8042",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\USERENV.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\IMM32.DLL",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureDll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\ConfigString",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\USER32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\bcrypt.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\VersioningLog",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\GCStressStartAtJit",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\mscorlib,2.0.0.0,,b77a5c561934e089,x86",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\SendEFSFiles",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Capabilities",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\ConfigMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\DisableMSIPeek",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\ChainCacheResyncFiletime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\Status",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\HelperDllName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing\\State",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\ConfigMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\SendEFSFiles",
        "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\Latest",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\Modules",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\ILDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\WINHTTP.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\EvalationData",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Windows\\CSDBuildNumber",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\TokenSize",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\MissingDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorUseSystemHeap",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\InstallRoot",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\MissingDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\dhcpcsvc6.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxAIAUrlCountInCert",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\dhcpcsvc.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LogResourceBinds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System,2.0.0.0,,b77a5c561934e089,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\Cabinet.dll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip\\WinSock 2.0 Provider ID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\EnableLog",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\CRYPTSP.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SYSTEM32\\MSCOREE.DLL",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\DisableConfigCache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\ILDependencies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\ForceLog",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\GCStressStart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\Modules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rasadhlp.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\DisableBranchCache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\mswsock.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\CLR20r3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\USP10.dll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\RPCRT4.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableMandatoryBasicConstraints",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\UseDelayedAcceptance",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\RestartRunTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\LastModTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\EvalationData",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DebugHeapFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\EnableWeakSignatureFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\SIG",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\DisplayName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\WINNSI.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\MSCTF.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\RestartRunTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\IPHLPAPI.DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\Safety Warning Level",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing\\Enabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\RpcId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\MSVCR80.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\Status",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\index4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\VERSION.dll"
    ],
    "directory_enumerated": [
        "C:\\Windows\\System32\\apphelp.dll",
        "C:\\Windows\\SysWOW64\\wintrust.dll",
        "C:\\Windows\\SysWOW64",
        "C:\\Users\\cuck\\AppData",
        "C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\2.0.0.0__b03f5f7f11d50a3a\\System.ServiceProcess.INI",
        "C:\\Windows\\SysWOW64\\advapi32.dll",
        "C:\\Windows\\assembly",
        "C:\\Windows\\SysWOW64\\msctf.dll",
        "C:\\Windows\\System32\\devrtl.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp",
        "C:\\Windows\\SysWOW64\\sspicli.dll",
        "C:\\Windows\\System32\\cabinet.dll",
        "C:\\Windows\\System32\\winhttp.dll",
        "C:\\Windows\\SysWOW64\\kernel32.dll",
        "C:\\Windows\\SysWOW64\\msvcrt.dll",
        "C:\\Windows\\SysWOW64\\shlwapi.dll",
        "C:\\Windows\\System32\\winnsi.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscoreei.dll",
        "C:\\Windows\\System32\\bcrypt.dll",
        "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
        "C:\\Windows\\System32\\WSHTCPIP.DLL",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
        "C:\\Windows\\System32\\cryptsp.dll",
        "C:\\Windows\\System32\\webio.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
        "C:\\Windows\\SysWOW64\\ole32.dll",
        "C:\\Users\\cuck\\AppData\\Local",
        "C:\\Windows\\System32\\profapi.dll",
        "C:\\Windows\\System32\\mscoree.dll",
        "C:\\Windows\\SysWOW64\\crypt32.dll",
        "C:\\Windows\\SysWOW64\\msasn1.dll",
        "C:\\Windows\\System32\\IPHLPAPI.DLL",
        "C:\\Windows\\SysWOW64\\user32.dll",
        "C:\\Windows\\SysWOW64\\shell32.dll",
        "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll",
        "C:\\Windows\\SysWOW64\\lpk.dll",
        "C:\\Windows\\System32\\version.dll",
        "C:\\Users",
        "C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.INI",
        "C:\\Windows\\System32",
        "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
        "C:\\Windows\\System32\\gpapi.dll",
        "C:\\Windows\\System32\\userenv.dll",
        "C:\\Windows\\Microsoft.NET\\Framework\\Upgrades.2.0.50727\\mscoreei.dll",
        "C:\\Windows\\SysWOW64\\nsi.dll",
        "C:\\Windows\\System32\\rasadhlp.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib",
        "C:\\Windows\\winsxs",
        "C:\\Windows\\System32\\dhcpcsvc.dll",
        "C:\\Windows\\System32\\ncrypt.dll",
        "C:\\Windows\\SysWOW64\\ntdll.dll",
        "C:\\Users\\cuck",
        "C:\\Windows\\System32\\dnsapi.dll",
        "C:\\Windows\\SysWOW64\\ws2_32.dll",
        "C:\\Windows\\SysWOW64\\sechost.dll",
        "C:\\Windows\\System32\\cryptnet.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.INI",
        "C:\\Windows\\System32\\wship6.dll",
        "C:\\Windows\\System32\\credssp.dll",
        "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System",
        "C:\\Windows\\System32\\imm32.dll",
        "C:\\Windows\\SysWOW64\\gdi32.dll",
        "C:\\Windows\\System32\\SensApi.dll",
        "C:\\Windows\\System32\\mswsock.dll",
        "C:\\Windows\\SysWOW64\\imagehlp.dll",
        "C:\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\msvcr80.dll",
        "C:\\Windows\\SysWOW64\\usp10.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\AppCrash_*_4c2a1b51a2182d52302ef23333c915f4dc39b3a0_cab_*",
        "C:\\Windows\\SysWOW64\\rpcrt4.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_*_4c2a1b51a2182d52302ef23333c915f4dc39b3a0_cab_*",
        "C:\\Windows\\System32\\drivers\\*.mrk",
        "C:\\Windows\\System32\\rsaenh.dll",
        "C:\\Windows",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_*",
        "C:\\Windows\\SysWOW64\\Wldap32.dll",
        "C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.INI",
        "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0972B7C417F696E06E186AEB26286F01_*"
    ]
}

Dropped

[
    {
        "yara": [],
        "sha1": "cf925fc512b936fe7d44ceb6e999e4a020ed6ff0",
        "name": "4c9c4d831d61c8c3_Cab5B91.tmp",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
        "type": "Microsoft Cabinet archive data, 56952 bytes, 1 file",
        "sha256": "4c9c4d831d61c8c38b2513f9b431ef4f4cf6af9fb18a2317cd2178d6e0997822",
        "urls": [],
        "crc32": "5168F337",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3970\/files\/4c9c4d831d61c8c3_Cab5B91.tmp",
        "ssdeep": null,
        "size": 56952,
        "sha512": "65dc435f6d3e1afd347ba1617a3eee59c6660f221faa36456a09e307d434d7276e8095e8aa34d59933e685a9f84564ec783e59ae9658791f7ebdbbc2eda32f7a",
        "pids": [
            2736
        ],
        "md5": "04d79a0dc77a8f449cbff6252862d398"
    },
    {
        "yara": [],
        "sha1": "4c59a83f08ce5989c52a355dd1fadd779f85a6ae",
        "name": "ba4372a3d66cb05d_wer62a1.tmp.werinternalmetadata.xml",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml",
        "type": "XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators",
        "sha256": "ba4372a3d66cb05d2aa8f985bae43f2ccca99b3ecfd0a62e156b5f77922f6429",
        "urls": [],
        "crc32": "FFB1019F",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3970\/files\/ba4372a3d66cb05d_wer62a1.tmp.werinternalmetadata.xml",
        "ssdeep": null,
        "size": 2684,
        "sha512": "bdee949c26a05f430f5e453257372f4aada0b5a999a35b838147133a271126e2ef5ffda58eda6b57c112a6966ac31247da00e7797931de9b1659783281ea7b1c",
        "pids": [
            1576
        ],
        "md5": "ffdd5fc8dac2f53c01175754f8ce5502"
    },
    {
        "yara": [],
        "sha1": "c64ad224b877cd5bbdcdb1799b71f3682602d231",
        "name": "b0a39e28d93f7822_Tar5B92.tmp",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
        "type": "data",
        "sha256": "b0a39e28d93f7822fe6cac1e082c7adc581dcd2b61eb9f536e74bd14a75b27bc",
        "urls": [
            "http:\/\/www.microsoft.com\/pkiops\/certs\/Microsoft%20Certificate%20Trust%20List%20PCA(3).crt0",
            "http:\/\/www.microsoft.com\/pki\/certs\/MicRooCerAut_2010-06-23.crt07",
            "http:\/\/www.microsoft.com\/pki\/certs\/MicCerLisCA2011_2011-03-29.crt0",
            "http:\/\/www.microsoft.com\/pki\/certs\/MicrosoftRootCert.crt0",
            "http:\/\/www.microsoft.com\/pkiops\/crl\/Microsoft%20Certificate%20Trust%20List%20PCA(3).crl0u"
        ],
        "crc32": "B495BE07",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3970\/files\/b0a39e28d93f7822_Tar5B92.tmp",
        "ssdeep": null,
        "size": 138525,
        "sha512": "0663fb22bcefd0ac5f090104322a8c0dc1ceb77a168b589d7dbb9a74d109daf38beac97dab715220abab08c355496f5719159e17995248caa19eff45bc2a5d46",
        "pids": [
            2736
        ],
        "md5": "0e34ebf89b843b303f0fb5f194be9d28"
    },
    {
        "yara": [],
        "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
        "name": "e3b0c44298fc1c14_WER62A1.tmp",
        "type": "empty",
        "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "urls": [],
        "crc32": "00000000",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3970\/files\/e3b0c44298fc1c14_WER62A1.tmp",
        "ssdeep": null,
        "size": 0,
        "sha512": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e",
        "md5": "d41d8cd98f00b204e9800998ecf8427e"
    },
    {
        "yara": [
            {
                "meta": {
                    "description": "Contains an embedded Mach-O file",
                    "author": "nex"
                },
                "name": "embedded_macho",
                "offsets": {
                    "magic1": [
                        [
                            16138554,
                            0
                        ]
                    ]
                },
                "strings": [
                    "yv66vg=="
                ]
            },
            {
                "meta": {
                    "description": "Contains an embedded PE32 file",
                    "author": "nex"
                },
                "name": "embedded_pe",
                "offsets": {
                    "a": [
                        [
                            21222061,
                            0
                        ],
                        [
                            25554035,
                            0
                        ]
                    ],
                    "b": [
                        [
                            15418665,
                            1
                        ]
                    ]
                },
                "strings": [
                    "UEUzMg==",
                    "VGhpcyBwcm9ncmFt"
                ]
            },
            {
                "meta": {
                    "description": "A non-Windows executable contains win32 API functions names",
                    "author": "nex"
                },
                "name": "embedded_win_api",
                "offsets": {
                    "api6": [
                        [
                            6966170,
                            7
                        ],
                        [
                            7166829,
                            7
                        ],
                        [
                            9996425,
                            7
                        ],
                        [
                            18728718,
                            7
                        ],
                        [
                            20034220,
                            7
                        ],
                        [
                            21282098,
                            7
                        ],
                        [
                            21310599,
                            7
                        ]
                    ],
                    "api7": [
                        [
                            5787407,
                            6
                        ],
                        [
                            5787883,
                            6
                        ],
                        [
                            5787994,
                            6
                        ],
                        [
                            5830085,
                            6
                        ],
                        [
                            6813079,
                            6
                        ],
                        [
                            6837144,
                            6
                        ],
                        [
                            6873584,
                            6
                        ],
                        [
                            6877144,
                            6
                        ],
                        [
                            6980182,
                            6
                        ],
                        [
                            7157102,
                            6
                        ],
                        [
                            7158401,
                            6
                        ],
                        [
                            7158422,
                            6
                        ],
                        [
                            7159874,
                            6
                        ],
                        [
                            7160442,
                            6
                        ],
                        [
                            7160462,
                            6
                        ],
                        [
                            7160812,
                            6
                        ],
                        [
                            7567765,
                            6
                        ],
                        [
                            9994805,
                            6
                        ]
                    ],
                    "api1": [
                        [
                            15711423,
                            0
                        ],
                        [
                            15711490,
                            0
                        ]
                    ],
                    "api2": [
                        [
                            5613057,
                            1
                        ],
                        [
                            6965582,
                            1
                        ]
                    ],
                    "api3": [
                        [
                            7184451,
                            4
                        ],
                        [
                            9989363,
                            4
                        ]
                    ],
                    "api8": [
                        [
                            18726644,
                            2
                        ],
                        [
                            20032134,
                            2
                        ],
                        [
                            21241803,
                            2
                        ],
                        [
                            21282176,
                            2
                        ]
                    ],
                    "api14": [
                        [
                            18726644,
                            2
                        ],
                        [
                            20032134,
                            2
                        ],
                        [
                            21241803,
                            2
                        ],
                        [
                            21282176,
                            2
                        ]
                    ],
                    "api12": [
                        [
                            18728649,
                            5
                        ],
                        [
                            21282054,
                            5
                        ],
                        [
                            21282074,
                            5
                        ]
                    ],
                    "api13": [
                        [
                            6842046,
                            3
                        ],
                        [
                            7177355,
                            3
                        ],
                        [
                            18726726,
                            3
                        ],
                        [
                            21281680,
                            3
                        ]
                    ]
                },
                "strings": [
                    "Q3JlYXRlRmlsZUE=",
                    "R2V0UHJvY0FkZHJlc3M=",
                    "R2V0V2luZG93c0RpcmVjdG9yeQ==",
                    "R2V0VGVtcFBhdGg=",
                    "TG9hZExpYnJhcnlB",
                    "U2V0RmlsZVBvaW50ZXI=",
                    "U2hlbGxFeGVjdXRl",
                    "V3JpdGVGaWxl"
                ]
            },
            {
                "meta": {
                    "description": "Matched shellcode byte patterns",
                    "author": "nex"
                },
                "name": "shellcode",
                "offsets": {
                    "shell7": [
                        [
                            4989682,
                            0
                        ],
                        [
                            5067074,
                            0
                        ],
                        [
                            5108402,
                            0
                        ],
                        [
                            5138914,
                            0
                        ],
                        [
                            8609102,
                            0
                        ],
                        [
                            8657062,
                            0
                        ],
                        [
                            8771382,
                            0
                        ],
                        [
                            8818426,
                            0
                        ],
                        [
                            8837650,
                            0
                        ],
                        [
                            8872166,
                            0
                        ],
                        [
                            8884202,
                            0
                        ],
                        [
                            8884278,
                            0
                        ],
                        [
                            8889626,
                            0
                        ],
                        [
                            8890418,
                            0
                        ],
                        [
                            8916722,
                            0
                        ],
                        [
                            9008166,
                            0
                        ],
                        [
                            9100998,
                            0
                        ],
                        [
                            9121330,
                            0
                        ],
                        [
                            9133426,
                            0
                        ],
                        [
                            9345298,
                            0
                        ],
                        [
                            9384722,
                            0
                        ],
                        [
                            9656338,
                            0
                        ],
                        [
                            9657854,
                            0
                        ],
                        [
                            9674102,
                            0
                        ],
                        [
                            9750622,
                            0
                        ],
                        [
                            9771474,
                            0
                        ],
                        [
                            9783670,
                            0
                        ],
                        [
                            9816118,
                            0
                        ],
                        [
                            9929330,
                            0
                        ],
                        [
                            9935026,
                            0
                        ],
                        [
                            9936242,
                            0
                        ],
                        [
                            9938722,
                            0
                        ],
                        [
                            9962130,
                            0
                        ],
                        [
                            9963762,
                            0
                        ],
                        [
                            17891546,
                            0
                        ],
                        [
                            17905898,
                            0
                        ],
                        [
                            17906138,
                            0
                        ],
                        [
                            17906186,
                            0
                        ],
                        [
                            17907322,
                            0
                        ],
                        [
                            17925626,
                            0
                        ],
                        [
                            18006138,
                            0
                        ],
                        [
                            18077370,
                            0
                        ],
                        [
                            18077562,
                            0
                        ],
                        [
                            18099034,
                            0
                        ],
                        [
                            18127562,
                            0
                        ],
                        [
                            18156794,
                            0
                        ],
                        [
                            18176810,
                            0
                        ],
                        [
                            18203674,
                            0
                        ],
                        [
                            18222538,
                            0
                        ],
                        [
                            18291994,
                            0
                        ],
                        [
                            18330938,
                            0
                        ],
                        [
                            18372506,
                            0
                        ],
                        [
                            18390970,
                            0
                        ],
                        [
                            18391034,
                            0
                        ],
                        [
                            18435498,
                            0
                        ],
                        [
                            18449178,
                            0
                        ],
                        [
                            18451098,
                            0
                        ],
                        [
                            18459098,
                            0
                        ],
                        [
                            22946766,
                            0
                        ],
                        [
                            23014510,
                            0
                        ],
                        [
                            23014682,
                            0
                        ],
                        [
                            23014710,
                            0
                        ],
                        [
                            23014738,
                            0
                        ],
                        [
                            23014814,
                            0
                        ],
                        [
                            23031030,
                            0
                        ],
                        [
                            23031658,
                            0
                        ],
                        [
                            23065882,
                            0
                        ],
                        [
                            23083290,
                            0
                        ],
                        [
                            23102834,
                            0
                        ],
                        [
                            23115862,
                            0
                        ],
                        [
                            23181594,
                            0
                        ],
                        [
                            23190594,
                            0
                        ],
                        [
                            23234602,
                            0
                        ],
                        [
                            23235062,
                            0
                        ],
                        [
                            23238126,
                            0
                        ],
                        [
                            23242554,
                            0
                        ],
                        [
                            23280882,
                            0
                        ],
                        [
                            23300550,
                            0
                        ],
                        [
                            23300578,
                            0
                        ],
                        [
                            23300606,
                            0
                        ],
                        [
                            23303658,
                            0
                        ],
                        [
                            23303694,
                            0
                        ],
                        [
                            23303794,
                            0
                        ],
                        [
                            23303830,
                            0
                        ],
                        [
                            23303874,
                            0
                        ],
                        [
                            23305050,
                            0
                        ],
                        [
                            23305094,
                            0
                        ],
                        [
                            23305134,
                            0
                        ],
                        [
                            23305934,
                            0
                        ],
                        [
                            23305970,
                            0
                        ],
                        [
                            23631674,
                            0
                        ],
                        [
                            23631738,
                            0
                        ],
                        [
                            23631766,
                            0
                        ],
                        [
                            23632138,
                            0
                        ],
                        [
                            23632490,
                            0
                        ],
                        [
                            23632906,
                            0
                        ],
                        [
                            23632938,
                            0
                        ],
                        [
                            23633354,
                            0
                        ],
                        [
                            23633386,
                            0
                        ],
                        [
                            23633674,
                            0
                        ],
                        [
                            23633706,
                            0
                        ],
                        [
                            23633774,
                            0
                        ],
                        [
                            23633802,
                            0
                        ],
                        [
                            23642122,
                            0
                        ],
                        [
                            23642154,
                            0
                        ],
                        [
                            23642186,
                            0
                        ],
                        [
                            23642282,
                            0
                        ],
                        [
                            23650090,
                            0
                        ],
                        [
                            23650258,
                            0
                        ],
                        [
                            23650474,
                            0
                        ],
                        [
                            23656658,
                            0
                        ],
                        [
                            23657058,
                            0
                        ],
                        [
                            23657866,
                            0
                        ],
                        [
                            23658130,
                            0
                        ],
                        [
                            23713458,
                            0
                        ],
                        [
                            23713514,
                            0
                        ],
                        [
                            23889714,
                            0
                        ],
                        [
                            23893866,
                            0
                        ],
                        [
                            23899334,
                            0
                        ],
                        [
                            23910530,
                            0
                        ],
                        [
                            23916426,
                            0
                        ],
                        [
                            23935018,
                            0
                        ],
                        [
                            23951914,
                            0
                        ],
                        [
                            24043446,
                            0
                        ],
                        [
                            24086250,
                            0
                        ],
                        [
                            24137166,
                            0
                        ],
                        [
                            24137214,
                            0
                        ],
                        [
                            24137370,
                            0
                        ],
                        [
                            24137450,
                            0
                        ],
                        [
                            24137498,
                            0
                        ],
                        [
                            24152766,
                            0
                        ],
                        [
                            24154470,
                            0
                        ],
                        [
                            24170890,
                            0
                        ],
                        [
                            24189794,
                            0
                        ],
                        [
                            24227514,
                            0
                        ],
                        [
                            24541226,
                            0
                        ],
                        [
                            24541422,
                            0
                        ],
                        [
                            24541610,
                            0
                        ],
                        [
                            24541770,
                            0
                        ],
                        [
                            24541866,
                            0
                        ],
                        [
                            24542186,
                            0
                        ],
                        [
                            24544250,
                            0
                        ],
                        [
                            24545570,
                            0
                        ],
                        [
                            24546398,
                            0
                        ],
                        [
                            24546430,
                            0
                        ],
                        [
                            24547690,
                            0
                        ],
                        [
                            24548362,
                            0
                        ],
                        [
                            24559398,
                            0
                        ],
                        [
                            24560842,
                            0
                        ],
                        [
                            24560938,
                            0
                        ],
                        [
                            24561966,
                            0
                        ],
                        [
                            24567938,
                            0
                        ],
                        [
                            24570842,
                            0
                        ],
                        [
                            24570958,
                            0
                        ],
                        [
                            24573326,
                            0
                        ],
                        [
                            24587562,
                            0
                        ],
                        [
                            24598026,
                            0
                        ],
                        [
                            24602186,
                            0
                        ],
                        [
                            24602218,
                            0
                        ],
                        [
                            24603818,
                            0
                        ],
                        [
                            24605934,
                            0
                        ],
                        [
                            24606410,
                            0
                        ],
                        [
                            24606966,
                            0
                        ],
                        [
                            24607558,
                            0
                        ],
                        [
                            24607818,
                            0
                        ],
                        [
                            24608790,
                            0
                        ],
                        [
                            24609002,
                            0
                        ],
                        [
                            24613322,
                            0
                        ],
                        [
                            24613458,
                            0
                        ],
                        [
                            24613782,
                            0
                        ],
                        [
                            24614358,
                            0
                        ],
                        [
                            24615490,
                            0
                        ],
                        [
                            24616150,
                            0
                        ],
                        [
                            24622970,
                            0
                        ],
                        [
                            24629302,
                            0
                        ],
                        [
                            24630442,
                            0
                        ],
                        [
                            24630734,
                            0
                        ],
                        [
                            24633726,
                            0
                        ],
                        [
                            24637066,
                            0
                        ],
                        [
                            24637770,
                            0
                        ],
                        [
                            24639378,
                            0
                        ],
                        [
                            24645194,
                            0
                        ],
                        [
                            24645394,
                            0
                        ],
                        [
                            24648618,
                            0
                        ],
                        [
                            24648714,
                            0
                        ],
                        [
                            24651822,
                            0
                        ],
                        [
                            24652010,
                            0
                        ],
                        [
                            24652842,
                            0
                        ],
                        [
                            24653618,
                            0
                        ],
                        [
                            24653946,
                            0
                        ],
                        [
                            24655882,
                            0
                        ],
                        [
                            24656310,
                            0
                        ],
                        [
                            24658142,
                            0
                        ],
                        [
                            24669994,
                            0
                        ],
                        [
                            24670834,
                            0
                        ],
                        [
                            24677574,
                            0
                        ],
                        [
                            24682262,
                            0
                        ],
                        [
                            24683494,
                            0
                        ],
                        [
                            24683562,
                            0
                        ],
                        [
                            24683730,
                            0
                        ],
                        [
                            24684662,
                            0
                        ],
                        [
                            24685194,
                            0
                        ],
                        [
                            24690314,
                            0
                        ],
                        [
                            24690562,
                            0
                        ],
                        [
                            24699170,
                            0
                        ],
                        [
                            24699498,
                            0
                        ],
                        [
                            24703370,
                            0
                        ],
                        [
                            24707082,
                            0
                        ],
                        [
                            24707146,
                            0
                        ],
                        [
                            24708170,
                            0
                        ],
                        [
                            24708986,
                            0
                        ],
                        [
                            24709730,
                            0
                        ],
                        [
                            24709858,
                            0
                        ],
                        [
                            24717422,
                            0
                        ],
                        [
                            24717578,
                            0
                        ],
                        [
                            24723666,
                            0
                        ],
                        [
                            24724854,
                            0
                        ],
                        [
                            24724938,
                            0
                        ],
                        [
                            24725190,
                            0
                        ],
                        [
                            24726298,
                            0
                        ],
                        [
                            24726410,
                            0
                        ],
                        [
                            24733254,
                            0
                        ],
                        [
                            24735898,
                            0
                        ],
                        [
                            24751214,
                            0
                        ],
                        [
                            24754614,
                            0
                        ],
                        [
                            24760414,
                            0
                        ],
                        [
                            24761066,
                            0
                        ],
                        [
                            24763478,
                            0
                        ],
                        [
                            24764770,
                            0
                        ],
                        [
                            24764938,
                            0
                        ],
                        [
                            24765202,
                            0
                        ],
                        [
                            24765262,
                            0
                        ],
                        [
                            24766570,
                            0
                        ],
                        [
                            24767030,
                            0
                        ],
                        [
                            24768666,
                            0
                        ],
                        [
                            24769114,
                            0
                        ],
                        [
                            24778026,
                            0
                        ],
                        [
                            24778218,
                            0
                        ],
                        [
                            24779914,
                            0
                        ],
                        [
                            24780330,
                            0
                        ],
                        [
                            24781710,
                            0
                        ],
                        [
                            24785294,
                            0
                        ],
                        [
                            24786702,
                            0
                        ],
                        [
                            24793418,
                            0
                        ],
                        [
                            24797406,
                            0
                        ],
                        [
                            24799918,
                            0
                        ],
                        [
                            24802346,
                            0
                        ],
                        [
                            24807690,
                            0
                        ],
                        [
                            24807870,
                            0
                        ],
                        [
                            24812270,
                            0
                        ],
                        [
                            24813298,
                            0
                        ],
                        [
                            24813354,
                            0
                        ],
                        [
                            24814550,
                            0
                        ],
                        [
                            24815218,
                            0
                        ],
                        [
                            24816438,
                            0
                        ],
                        [
                            24817238,
                            0
                        ],
                        [
                            24827210,
                            0
                        ],
                        [
                            24830378,
                            0
                        ],
                        [
                            24830538,
                            0
                        ],
                        [
                            24831770,
                            0
                        ],
                        [
                            24832778,
                            0
                        ],
                        [
                            24835614,
                            0
                        ],
                        [
                            24836046,
                            0
                        ],
                        [
                            24840038,
                            0
                        ],
                        [
                            24840546,
                            0
                        ],
                        [
                            24846570,
                            0
                        ],
                        [
                            24846762,
                            0
                        ],
                        [
                            24848426,
                            0
                        ],
                        [
                            24848986,
                            0
                        ],
                        [
                            24850810,
                            0
                        ],
                        [
                            24852878,
                            0
                        ],
                        [
                            24857970,
                            0
                        ],
                        [
                            24861162,
                            0
                        ],
                        [
                            24864906,
                            0
                        ],
                        [
                            24865470,
                            0
                        ],
                        [
                            24866402,
                            0
                        ],
                        [
                            24866666,
                            0
                        ],
                        [
                            24867818,
                            0
                        ],
                        [
                            24868434,
                            0
                        ],
                        [
                            24872202,
                            0
                        ],
                        [
                            24872734,
                            0
                        ],
                        [
                            24876178,
                            0
                        ],
                        [
                            24876618,
                            0
                        ],
                        [
                            24877906,
                            0
                        ]
                    ],
                    "shell1": [
                        [
                            19335263,
                            1
                        ],
                        [
                            19346681,
                            1
                        ],
                        [
                            19464995,
                            1
                        ],
                        [
                            19638839,
                            1
                        ],
                        [
                            19690443,
                            1
                        ],
                        [
                            19732697,
                            1
                        ],
                        [
                            19778593,
                            1
                        ],
                        [
                            19805381,
                            1
                        ],
                        [
                            19830111,
                            1
                        ],
                        [
                            19875283,
                            1
                        ]
                    ]
                },
                "strings": [
                    "VYvs6A==",
                    "ZItk"
                ]
            }
        ],
        "sha1": "4feb45659d01ef22edbb21181dcbbedab482bbf3",
        "name": "4fa43a0472a2a3ef_wer6cf2.tmp.hdmp",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp.hdmp",
        "type": "MDMP crash report data",
        "sha256": "4fa43a0472a2a3efa14037da44cf250198ac30bdedcde28ca5e723fb6ceddbcc",
        "urls": [
            "http:\/\/s.symcb.com\/universal-root.crl0",
            "http:\/\/www.microsoft.com\/pki\/certs\/MicRooCerAut_2010-06-23.crt07",
            "http:\/\/crl.securetrust.com\/STCA.crl0",
            "http:\/\/crl.xrampsecurity.com\/XGCA.crl0",
            "http:\/\/wwwx",
            "http:\/\/www.e-szigno.hu\/RootCA.crt0",
            "http:\/\/www.trustcenter.de\/guidelines0",
            "http:\/\/www.usertrust.com1",
            "http:\/\/crl.usertrust.com\/UTN-DATACorpSGC.crl0",
            "http:\/\/sw.symcb.com\/sw.crl0",
            "https:\/\/www.certification.tn\/cgi-bin\/pub\/crl\/cacrl.crl0E",
            "http:\/\/crl.netsolssl.com\/NetworkSolutionsCertificateAuthority.crl0",
            "http:\/\/crl.verisign.com\/pca3.crl0",
            "https:\/\/www.verisign.com\/rpa0",
            "http:\/\/www.acabogacia.org\/doc0",
            "http:\/\/www.d-trust.net\/crl\/d-trust_qualified_root_ca_1_2007_pn.crl0",
            "http:\/\/www.ssc.lt\/cps03",
            "http:\/\/qual.ocsp.d-trust.net0",
            "http:\/\/www.microsoft.com\/pki\/certs\/MicrosoftRootCert.crt0",
            "https:\/\/www.verisign.com\/CPS04",
            "http:\/\/ts-crl.ws.symantec.com\/sha256-tss-ca.crl0",
            "http:\/\/www.wellsfargo.com\/certpolicy0",
            "https:\/\/d.symcb.com\/cps0%",
            "http:\/\/crl.oces.certifika",
            "http:\/\/www.pki.gva.es\/cps0",
            "http:\/\/www.d-trust.net\/crl\/d-trust_root_class_3_ca_2007.crl0",
            "http:\/\/www.pki.admin.ch\/policy\/CPS_2_16_756_1_17_3_21_1.pdf0",
            "http:\/\/s.symcd.com06",
            "http:\/\/sw.symcd.com0",
            "http:\/\/sw1.symcb.com\/sw.crt0",
            "http:\/\/www.signatur.rtr.at\/current.crl0",
            "https:\/\/www.verisign.com\/repository\/verisignlogo.gif0D",
            "http:\/\/repository.swisssign.com\/0",
            "http:\/\/www.acabogacia.org0",
            "http:\/\/crl.ssc.lt\/root-c\/cacrl.crl0",
            "http:\/\/fedir.comsign.co.il\/cacert\/ComSignAdvancedSecurityCA.crt0",
            "http:\/\/ocsp.pki.gva.es0",
            "http:\/\/www.microsoft.com\/pki\/certs\/MicCerLisCA2011_2011-03-29.crt0",
            "https:\/\/d.symcb.com\/rpa0",
            "https:\/\/www.netlock.net\/docs",
            "http:\/\/www.microsoft.com\/pkiops\/certs\/Microsoft%20Certificate%20Trust%20List%20PCA(3).crt0",
            "https:\/\/www.avira.com\/en\/new-user-launcher-emb-prime?x-a-source=launcher",
            "https:\/\/www.netlock.hu\/docs\/",
            "https:\/\/www.certification.tn\/cgi-bin\/pub\/crl\/cacrl.crl0",
            "https:\/\/www.verisign.com",
            "http:\/\/www.d-trust.net\/crl\/d-trust_root_class_2_ca_2007.crl0",
            "http:\/\/www.signatur.rtr.at\/de\/directory\/cps.html0",
            "http:\/\/www.d-trust.net0",
            "http:\/\/logo.verisign.com\/vslogo.gif0",
            "http:\/\/www.certplus.com\/CRL\/class3TS.crl0",
            "http:\/\/fedir.comsign.co.il\/crl\/ComSignSecuredCA.crl0",
            "http:\/\/www.e-szigno.hu\/RootCA.crl",
            "http:\/\/fedir.comsign.co.il\/crl\/ComSignAdvancedSecurityCA.crl0",
            "http:\/\/www.rootca.or.kr\/rca\/cps.html0",
            "http:\/\/crl.comodo.net\/AAACertificateServices.crl0",
            "https:\/\/d.symcb.com\/rpa0.",
            "https:\/\/rca.e-szigno.hu\/ocsp0-",
            "https:\/\/www.verisign.com\/repository\/CPS",
            "https:\/\/www.avira.com\/en\/trial-user-launcher-avira-prime?x-a-source=launcher",
            "http:\/\/ts-ocsp.ws.symantec.com0",
            "http:\/\/www.e-szigno.hu\/SZSZ\/0",
            "https:\/\/ca.sia.it\/seccli\/repository\/CPS0",
            "http:\/\/users.ocsp.d-trust.net03",
            "http:\/\/www.valicert.com\/1",
            "http:\/\/certificates.starfieldtech.com\/repository\/1604",
            "http:\/\/ts-aia.ws.symantec.com\/sha256-tss-ca.cer0(",
            "http:\/\/www.trustce",
            "http:\/\/www.comsign.co.il\/cps0",
            "http:\/\/www.microsoft.com\/pkiops\/crl\/Microsoft%20Certificate%20Trust%20List%20PCA(3).crl0u",
            "http:\/\/www.post.trust.alified",
            "http:\/\/crl.globalsign.net\/root-r2.crl0",
            "http:\/\/crl.comodoca.com\/COMODOCertificationAuthority.crl0",
            "http:\/\/ca.sia.it\/seccli\/repository\/CRL.der0J",
            "http:\/\/crl.usertrust.com\/UTN-USERFirst-Hardware.crl01"
        ],
        "crc32": "2CF8657A",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3970\/files\/4fa43a0472a2a3ef_wer6cf2.tmp.hdmp",
        "ssdeep": null,
        "size": 31862207,
        "sha512": "dff68dd5db4d6ef66146d8034d83b54bb7dc9d7126349e63886bfdc05487431d87bdbd393fc19873602bfbe1a98c7bc959f65f64c7d749bb9ddd4dde48466296",
        "pids": [
            1576
        ],
        "md5": "f2319d0357907cf405579098a0d99472"
    }
]

Generic

[
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "process_name": "ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
        "pid": 2736,
        "summary": {
            "file_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
            ],
            "file_recreated": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
                "\\Device\\KsecDD",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
            ],
            "regkey_written": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\\Blob",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob",
                "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\LanguageList"
            ],
            "dll_loaded": [
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\culture.dll",
                "imagehlp.dll",
                "API-MS-Win-Security-LSALookup-L1-1-0.dll",
                "credssp.dll",
                "ntdll",
                "API-MS-WIN-Service-Management-L2-1-0.dll",
                "gdi32.dll",
                "DNSAPI.dll",
                "kernel32.dll",
                "API-MS-Win-Security-SDDL-L1-1-0.dll",
                "SensApi.dll",
                "ntdll.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ole32.dll",
                "cryptsp.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll",
                "imm32.dll",
                "ADVAPI32.dll",
                "ncrypt.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\VERSION.dll",
                "bcrypt.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
                "API-MS-WIN-Service-Management-L1-1-0.dll",
                "cryptnet.dll",
                "crypt32.dll",
                "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
                "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
                "AdvApi32.dll",
                "SspiCli.dll",
                "advapi32.dll",
                "ole32.dll",
                "SHLWAPI.dll",
                "CRYPTSP.dll",
                "USER32.dll",
                "C:\\Windows\\system32\\IMM32.DLL",
                "API-MS-WIN-Service-winsvc-L1-1-0.dll",
                "IPHLPAPI.DLL",
                "C:\\Windows\\syswow64\\CRYPT32.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll",
                "RichEd20.dll",
                "NSI.dll",
                "winhttp.dll",
                "profapi.dll",
                "RPCRT4.dll",
                "C:\\Windows\\System32\\wship6.dll",
                "setupapi.dll",
                "mscorsec.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll",
                "VERSION.dll",
                "mscoree.dll",
                "CFGMGR32.dll",
                "WINTRUST.DLL",
                "C:\\Windows\\system32\\cryptnet.dll",
                "DEVRTL.dll",
                "C:\\Windows\\system32\\mswsock.dll",
                "shell32.dll",
                "C:\\Windows\\System32\\wshtcpip.dll",
                "WS2_32.dll",
                "Cabinet.dll",
                "WINHTTP.dll"
            ],
            "file_failed": [
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\FA47BF11E3FC6DA7A80A2910535F021F",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0972B7C417F696E06E186AEB26286F01_EC6918D7CB4A54242E7A79500CDB31EB",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3D0AC26322348780E90E022EA217C58C",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_DC03E45EC7611F50ADAEBABE405A8C4C",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin.config",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A3D5BF1283C2E63D8C8A8C72F0051F5A",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0972B7C417F696E06E186AEB26286F01_8A7601FFF9878487CA80CB28D50438E2"
            ],
            "regkey_opened": [
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Assemblies\\Global",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\ExclusionList",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\55b53053\\df39bd4",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Configuration__b03f5f7f11d50a3a",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets\\Internet",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\AppPatch",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting\\InclusionList",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e",
                "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting\\InclusionList",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Assemblies\\Global",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting\\ExclusionList",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Windows.Forms__b77a5c561934e089",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets\\LocalIntranet",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\index127",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Assemblies\\C:|Users|cuck|AppData|Local|Temp|ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Assemblies\\Global",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\Standards",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Security\\Policy\\Extensions\\NamedPermissionSets",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Drawing__b03f5f7f11d50a3a",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\Standards\\v2.0.50727",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
                "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting\\ExclusionList",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\v2.0.50727\\Security\\Policy",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System__b77a5c561934e089",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\StrongName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Fusion",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\PublisherPolicy\\Default",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\policy.2.0.System.Xml__b77a5c561934e089",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Fusion\\GACChangeNotification\\Default",
                "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\ExclusionList",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5f57882f\\7d473bb0",
                "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\InclusionList",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4d36e972-e325-11ce-bfc1-08002be10318}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\Upgrades",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\Standards",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\InclusionList",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87",
                "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\PCHealth\\ErrorReporting",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\Policy\\APTCA",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\Policy\\v2.0",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework\\Policy\\Standards",
                "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting"
            ],
            "resolves_host": [
                "www.download.windowsupdate.com",
                "sw.symcd.com",
                "sw.symcb.com",
                "s.symcb.com",
                "s.symcd.com"
            ],
            "file_written": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
            ],
            "regkey_deleted": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE"
            ],
            "file_deleted": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
            ],
            "file_exists": [
                "C:\\Windows\\inf\\",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\fusion.localgac",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.config",
                "C:\\Users\\cuck\\AppData\\LocalLow",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore\\Avira.OE.WinCore.exe",
                "C:\\Windows\\Globalization\\en-us.nlp",
                "C:\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\msvcr80.dll",
                "C:\\Windows\\System32\\qagentrt.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Windows\\assembly\\GAC\\PublisherPolicy.tme",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config",
                "C:\\Windows\\System32\\dnsapi.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "C:\\Windows\\System32\\MSCOREE.DLL.local",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore\\Avira.OE.WinCore.dll",
                "C:\\Windows\\System32\\p2pcollab.dll"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
                "C:\\Users\\cuck\\AppData\\LocalLow",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\index127.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
                "C:\\Windows\\System32\\netmsg.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
                "C:\\Windows\\System32\\l_intl.nls",
                "C:\\Windows\\System32\\en-US\\WINHTTP.dll.mui",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
                "C:\\Windows\\assembly\\pubpol4.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
            ],
            "command_line": [
                "dw20.exe -x -s 936"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73D4.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC6A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE579.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73F6.tmp",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E57.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E45.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabBC8C.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC8D.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5B92.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5D0B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab2D9F.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE558.tmp",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar73D5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5E46.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarBC6B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE578.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE515.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5E56.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE557.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5B91.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar2DA0.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5638.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab5D0A.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE516.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Cab73F5.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\Tar5639.tmp",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\TarE537.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\CabE536.tmp"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\LatestIndex",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\Status",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\\Serial_Access_Num",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\Modules",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SecurityProviders",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\ILDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxAIAUrlRetrievalCertCount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7\\Name",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagMatchAnyMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\MVID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\CLRLoadLogDir",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\DevOverrideEnable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxAIAUrlRetrievalCountPerChain",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NoClientChecks",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\DownloadCacheQuotaInKB",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\MVID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LoggingLevel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\EvalationData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\MVID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\ConfigMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LogFailures",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\MissingDependencies",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\NIDependencies",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\NIDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxAIAUrlRetrievalByteCount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetCachedOcspSwitchToCrlCount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\index127\\ILUsageMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\UseLegacyIdentityFormat",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableUnsupportedCriticalExtensions",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Comment",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DebugFlags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\OnlyUseLatestCLR",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\Modules",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetMaxCachedOcspPerCrlCount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\index127\\NIUsageMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\ConfigString",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\Status",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\Mapping",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\NIDependencies",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Type",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MaxSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\ConfigString",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\EnableInetUnknownAuth",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\CacheLocation",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\\Blob",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureRoutine",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableCANameConstraints",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\LegacyPolicyTimeStamp",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MinSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\Modules",
                "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\p2pcollab.dll,-8042",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3f50fe4f\\6f1da7aa\\88\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureDll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\ConfigString",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\VersioningLog",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\GCStressStartAtJit",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\mscorlib,2.0.0.0,,b77a5c561934e089,x86",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Capabilities",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\ConfigMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\DisableMSIPeek",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\ChainCacheResyncFiletime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\Status",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\HelperDllName",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing\\State",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\ConfigMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
                "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\Latest",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\ILDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\EvalationData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\TokenSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\5fcea75a\\3c9c8d7b\\67\\MissingDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\InstallRoot",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\30bc7c4f\\3f50fe4f\\88\\MissingDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxAIAUrlCountInCert",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\DisplayName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\LogResourceBinds",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System,2.0.0.0,,b77a5c561934e089,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\424bd4d8\\1c83327b\\86\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip\\WinSock 2.0 Provider ID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\EnableLog",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagLevel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\3c9c8d7b\\46b95040\\6c\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\DisableConfigCache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\ILDependencies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\ForceLog",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\.NETFramework\\GCStressStart",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\73843e06\\43a920ef\\66\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\c991064\\2bd33e1c\\79\\Modules",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\DisableBranchCache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\GACChangeNotification\\Default\\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableMandatoryBasicConstraints",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\UseDelayedAcceptance",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\19ab8d57\\1bd7b0d8\\87\\LastModTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\NI\\181938c6\\7950e2c5\\83\\EvalationData",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DebugHeapFlags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\EnableWeakSignatureFlags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\SIG",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\7950e2c5\\183e33de\\83\\DisplayName",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\Safety Warning Level",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing\\Enabled",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\RpcId",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\NativeImagesIndex\\v2.0.50727_32\\IL\\6dc7d4c0\\a5cd4db\\7e\\Status",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion\\PublisherPolicy\\Default\\index4"
            ],
            "directory_enumerated": [
                "C:\\Users",
                "C:\\Windows\\Microsoft.NET\\Framework\\Upgrades.2.0.50727\\mscoreei.dll",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_*",
                "C:\\Users\\cuck\\AppData",
                "C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\2.0.0.0__b03f5f7f11d50a3a\\System.ServiceProcess.INI",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.INI",
                "C:\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\msvcr80.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Users\\cuck",
                "C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.INI",
                "C:\\Windows",
                "C:\\Windows\\winsxs",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscoreei.dll",
                "C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.INI",
                "C:\\Users\\cuck\\AppData\\Local",
                "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0972B7C417F696E06E186AEB26286F01_*",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll"
            ]
        },
        "first_seen": 1575258785.671875,
        "ppid": 2456
    },
    {
        "process_path": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe",
        "process_name": "dw20.exe",
        "pid": 1576,
        "summary": {
            "file_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp.hdmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml"
            ],
            "file_recreated": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml"
            ],
            "dll_loaded": [
                "dbghelp.dll",
                "version.dll",
                "C:\\Windows\\system32\\ole32.dll",
                "CFGMGR32.dll",
                "DUI70.dll",
                "kernel32.dll",
                "UxTheme.dll",
                "SensApi.dll",
                "werui.dll",
                "dwmapi.dll",
                "ntdll.dll",
                "cryptsp.dll",
                "winhttp.dll",
                "verifier.dll",
                "C:\\Windows\\system32\\RICHED20.DLL",
                "API-MS-WIN-Service-Management-L2-1-0.dll",
                "API-MS-WIN-Service-Management-L1-1-0.dll",
                "C:\\Windows\\syswow64\\MSCTF.dll",
                "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
                "psapi.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordacwks.dll",
                "OLEAUT32.DLL",
                "SspiCli.dll",
                "C:\\Windows\\system32\\wer.dll",
                "advapi32.dll",
                "comctl32",
                "ole32.dll",
                "SHLWAPI.dll",
                "CRYPTSP.dll",
                "USER32.dll",
                "Comctl32.dll",
                "credssp.dll",
                "API-MS-WIN-Service-winsvc-L1-1-0.dll",
                "IPHLPAPI.DLL",
                "C:\\Windows\\system32\\xmllite.dll",
                "OLEAUT32.dll",
                "SHELL32.dll",
                "RPCRT4.dll",
                "DNSAPI.dll",
                "C:\\Windows\\System32\\wship6.dll",
                "DUser.dll",
                "comctl32.dll",
                "NSI.dll",
                "C:\\Windows\\system32\\DUser.dll",
                "C:\\Windows\\system32\\mswsock.dll",
                "powrprof.dll",
                "ADVAPI32.dll",
                "rpcrt4.dll",
                "C:\\Windows\\System32\\wshtcpip.dll",
                "WS2_32.dll",
                "user32.dll",
                "WINHTTP.dll"
            ],
            "file_opened": [
                "C:\\Windows\\System32\\apphelp.dll",
                "C:\\Windows\\System32\\mswsock.dll",
                "C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
                "C:\\Windows\\System32\\mscoree.dll",
                "C:\\Windows\\SysWOW64\\user32.dll",
                "C:\\Windows\\SysWOW64\\advapi32.dll",
                "C:\\Windows\\SysWOW64\\msctf.dll",
                "C:\\Windows\\System32\\cryptnet.dll",
                "C:\\Windows\\SysWOW64\\sspicli.dll",
                "C:\\Windows\\System32\\cabinet.dll",
                "C:\\Windows\\System32\\winhttp.dll",
                "C:\\Windows\\SysWOW64\\kernel32.dll",
                "C:\\Windows\\SysWOW64\\msvcrt.dll",
                "C:\\Windows\\System32\\winnsi.dll",
                "C:\\Windows\\SysWOW64\\shlwapi.dll",
                "C:\\Windows\\System32\\bcrypt.dll",
                "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
                "C:\\Windows\\System32\\WSHTCPIP.DLL",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
                "C:\\Windows\\System32\\cryptsp.dll",
                "C:\\Windows\\System32\\webio.dll",
                "C:\\Windows\\System32\\dhcpcsvc6.DLL",
                "C:\\Windows\\SysWOW64\\ole32.dll",
                "C:\\Windows\\System32\\devrtl.dll",
                "C:\\Windows\\System32\\profapi.dll",
                "C:\\Windows\\SysWOW64\\crypt32.dll",
                "C:\\Windows\\SysWOW64\\msasn1.dll",
                "C:\\Windows\\System32\\IPHLPAPI.DLL",
                "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
                "C:\\Windows\\SysWOW64\\shell32.dll",
                "C:\\Windows\\SysWOW64\\lpk.dll",
                "C:\\Windows\\System32\\version.dll",
                "C:\\Windows\\System32\\rasadhlp.dll",
                "C:\\Windows\\SysWOW64\\wintrust.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
                "C:\\Windows\\System32\\gpapi.dll",
                "C:\\Windows\\System32\\userenv.dll",
                "C:\\Windows\\System32\\dhcpcsvc.dll",
                "C:\\Windows\\win.ini",
                "C:\\Windows\\System32\\en-US\\erofflps.txt",
                "C:\\Windows\\System32\\ncrypt.dll",
                "C:\\Windows\\SysWOW64\\ntdll.dll",
                "C:\\Windows\\SysWOW64\\usp10.dll",
                "C:\\Windows\\System32\\dnsapi.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "C:\\Windows\\SysWOW64\\ws2_32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml",
                "C:\\Windows\\SysWOW64\\sechost.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll",
                "C:\\Windows\\System32\\wship6.dll",
                "C:\\Windows\\System32\\credssp.dll",
                "C:\\Windows\\System32\\imm32.dll",
                "C:\\Windows\\SysWOW64\\gdi32.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
                "C:\\Windows\\SysWOW64\\imagehlp.dll",
                "C:\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\msvcr80.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll",
                "C:\\Windows\\SysWOW64\\rpcrt4.dll",
                "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll",
                "C:\\Windows\\System32\\rsaenh.dll",
                "C:\\Windows\\SysWOW64\\nsi.dll",
                "C:\\Windows\\SysWOW64\\Wldap32.dll",
                "C:\\Windows\\System32\\SensApi.dll",
                "C:\\Windows\\SysWOW64\\KERNELBASE.dll"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LsaExtensionConfig\\SspiCli",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Reliability Analysis\\RAC",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\Tracing",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Throttling\\CLR20r3",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\CEIPRole\\RolesInWER",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\dw20.exe",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\ExcludedApplications",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\KnownManagedDebuggingDlls",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\DirectUI",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\HeapControlledList\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4d36e972-e325-11ce-bfc1-08002be10318}",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ExcludedApplications",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Windows",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SspiCache",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters"
            ],
            "resolves_host": [
                "watson.microsoft.com"
            ],
            "file_written": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp.hdmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml"
            ],
            "file_deleted": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp.hdmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml"
            ],
            "file_exists": [
                "C:\\Windows\\System32\\apphelp.dll",
                "C:\\Windows\\System32\\mswsock.dll",
                "C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
                "C:\\Windows\\System32\\mscoree.dll",
                "C:\\Windows\\SysWOW64\\user32.dll",
                "C:\\Windows\\SysWOW64\\advapi32.dll",
                "C:\\Windows\\SysWOW64\\msctf.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Windows\\SysWOW64\\sspicli.dll",
                "C:\\Windows\\System32\\cabinet.dll",
                "C:\\Windows\\System32\\winhttp.dll",
                "C:\\Windows\\SysWOW64\\kernel32.dll",
                "C:\\Windows\\SysWOW64\\msvcrt.dll",
                "C:\\Windows\\System32\\winnsi.dll",
                "C:\\Windows\\SysWOW64\\shlwapi.dll",
                "C:\\Windows\\System32\\bcrypt.dll",
                "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
                "C:\\Windows\\System32\\WSHTCPIP.DLL",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
                "C:\\Windows\\System32\\cryptsp.dll",
                "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
                "C:\\Windows\\System32\\dhcpcsvc6.DLL",
                "C:\\Windows\\SysWOW64\\ole32.dll",
                "C:\\Windows\\System32\\devrtl.dll",
                "C:\\Windows\\System32\\profapi.dll",
                "C:\\Windows\\SysWOW64\\crypt32.dll",
                "C:\\Windows\\SysWOW64\\msasn1.dll",
                "C:\\Windows\\System32\\IPHLPAPI.DLL",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
                "C:\\Windows\\SysWOW64\\shell32.dll",
                "C:\\Windows\\SysWOW64\\lpk.dll",
                "C:\\Windows\\System32\\version.dll",
                "C:\\Windows\\SysWOW64\\wintrust.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
                "C:\\Windows\\System32\\gpapi.dll",
                "C:\\Windows\\System32\\userenv.dll",
                "C:\\Windows\\System32\\webio.dll",
                "C:\\Windows\\System32\\rasadhlp.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER6CF2.tmp.hdmp",
                "C:\\Windows\\System32\\dhcpcsvc.dll",
                "C:\\Windows\\System32\\en-US\\erofflps.txt",
                "C:\\Windows\\System32\\ncrypt.dll",
                "C:\\Windows\\SysWOW64\\ntdll.dll",
                "C:\\Windows\\SysWOW64\\usp10.dll",
                "C:\\Windows\\System32\\dnsapi.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "C:\\Windows\\SysWOW64\\ws2_32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\WER62A1.tmp.WERInternalMetadata.xml",
                "C:\\Windows\\SysWOW64\\sechost.dll",
                "C:\\Windows\\System32\\cryptnet.dll",
                "C:\\Windows\\System32\\wship6.dll",
                "C:\\Windows\\System32\\credssp.dll",
                "C:\\Windows\\System32\\imm32.dll",
                "C:\\Windows\\SysWOW64\\gdi32.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll",
                "C:\\Windows\\SysWOW64\\imagehlp.dll",
                "C:\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\msvcr80.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll",
                "C:\\Windows\\SysWOW64\\rpcrt4.dll",
                "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll",
                "C:\\Windows\\System32\\rsaenh.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll",
                "C:\\Windows\\SysWOW64\\nsi.dll",
                "C:\\Windows\\SysWOW64\\Wldap32.dll",
                "C:\\Windows\\System32\\SensApi.dll",
                "C:\\Windows\\SysWOW64\\KERNELBASE.dll"
            ],
            "mutex": [
                "Global\\037add7c-14af-11ea-8829-08002749d99b"
            ],
            "guid": [
                "{713aacc8-3b71-435c-a3a1-be4e53621ab1}",
                "{22e4c895-8ab9-40bb-b81a-001dd9b1f449}"
            ],
            "file_read": [
                "C:\\Windows\\win.ini"
            ],
            "regkey_read": [
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\GPAPI.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\profapi.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Users\\cuck\\AppData\\Local\\Temp\\ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\wshtcpip.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableQueue",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DEVRTL.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SecurityProviders",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WS2_32.dll",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\MSASN1.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SspiCli.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\wship6.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\SendEFSFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\44D72C57",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\CLR20r3",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WLDAP32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\IPHLPAPI.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerPortNumber",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LastWatsonCabUploaded",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\credssp.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseSSL",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\HelperDllName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\LPK.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\shell32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerServer",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\BIOSVersion",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\KERNELBASE.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\NSI.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CurrentType",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\imagehlp.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\COMCTL32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\webio.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CRYPT32.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\ConfigureArchive",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WINTRUST.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Windows\\CSDBuildNumber",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\QueuePesterInterval",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\MSVCR80.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Comment",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\RPCRT4.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\WINHTTP.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\SensApi.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DisableArchive",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\MaxArchiveCount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\KERNEL32.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultOverrideBehavior",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\sechost.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\Mapping",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CFGMGR32.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Type",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\ncrypt.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceUserModeCabCollection",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\cryptnet.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CRYPTBASE.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProductName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureRoutine",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\MachineID",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MinSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rsaenh.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ForceQueue",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\IMM32.DLL",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureDll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\USERENV.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\ole32.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\MaxQueueCount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\USER32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\CorporateWerUseAuthentication",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\MSCTF.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\SendEFSFiles",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorSystemHeapIsPrivate",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\CLR20r3",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MaxSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemProductName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DNSAPI.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\KnownManagedDebuggingDlls\\C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordacwks.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\ADVAPI32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\TokenSize",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\UseDelayedAcceptance",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorUseSystemHeap",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Disabled",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Capabilities",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\dhcpcsvc6.DLL",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LoggingDisabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\dhcpcsvc.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SYSTEM32\\MSCOREE.DLL",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing\\Enabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\CRYPTSP.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SystemInformation\\SystemManufacturer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\apphelp.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\BypassDataThrottling",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\msvcrt.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Reliability Analysis\\RAC\\RacWerSampleTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\ntdll.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\Cabinet.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentType",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\RestartRunTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SHLWAPI.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\DisableBranchCache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontSendAdditionalData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\mswsock.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\USP10.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Version",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\RestartRunTime",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip\\WinSock 2.0 Provider ID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\GDI32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rasadhlp.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\WINNSI.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\bcrypt.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\RpcId",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Disabled",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\DisableQueue",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\VERSION.dll"
            ],
            "directory_enumerated": [
                "C:\\Windows\\System32\\apphelp.dll",
                "C:\\Windows\\SysWOW64",
                "C:\\Users\\cuck\\AppData",
                "C:\\Windows\\SysWOW64\\user32.dll",
                "C:\\Windows\\SysWOW64\\advapi32.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib",
                "C:\\Windows\\SysWOW64\\msctf.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Windows\\SysWOW64\\sspicli.dll",
                "C:\\Windows\\System32\\cabinet.dll",
                "C:\\Windows\\System32\\winhttp.dll",
                "C:\\Windows\\SysWOW64\\kernel32.dll",
                "C:\\Windows\\SysWOW64\\msvcrt.dll",
                "C:\\Windows\\assembly",
                "C:\\Windows\\System32\\winnsi.dll",
                "C:\\Windows\\SysWOW64\\shlwapi.dll",
                "C:\\Windows\\System32\\bcrypt.dll",
                "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
                "C:\\Windows\\System32\\WSHTCPIP.DLL",
                "C:\\Windows\\System32",
                "C:\\Windows\\System32\\cryptsp.dll",
                "C:\\Windows\\System32\\webio.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll",
                "C:\\Windows\\SysWOW64\\ole32.dll",
                "C:\\Windows\\System32\\devrtl.dll",
                "C:\\Windows\\System32\\profapi.dll",
                "C:\\Windows\\System32\\mscoree.dll",
                "C:\\Windows\\SysWOW64\\crypt32.dll",
                "C:\\Windows\\SysWOW64\\msasn1.dll",
                "C:\\Windows\\System32\\IPHLPAPI.DLL",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll",
                "C:\\Windows\\SysWOW64\\shell32.dll",
                "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll",
                "C:\\Windows\\SysWOW64\\lpk.dll",
                "C:\\Windows\\System32\\version.dll",
                "C:\\Users",
                "C:\\Windows\\SysWOW64\\wintrust.dll",
                "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll",
                "C:\\Windows\\System32\\gpapi.dll",
                "C:\\Windows\\System32\\userenv.dll",
                "C:\\Windows\\SysWOW64\\nsi.dll",
                "C:\\Windows\\System32\\rasadhlp.dll",
                "C:\\Windows\\System32\\dhcpcsvc.dll",
                "C:\\Windows\\System32\\ncrypt.dll",
                "C:\\Windows\\SysWOW64\\ntdll.dll",
                "C:\\Users\\cuck",
                "C:\\Windows\\System32\\dnsapi.dll",
                "C:\\Windows\\SysWOW64\\ws2_32.dll",
                "C:\\Windows\\SysWOW64\\sechost.dll",
                "C:\\Windows\\System32\\cryptnet.dll",
                "C:\\Users\\cuck\\AppData\\Local",
                "C:\\Windows\\System32\\wship6.dll",
                "C:\\Windows\\System32\\credssp.dll",
                "C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System",
                "C:\\Windows\\System32\\imm32.dll",
                "C:\\Windows\\SysWOW64\\gdi32.dll",
                "C:\\Windows\\System32\\mswsock.dll",
                "C:\\Windows\\SysWOW64\\imagehlp.dll",
                "C:\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\\msvcr80.dll",
                "C:\\Windows\\SysWOW64\\usp10.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\AppCrash_*_4c2a1b51a2182d52302ef23333c915f4dc39b3a0_cab_*",
                "C:\\Windows\\SysWOW64\\rpcrt4.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_*_4c2a1b51a2182d52302ef23333c915f4dc39b3a0_cab_*",
                "C:\\Windows\\System32\\drivers\\*.mrk",
                "C:\\Windows\\System32\\rsaenh.dll",
                "C:\\Windows",
                "C:\\Windows\\winsxs",
                "C:\\Windows\\SysWOW64\\Wldap32.dll",
                "C:\\Windows\\System32\\SensApi.dll"
            ]
        },
        "first_seen": 1575258850.765625,
        "ppid": 2736
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1575258785.46875,
        "ppid": 376
    }
]

Signatures

[
    {
        "markcount": 2,
        "families": [],
        "description": "Checks if process is being debugged by a debugger",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "system",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 0,
                    "nt_status": -1073741700,
                    "api": "IsDebuggerPresent",
                    "return_value": 0,
                    "arguments": {},
                    "time": 1575258785.765875,
                    "tid": 2504,
                    "flags": {}
                },
                "pid": 2736,
                "type": "call",
                "cid": 368
            },
            {
                "call": {
                    "category": "system",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 2,
                    "nt_status": -1073741772,
                    "api": "IsDebuggerPresent",
                    "return_value": 0,
                    "arguments": {},
                    "time": 1575258850.656875,
                    "tid": 2504,
                    "flags": {}
                },
                "pid": 2736,
                "type": "call",
                "cid": 8542
            }
        ],
        "references": [],
        "name": "checks_debugger"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "This executable has a PDB path",
        "severity": 1,
        "marks": [
            {
                "category": "pdb_path",
                "ioc": "e:\\Bld\\40\\100\\Sources\\OnlineEssentials\\Source\\Avira.OE.ServiceHost\\obj\\x86\\Release\\Avira.ServiceHost.pdb",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "has_pdb"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "system",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GlobalMemoryStatusEx",
                    "return_value": 1,
                    "arguments": {},
                    "time": 1575258850.843625,
                    "tid": 2728,
                    "flags": {}
                },
                "pid": 1576,
                "type": "call",
                "cid": 51
            }
        ],
        "references": [],
        "name": "antivm_memory_available"
    },
    {
        "markcount": 19,
        "families": [],
        "description": "Allocates read-write-execute memory (usually to unpack itself)",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "base_address": "0x749f1000"
                    },
                    "time": 1575258785.765875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 258
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x0053a000"
                    },
                    "time": 1575258785.765875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 380
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 8192,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "base_address": "0x749f2000"
                    },
                    "time": 1575258785.765875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 381
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x00532000"
                    },
                    "time": 1575258785.765875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 382
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x00552000"
                    },
                    "time": 1575258785.781875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 509
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x00553000"
                    },
                    "time": 1575258850.593875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8305
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x0072b000"
                    },
                    "time": 1575258850.609875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8314
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x00727000"
                    },
                    "time": 1575258850.609875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8315
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x0055c000"
                    },
                    "time": 1575258850.609875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8356
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x00566000"
                    },
                    "time": 1575258850.609875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8365
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x05c30000"
                    },
                    "time": 1575258850.609875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8368
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x00554000"
                    },
                    "time": 1575258850.625875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8504
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x0071a000"
                    },
                    "time": 1575258850.640875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8539
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 851968,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 8192,
                        "base_address": "0x05cb0000"
                    },
                    "time": 1575258850.671875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_RESERVE"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8590
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x05d40000"
                    },
                    "time": 1575258850.671875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8592
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2736,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x05d41000"
                    },
                    "time": 1575258850.671875,
                    "tid": 2504,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2736,
                "type": "call",
                "cid": 8593
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1576,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x02650000"
                    },
                    "time": 1575258851.843625,
                    "tid": 852,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1576,
                "type": "call",
                "cid": 2752
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1576,
                        "region_size": 524288,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 8192,
                        "base_address": "0x03430000"
                    },
                    "time": 1575258857.062625,
                    "tid": 2728,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_RESERVE"
                    }
                },
                "pid": 1576,
                "type": "call",
                "cid": 11731
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 1576,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 1,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x03470000"
                    },
                    "time": 1575258857.062625,
                    "tid": 2728,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 1576,
                "type": "call",
                "cid": 11733
            }
        ],
        "references": [],
        "name": "allocates_rwx"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks adapter addresses which can be used to detect virtual network interfaces",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "network",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 0,
                    "nt_status": -1073741772,
                    "api": "GetAdaptersAddresses",
                    "return_value": 111,
                    "arguments": {
                        "flags": 15,
                        "family": 0
                    },
                    "time": 1575258787.484875,
                    "tid": 2820,
                    "flags": {}
                },
                "pid": 2736,
                "type": "call",
                "cid": 2602
            }
        ],
        "references": [],
        "name": "antivm_network_adapters"
    },
    {
        "markcount": 522,
        "families": [],
        "description": "Potentially malicious URLs were found in the process memory dump",
        "severity": 2,
        "marks": [
            {
                "category": "url",
                "ioc": "http:\/\/s.symcb.com\/universal-root.crl0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.expedia.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/uk.ask.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.priceminister.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.iask.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/ocsp.infonotary.com\/responder.cgi0V",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.merlin.com.pl\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.cnet.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.certificadodigital.com.br\/repositorio\/serasaca\/crl\/SerasaCAII.crl0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.nifty.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/ns.adobe.com\/exif\/1.0\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.etmall.com.tw\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/crl.chambersign.org\/publicnotaryroot.crl0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.goo.ne.jp\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/fr.wikipedia.org\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/busca.estadao.com.br\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.hanafos.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.chol.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.interpark.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/amazon.fr\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.amazon.co.jp\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.mtv.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/busqueda.aol.com.mx\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.live.com\/results.aspx?FORM=SOLTDF",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/msdn.microsoft.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.sogou.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.sify.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/yellowpages.superpages.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/suche.freenet.de\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/crl.chambersign.org\/chambersroot.crl0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.aol.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/browse.guardian.co.uk\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.mercadolibre.com.mx\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.asharqalawsat.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.facebook.com\/",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/si.wikipedia.org\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.rtl.de\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.msn.com\/results.aspx?q=",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.microsoft.com.",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.naver.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/fedir.comsign.co.il\/cacert\/ComSignAdvancedSecurityCA.crt0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "https:\/\/www.verisign.com\/repository\/verisignlogo.gif0D",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/crl.usertrust.com\/UTN-USERFirst-NetworkApplications.crl0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "https:\/\/www.netlock.net\/docs",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/en.wikipedia.org\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/si.wikipedia.org\/w\/api.php?action=opensearch",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/www.signatur.rtr.at\/de\/directory\/cps.html0",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/udn.com\/favicon.ico",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/rover.ebay.com",
                "type": "ioc",
                "description": null
            },
            {
                "category": "url",
                "ioc": "http:\/\/search.ebay.fr\/",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "memdump_urls"
    },
    {
        "markcount": 4,
        "families": [],
        "description": "Attempts to identify installed AV products by installation directory",
        "severity": 3,
        "marks": [
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore.exe",
                "type": "ioc",
                "description": null
            },
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore\\Avira.OE.WinCore.dll",
                "type": "ioc",
                "description": null
            },
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore.dll",
                "type": "ioc",
                "description": null
            },
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\Avira.OE.WinCore\\Avira.OE.WinCore.exe",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "antiav_detectfile"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Attempts to create or modify system certificates",
        "severity": 3,
        "marks": [
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\\Blob",
                "type": "ioc",
                "description": null
            },
            {
                "category": "registry",
                "ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "modifies_certificates"
    },
    {
        "markcount": 6,
        "families": [],
        "description": "Resumed a suspended thread in a remote process potentially indicative of process injection",
        "severity": 3,
        "marks": [
            {
                "category": "Process injection",
                "ioc": "Process 1576 resumed a thread in remote process 2736",
                "type": "ioc",
                "description": null
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtResumeThread",
                    "return_value": 0,
                    "arguments": {
                        "thread_handle": "0x000002d8",
                        "suspend_count": 1,
                        "process_identifier": 2736
                    },
                    "time": 1575258910.046625,
                    "tid": 2728,
                    "flags": {}
                },
                "pid": 1576,
                "type": "call",
                "cid": 638209
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtResumeThread",
                    "return_value": 0,
                    "arguments": {
                        "thread_handle": "0x000002e0",
                        "suspend_count": 1,
                        "process_identifier": 2736
                    },
                    "time": 1575258910.296625,
                    "tid": 2728,
                    "flags": {}
                },
                "pid": 1576,
                "type": "call",
                "cid": 638211
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtResumeThread",
                    "return_value": 0,
                    "arguments": {
                        "thread_handle": "0x000002e4",
                        "suspend_count": 1,
                        "process_identifier": 2736
                    },
                    "time": 1575258910.562625,
                    "tid": 2728,
                    "flags": {}
                },
                "pid": 1576,
                "type": "call",
                "cid": 638213
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtResumeThread",
                    "return_value": 0,
                    "arguments": {
                        "thread_handle": "0x000002e8",
                        "suspend_count": 1,
                        "process_identifier": 2736
                    },
                    "time": 1575258910.812625,
                    "tid": 2728,
                    "flags": {}
                },
                "pid": 1576,
                "type": "call",
                "cid": 638216
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtResumeThread",
                    "return_value": 0,
                    "arguments": {
                        "thread_handle": "0x000002ec",
                        "suspend_count": 1,
                        "process_identifier": 2736
                    },
                    "time": 1575258911.062625,
                    "tid": 2728,
                    "flags": {}
                },
                "pid": 1576,
                "type": "call",
                "cid": 638218
            }
        ],
        "references": [
            "www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
        ],
        "name": "injection_resumethread"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 546,
            "time": 3.07861590385437,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 27906,
            "time": 9.078912019729614,
            "dport": 138,
            "sport": 138
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 29750,
            "time": 38.44126296043396,
            "dport": 5355,
            "sport": 49556
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 30070,
            "time": 6.761756896972656,
            "dport": 5355,
            "sport": 49840
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 30390,
            "time": 33.160255908966064,
            "dport": 5355,
            "sport": 50202
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 30710,
            "time": 56.91720199584961,
            "dport": 5355,
            "sport": 50952
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 31030,
            "time": 3.040226936340332,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 31358,
            "time": 70.52145409584045,
            "dport": 5355,
            "sport": 51670
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 31678,
            "time": 11.987464904785156,
            "dport": 5355,
            "sport": 52259
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 31998,
            "time": 1.0383808612823486,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 32326,
            "time": 3.0517380237579346,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 32654,
            "time": 52.17884302139282,
            "dport": 5355,
            "sport": 54025
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 32974,
            "time": 26.300602912902832,
            "dport": 5355,
            "sport": 54237
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 33294,
            "time": 1.55702805519104,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 33622,
            "time": 19.387507915496826,
            "dport": 5355,
            "sport": 54335
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 33942,
            "time": -0.08912801742553711,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 34270,
            "time": 64.68331503868103,
            "dport": 5355,
            "sport": 55385
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 34590,
            "time": 4.16948390007019,
            "dport": 5355,
            "sport": 55880
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 34910,
            "time": 45.85964894294739,
            "dport": 5355,
            "sport": 56347
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 35230,
            "time": 35.73251509666443,
            "dport": 5355,
            "sport": 56353
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 35550,
            "time": 55.302720069885254,
            "dport": 5355,
            "sport": 56388
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 35870,
            "time": 59.480515003204346,
            "dport": 5355,
            "sport": 58056
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 36190,
            "time": 54.77569603919983,
            "dport": 5355,
            "sport": 58651
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 36510,
            "time": 25.739147901535034,
            "dport": 5355,
            "sport": 58989
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 36830,
            "time": 62.079617977142334,
            "dport": 5355,
            "sport": 59113
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 37150,
            "time": 48.43892502784729,
            "dport": 5355,
            "sport": 59490
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 37470,
            "time": 23.168349027633667,
            "dport": 5355,
            "sport": 59548
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 37790,
            "time": 28.878211975097656,
            "dport": 5355,
            "sport": 60071
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 38110,
            "time": 41.041922092437744,
            "dport": 5355,
            "sport": 60575
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 38430,
            "time": 30.557776927947998,
            "dport": 5355,
            "sport": 62601
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 38750,
            "time": 57.87830185890198,
            "dport": 5355,
            "sport": 63089
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 39070,
            "time": 16.81537699699402,
            "dport": 5355,
            "sport": 63506
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 39390,
            "time": 27.95568609237671,
            "dport": 5355,
            "sport": 63646
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 39710,
            "time": 9.414735078811646,
            "dport": 5355,
            "sport": 64017
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 40030,
            "time": 1.5671238899230957,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 59440,
            "time": 1.072516918182373,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 67824,
            "time": 3.1252739429473877,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "465431e984c14b4a568de60c183265f039f454e1863bbcf374c0d1cd31b042fc",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "b141cf4c5bc0e7bc5a9d1927afc8e10c5fa154881078753aea916f37cd901265",
    "irc": [],
    "https_ex": []
}

Screenshots

Screenshot from the sandboxScreenshot from the sandboxScreenshot from the sandbox

Other files also named avira.servicehost.exe

avira.servicehost.exe (41 votes)

Hashes [?]

PropertyValue
MD58e1960ed88843d85e3334befb4c50672
SHA256ffff6980f289b3cb06da80568f627919906dcf6147a3b29e4955fba10707dcd4

Error Messages

These are some of the error messages that can appear related to avira.servicehost.exe:

avira.servicehost.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

avira.servicehost.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.

Avira Service Host has stopped working.

End Program - avira.servicehost.exe. This program is not responding.

avira.servicehost.exe is not a valid Win32 application.

avira.servicehost.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.

What will you do with the file?

To help other users, please let us know what you will do with the file:



Malware or legitimate?

If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.

Please select the option that best describe your thoughts on the information provided on this web page


Free online surveys

And now some shameless self promotion ;)

A screenshot of FreeFixer's scan result.Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.

If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

No comments posted yet.

Leave a reply